"any Executive department, military department, Government corporation, Government controlled corporation, or other establishment in the executive branch of the [federal] Government (including the Executive Office of the President), or any independent regulatory agency." 5 U.S.C. § 552a(1) (incorporating 5 U.S.C. § 552(f) (2000), which in turn incorporates 5 U.S.C. § 551(1) (2000)).
Comment:
The Privacy Act -- like the Freedom of Information Act, 5 U.S.C. § 552 -- applies only to a federal "agency." See OMB Guidelines, 40 Fed. Reg. 28,948, 28,950-51 (July 9, 1975); 120 Cong. Rec. 40,408 (1974), reprinted in Source Book at 866 (indicating intent that Act apply to Postal Service, Postal Rate Commission, and government corporations or government controlled corporations); 120 Cong. Rec. 36,967 (1974), reprinted in Source Book at 958 (indicating intent that term "agency" be given "its broadest statutory meaning," and, giving example of Department of Justice as an "agency," recognizing propriety of subsection (b)(1) "need to know" disclosures between its various components); see also, e.g., NLRB v. USPS, 841 F.2d 141, 144 n.3 (6th Cir. 1988) (Postal Service is an "agency" because it is an "independent establishment of the executive branch"); Ehm v. Nat'l R.R. Passenger Corp., 732 F.2d 1250, 1252-55 (5th Cir. 1984) (Amtrak held not to constitute a "Government-controlled corporation"); Mumme v. United States Dep't of Labor, 150 F. Supp. 2d 162, 169 (D. Me. 2001) ("[A] claimant bringing a Privacy Act claim must bring suit against a particular agency, not the entire United States." (referencing prior related opinion, No. 00-CV-96-B-S (D. Me. May 25, 2001))), aff'd, No. 01-2256 (1st Cir. June 12, 2002). But cf. Shannon v. Gen. Elec. Co., 812 F. Supp. 308, 313, 315 n.5 (N.D.N.Y. 1993) ("no dispute" that GE falls within definition of "agency" subject to requirements of Privacy Act where pursuant to contract it operated Department of Energy-owned lab under supervision, control, and oversight of Department and where by terms of contract GE agreed to comply with Privacy Act).
With regard to the White House, all but one of the courts that have considered the issue have held that those components of the Executive Office of the President whose sole function is to advise and assist the President are not "agencies" for purposes of the Privacy Act. Compare Dale v. Executive Office of the President, 164 F. Supp. 2d 22, 25-26 (D.D.C. 2001); Trulock v. United States Dep't of Justice, No. 00-2234, slip op. at 7 (D.D.C. Sept. 18, 2001); Tripp v. Executive Office of the President, 200 F.R.D. 140, 142-46 (D.D.C. 2001), appeal dismissed per curiam, No. 01-5189, 2001 WL 1488614 (D.C. Cir. Oct. 17, 2001); Broaddrick v. Executive Office of the President, 139 F. Supp. 2d 55, 60 (D.D.C. 2001), aff'd per curiam, No. 01-5178 (D.C. Cir. May 1, 2002); Flowers v. Executive Office of the President, 142 F. Supp. 2d 38, 41-43 (D.D.C. 2001); Jones v. Executive Office of the President, 167 F. Supp. 2d 10, 13-20 (D.D.C. 2001); Sculimbrene v. Reno, 158 F. Supp. 2d 26, 35-36 (D.D.C. 2001); Schwarz v. United States Dep't of Treasury, 131 F. Supp. 2d 142, 147-48 (D.D.C. 2000), summary affirmance granted, No. 00-5453 (D.C. Cir. May 10, 2001); Falwell v. Executive Office of the President, 113 F. Supp. 2d 967, 968-70 (W.D. Va. 2000); and Barr v. Executive Office of the President, No. 99-CV-1695, 2000 WL 33539396, at *3 (D.D.C. Aug. 9, 2000), with Alexander v. FBI, 971 F. Supp. 603, 606-07 (D.D.C. 1997) (although recognizing that the definition of "agency" under the Privacy Act is the same as in the FOIA and that courts have interpreted that definition under the FOIA to exclude the President's immediate personal staff and units within the Executive Office of the President whose sole function is to advise and assist the President, nevertheless rejecting such limitation with regard to "agency" as used in the Privacy Act due to "the very different purposes the two statutes serve"), petition for permission to appeal from interlocutory order denied, No. 97-8059 (D.C. Cir. Oct. 10, 1997), subsequent related decision, 193 F.R.D. 1 (D.D.C. 2000), mandamus denied per curiam sub nom. In re: Executive Office of the President, 215 F.3d 20, 24-25 (D.C. Cir. 2000) (stating that the White House "remains free to adhere to the position that the Privacy Act does not cover members of the White House Office").
Note also that federal entities outside of the executive branch, such as a federal district court, see Cobell v. Norton, 157 F. Supp. 2d 82, 86 & n.6 (D.D.C. 2001), a grand jury, see Standley v. Dep't of Justice, 835 F.2d 216, 218 (9th Cir. 1987), a probation office, see Schwartz v. United States Dep't of Justice, No. 95-6423, 1996 WL 335757, at *1 (2d Cir. June 6, 1996), aff'g No. 94 CIV. 7476, 1995 WL 675462, at *7 (S.D.N.Y. Nov. 14, 1995); United States v. Chandler, 220 F. Supp. 2d 165, 167-68 (E.D.N.Y. 2002); Harrell v. United States Bureau of Prisons, No. 99-1619, slip op. at 6 (W.D. Okla. Mar. 5, 2001), aff'd on other grounds sub nom. Harrell v. Fleming, 285 F.3d 1292 (10th Cir. 2002); Callwood v. Dep't of Prob. of the V.I., 982 F. Supp. 341, 343 (D.V.I. 1997); Chambers v. Div. of Prob., No. 87-0163, 1987 WL 10133, at *1 (D.D.C. Apr. 8, 1987), or a federal bankruptcy court, see In re Adair, 212 B.R. 171, 173 (Bankr. N.D. Ga. 1997), are not subject to the Act. Similarly, the Smithsonian Institution, although having many "links" with the federal government, "is not an agency for Privacy Act purposes." Dong v. Smithsonian Inst., 125 F.3d 877, 879-80 (D.C. Cir. 1997).
State and local government agencies are not covered by the Privacy Act. See, e.g., Perez-Santos v. Malave, 23 Fed. Appx. 11, 12 (1st Cir. 2001) (per curiam); Dittman v. California, 191 F.3d 1020, 1026, 1029 (9th Cir. 1999); Ortez v. Washington County, Or., 88 F.3d 804, 811 (9th Cir. 1996); Brown v. Kelly, No. 93-5222, 1994 WL 36144, at *1 (D.C. Cir. Jan. 27, 1994) (per curiam); Monk v. Teeter, No. 89-16333, 1992 WL 1681, at *2 (9th Cir. Jan. 8, 1992); Davidson v. Georgia, 622 F.2d 895, 896 (5th Cir. 1980); Schmitt v. City of Detroit, 267 F. Supp. 2d 718, 722 (E.D. Mich. 2003) (appeal pending); Villa v. Vill. of Elmore, No. 3:02CV7357, 2002 WL 31728970, at *5 (N.D. Ohio Dec. 3, 2002), appeal dismissed sua sponte as untimely, No. 03-3034 (6th Cir. Mar. 28, 2003); Daniel v. Safir, 175 F. Supp. 2d 474, 481 (E.D.N.Y. 2001) (although characterizing claims as under FOIA, dismissing Privacy Act claims against local agency), aff'd, 42 Fed. Appx. 528 (2d Cir. 2002); Atamian v. Ellis, No. 00-797, 2001 WL 699016, at *3 (D. Del. June 19, 2001), aff'd, 35 Fed. Appx. 356 (3d Cir. 2002) (unpublished table decision); Lampkin v. N.Y. City Dep't of Prob., No. 00 Civ. 7165, 2001 WL 210362, at *2 (S.D.N.Y. Feb. 28, 2001); Markun v. Hillsborough County Dep't of Corr., No. 97-208, 1999 WL 813949, at *1 (D.N.H. Sept. 17, 1999); McClain v. United States Dep't of Justice, No. 97 C 0385, 1999 WL 759505, at *2 (N.D. Ill. Sept. 1, 1999), aff'd, 17 Fed. Appx. 471 (7th Cir. 2001); Ferguson v. Ala. Criminal Justice Info. Ctr., 962 F. Supp. 1446, 1446-47 (M.D. Ala. 1997); Williams v. District of Columbia, No. 95CV0936, 1996 WL 422328, at **2-3 (D.D.C. July 19, 1996); Martinson v. Violent Drug Traffickers Project, No. 95-2161, 1996 WL 411590, at **1-2 (D.D.C. July 11, 1996), summary affirmance granted, No. 96-5262 (D.C. Cir. Sept. 22, 1997); Mamarella v. County of Westchester, 898 F. Supp. 236, 237-38 (S.D.N.Y. 1995); Reno v. United States, No. 4:94CV243, 1995 U.S. Dist. LEXIS 12834, at *6 (W.D.N.C. Aug. 14, 1995) (state national guard); Connolly v. Beckett, 863 F. Supp. 1379, 1383-84 (D. Colo. 1994); MR by RR v. Lincolnwood Bd. of Educ., Dist. 74, 843 F. Supp. 1236, 1239-40 (N.D. Ill. 1994), aff'd sub nom. Rheinstrom v. Lincolnwood Bd. of Educ., Dist. 74, No. 94-1357, 1995 U.S. App. LEXIS 10781 (7th Cir. May 10, 1995); Malewich v. USPS, No. 91-4871, slip op. at 19 (D.N.J. Apr. 8, 1993), aff'd, 27 F.3d 557 (3d Cir. 1994) (unpublished table decision); Shields v. Shetler, 682 F. Supp. 1172, 1176 (D. Colo. 1988); Ryans v. N.J. Comm'n, 542 F. Supp. 841, 852 (D.N.J. 1982). Additionally, neither federal funding nor regulation converts such entities into covered agencies. See St. Michaels Convalescent Hosp. v. California, 643 F.2d 1369, 1373 (9th Cir. 1981); Adelman v. Discover Card Servs., 915 F. Supp. 1163, 1166 (D. Utah 1996). The Act likewise does not apply to tribal entities. See Stevens v. Skenandore, No. 99-2611, 2000 WL 1069404, at *1 (7th Cir. Aug. 1, 2000) (no right of action against tribal officials under Privacy Act).
Similarly, private entities are not subject to the Act. See, e.g., Chimarev v. TD Waterhouse Investor Servs., No. 03-7916, 2004 WL 1013320, at *2 (2d Cir. May 6, 2004); McLeod v. VA, 43 Fed. Appx. 70, 71 (9th Cir. 2002); Sharwell v. Best Buy, No. 00-3206, 2000 WL 1478341, at *2 (6th Cir. Sept. 26, 2000); Sutton v. Providence St. Joseph Med. Ctr., 192 F.3d 826, 844 (9th Cir. 1999); Mitchell v. G.E. Am. Spacenet, No. 96-2624, 1997 WL 226369, at *1 (4th Cir. May 7, 1997); Gilbreath v. Guadalupe Hosp. Found., 5 F.3d 785, 791 (5th Cir. 1993); Locke v. MedLab/Gen. Chem., No. 99-2137, 2000 WL 127111 (E.D. Pa. Feb. 3, 2000); Payne v. EEOC, No. 99-270, slip op. at 2-3 (D.N.M. July 7, 1999), aff'd, No. 00-2021, 2000 WL 1862659, at *2 (10th Cir. Dec. 20, 2000); Davis v. Boston Edison Co., No. 83-1114-2, 1985 U.S. Dist. LEXIS 23275 (D. Mass. Jan. 21, 1985); Friedlander v. USPS, No. 84-773, slip op. at 5-6 (D.D.C. Oct. 16, 1984); Marshall v. Park Place Hosp., 3 Gov't Disclosure Serv. (P-H) ¶ 83,088, at 83,057 (D.D.C. Feb. 25, 1983); see also Bybee v. Pirtle, No. 96-5077, 1996 WL 596458, at *1 (6th Cir. Oct. 16, 1996) (appellant did not state claim under Privacy Act because it does not apply to individuals who refused to hire him due to his failure to furnish his social security number or fill out W-4 forms for income tax purposes); Steadman v. Rocky Mountain News, No. 95-1102, 1995 U.S. App. LEXIS 34986, at *4 (10th Cir. Dec. 11, 1995) (Privacy Act claims "cannot be brought against defendant because defendant is not a governmental entity"); United States v. Mercado, No. 94-3976, 1995 U.S. App. LEXIS 2054, at **3-4 (6th Cir. Jan. 31, 1995) (appellant's retained defense counsel is not an "agency"). Additionally, neither federal funding nor regulation renders such private entities subject to the Act. See Unt v. Aerospace Corp., 765 F.2d 1440, 1448 (9th Cir. 1985); United States v. Haynes, 620 F. Supp. 474, 478-79 (M.D. Tenn. 1985); Dennie v. Univ. of Pittsburgh Sch. of Med., 589 F. Supp. 348, 351-52 (D.V.I. 1984), aff'd, 770 F.2d 1068 (3d Cir. 1985) (unpublished table decision); see also United States v. Miller, 643 F.2d 713, 715 n.1 (10th Cir. 1981) (finding that definition of "agency" does not encompass national banks); Boggs v. Se. Tidewater Opportunity Project, No. 2:96cv196, 1996 U.S. Dist. LEXIS 6977, at **5-9 (E.D. Va. May 22, 1996) (rejecting plaintiff's argument concerning entity's acceptance of federal funds and stating that "[i]t is well settled that the Administrative Procedures [sic] Act, 5 U.S.C. § 551 . . . applies only to Federal agencies").
An exception to this rule, however, is the social security number usage restrictions, contained in section 7 of the Privacy Act, which do apply to federal, state, and local government agencies. (section 7, part of Pub. L. No. 93-579, can be found at 5 U.S.C. § 552a note (Disclosure of Social Security Number)). This special provision is discussed below under "Social Security Number Usage."
A civil action under the Privacy Act is properly filed against an "agency" only, not against an individual, a government official, an employee, or the United States. See, e.g., Connelly v. Comptroller of the Currency, 876 F.2d 1209, 1215 (5th Cir. 1989); Petrus v. Bowen, 833 F.2d 581, 582-83 (5th Cir. 1987); Schowengerdt v. Gen. Dynamics Corp., 823 F.2d 1328, 1340 (9th Cir. 1987); Hewitt v. Grabicki, 794 F.2d 1373, 1377 & n.2 (9th Cir. 1986); Unt, 765 F.2d at 1447; Brown-Bey v. United States, 720 F.2d 467, 469 (7th Cir. 1983); Windsor v. The Tennessean, 719 F.2d 155, 159-60 (6th Cir. 1983); Bruce v. United States, 621 F.2d 914, 916 n.2 (8th Cir. 1980); Parks v. IRS, 618 F.2d 677, 684 (10th Cir. 1980); Buckles v. Indian Health Serv./Belcourt Serv. Unit, 268 F. Supp. 2d 1101, 1102 (D.N.D. 2003); Stokes v. Barnhart, 257 F. Supp. 2d 288, 299 (D. Me. 2003); Mandel v. OPM, 244 F. Supp. 2d 146, 153 (E.D.N.Y. 2003), aff'd on other grounds, 79 Fed. Appx. 479 (2d Cir. 2003); Mumme v. United States Dep't of Labor, 150 F. Supp. 2d 162, 169 (D. Me. 2001), aff'd, No. 01-2256 (1st Cir. June 12, 2002); Payne v. EEOC, No. 99-270, slip op. at 2 (D.N.M. July 7, 1999), aff'd, No. 00-2021, 2000 WL 1862659, at *2 (10th Cir. Dec. 20, 2000); Armstrong v. United States Bureau of Prisons, 976 F. Supp. 17, 23 (D.D.C. 1997), summary affirmance granted sub nom. Armstrong v. Fed. Bureau of Prisons, No. 97-5208, 1998 WL 65543 (D.C. Cir. Jan. 30, 1998); Claasen v. Brown, No. 94-1018, 1996 WL 79490, at **3-4 (D.D.C. Feb. 16, 1996); Lloyd v. Coady, No. 94-5842, 1995 U.S. Dist. LEXIS 2490, at **3-4 (E.D. Pa. Feb. 28, 1995), upon consideration of amended complaint, 1995 U.S. Dist. LEXIS 6258, at *3 n.2 (E.D. Pa. May 9, 1995); Hill v. Blevins, No. 3-CV-92-0859, slip op. at 4-5 (M.D. Pa. Apr. 12, 1993), aff'd, 19 F.3d 643 (3d Cir. 1994) (unpublished table decision); Malewich, No. 91-4871, slip op. at 19 (D.N.J. Apr. 8, 1993); Sheptin v. United States Dep't of Justice, No. 91-2806, 1992 U.S. Dist. LEXIS 6221, at **5-6 (D.D.C. Apr. 30, 1992); Williams v. McCausland, 791 F. Supp. 992, 1000 (S.D.N.Y. 1992); Mittleman v. United States Treasury, 773 F. Supp. 442, 450 (D.D.C. 1991); Stephens v. TVA, 754 F. Supp. 579, 580 n.1 (E.D. Tenn. 1990); B.J.R.L. v. Utah, 655 F. Supp. 692, 696-97 (D. Utah 1987); Dennie, 589 F. Supp. at 351-53; Gonzalez v. Leonard, 497 F. Supp. 1058, 1075-76 (D. Conn. 1980); see also Bavido v. Apfel, 215 F.3d 743, 747 (7th Cir. 2000) (finding that Social Security Administration Commissioner was not proper party defendant, but that Social Security Administration had waived any objection as to naming of proper party agency defendant); cf. Stewart v. FBI, No. 97-1595, 1999 U.S. Dist. LEXIS 21335, at **15-22 (D. Or. Dec. 10, 1999) (magistrate's recommendation) (actions of two Air Force officers assigned to other agencies were not attributable to Air Force; neither were their actions attributable to State Department, because although they both physically worked at embassy and ambassador had supervisory responsibility over all executive branch agency employees, neither reported to State Department or ambassador), adopted, 2000 U.S. Dist. LEXIS 2954 (D. Or. Mar. 15, 2000). One court also noted, though, that while of course a Privacy Act action "must be maintained against an agency," it is "unaware of any authority which requires the Plaintiffs to specifically name, either as an individual defendant or within the body of a complaint, each and every agency employee who may have contributed to an alleged Privacy Act violation." Buckles v. Indian Health Serv./Belacourt Serv. Unit, 305 F. Supp. 2d 1108, 1112 (D.N.D. 2004).
Some courts have held that the head of an agency, if sued in his or her official capacity, can be a proper party defendant under the Privacy Act. See Hampton, No. 93-0816, slip op. at 8, 10-11 (D.D.C. June 30, 1995); Jarrell v. Tisch, 656 F. Supp. 237, 238 (D.D.C. 1987); Diamond v. FBI, 532 F. Supp. 216, 219-20 (S.D.N.Y. 1981), aff'd, 707 F.2d 75 (2d Cir. 1983); Nemetz v. Dep't of the Treasury, 446 F. Supp. 102, 106 (N.D. Ill. 1978); Rowe v. Tennessee, 431 F. Supp. 1257, 1264 (M.D. Tenn. 1977), vacated on other grounds, 609 F.2d 259 (6th Cir. 1979). Further, leave to amend a complaint to substitute a proper party defendant ordinarily is freely granted where the agency is on notice of the claim. See, e.g., Reyes v. Supervisor of DEA, 834 F.2d 1093, 1097 (1st Cir. 1987); Petrus, 833 F.2d at 583. But cf. Doe v. Rubin, No. 95-CV-75874, 1998 U.S. Dist. LEXIS 14755, at *9 (E.D. Mich. Aug. 10, 1998) (granting summary judgment for defendant where plaintiff had named Secretary of the Treasury as sole defendant and had filed no motion to amend).
Note that a prosecution enforcing the Privacy Act's criminal penalties provision, 5 U.S.C. § 552a(i) (see "Criminal Penalties" discussion below), would of course properly be filed against an individual. See Stone v. Def. Investigative Serv., 816 F. Supp. 782, 785 (D.D.C. 1993) ("Under the Privacy Act, this Court has jurisdiction over individually named defendants only for unauthorized disclosure in violation of 5 U.S.C. § 552a(i)."); see also Hampton v. FBI, No. 93-0816, slip op. at 8, 10-11 (D.D.C. June 30, 1995) (citing Stone).
"a citizen of the United States or an alien lawfully admitted for permanent residence." 5 U.S.C. § 552a(a)(2).
Comment:
Compare this definition with the FOIA's much broader "any person" definition (5 U.S.C. § 552(a)(3) (2000)). See, e.g., Fares v. INS, No. 94-1339, 1995 WL 115809, at *4 (4th Cir. 1995) (per curiam) ("[Privacy] Act only protects citizens of the United States or aliens lawfully admitted for permanent residence."); Raven v. Panama Canal Co., 583 F.2d 169, 170-71 (5th Cir. 1978) (same as Fares, and comparing "use of the word 'individual' in the Privacy Act, as opposed to the word 'person,' as more broadly used in the FOIA"); Cudzich v. INS, 886 F. Supp. 101, 105 (D.D.C. 1995) (A plaintiff whose permanent resident status had been revoked "is not an 'individual' for the purposes of the Privacy Act. . . . Plaintiff's only potential access to the requested information is therefore under the Freedom of Information Act.").
Deceased individuals do not have any Privacy Act rights, nor do executors or next-of-kin. See OMB Guidelines, 40 Fed. Reg. 28,948, 28,951 (July 9, 1975); see also Monk v. Teeter, No. 89-16333, 1992 WL 1681, at *2 (9th Cir. Jan. 8. 1992); Crumpton v. United States, 843 F. Supp. 751, 756 (D.D.C. 1994), aff'd on other grounds sub nom. Crumpton v. Stone, 59 F.3d 1400 (D.C. Cir. 1995).
Corporations and organizations also do not have any Privacy Act rights. See St. Michaels Convalescent Hosp. v. California, 643 F.2d 1369, 1373 (9th Cir. 1981); OKC v. Williams, 614 F.2d 58, 60 (5th Cir. 1980); Dresser Indus. v. United States, 596 F.2d 1231, 1237-38 (5th Cir. 1980); Cell Assocs. v. NIH, 579 F.2d 1155, 1157 (9th Cir. 1978); Stone v. Exp.-Imp. Bank of the United States, 552 F.2d 132, 137 n.7 (5th Cir. 1977); Falwell v. Executive Office of the President, 158 F. Supp. 2d 734, 736, 739 n.3 (W.D. Va. 2001); Comm. in Solidarity v. Sessions, 738 F. Supp. 544, 547 (D.D.C. 1990), aff'd on other grounds, 929 F.2d 742 (D.C. Cir. 1991); United States v. Haynes, 620 F. Supp. 474, 478-79 (M.D. Tenn. 1985); Utah-Ohio Gas & Oil, Inc. v. SEC, 1 Gov't Disclosure Serv. (P-H) ¶ 80,038, at 80,114 (D. Utah Jan. 9, 1980); see also OMB Guidelines, 40 Fed. Reg. at 28,951. But cf. Recticel Foam Corp. v. United States Dep't of Justice, No. 98-2523, slip op. at 11-15 (D.D.C. Jan. 31, 2002) (issuing novel ruling that corporation had standing to bring action under Administrative Procedure Act to enjoin agency from disclosing investigative information about company; "[T]he fact that Congress did not create a cause of action for corporations under the Privacy Act does not necessarily mean that Recticel's interests do not fall within the 'zone of interests' contemplated by that Act. It is sufficient for a standing analysis that Plaintiffs' interests 'arguably' fall within the zone of interests contemplated by the statute."), appeal dismissed, No. 02-5118 (D.C. Cir. Apr. 25, 2002).
The OMB Guidelines suggest that an individual has no standing under the Privacy Act to challenge agency handling of records that pertain to him solely in his "entrepreneurial" capacity. OMB Guidelines, 40 Fed. Reg. at 28,951 (quoting legislative history and stating that it "suggests that a distinction can be made between individuals acting in a personal capacity and individuals acting in an entrepreneurial capacity (e.g., as sole proprietors) and that th[e] definition [of 'individual'] (and, therefore, the Act) was intended to embrace only the former"). However, there is a split of authority concerning OMB's personal/entrepreneurial distinction as applied to an individual. Compare Shermco Indus. v. Sec'y of the United States Air Force, 452 F. Supp. 306, 314-15 (N.D. Tex. 1978) (accepting distinction), rev'd & remanded on other grounds, 613 F.2d 1314 (5th Cir. 1980), and Daniels v. FCC, No. 77-5011, slip op. at 8-9 (D.S.D. Mar. 15, 1978) (same), with Henke v. Dep't of Commerce, No. 94-189, 1995 WL 904918, at *2 (D.D.C. May 26, 1995) (rejecting distinction), vacated & remanded on other grounds, 83 F.3d 1453 (D.C. Cir. 1996); Henke v. United States Dep't of Commerce, No. 94-0189, 1996 WL 692020, at **2-3 (D.D.C. Aug. 19, 1994) (same), aff'd on other grounds, 83 F.3d 1445 (D.C. Cir. 1996); Metadure Corp. v. United States, 490 F. Supp. 1368, 1373-74 (S.D.N.Y. 1980) (same); Fla. Med. Ass'n v. HEW, 479 F. Supp. 1291, 1307-11 (M.D. Fla. 1979) (same); and Zeller v. United States, 467 F. Supp. 487, 496-99 (E.D.N.Y. 1979) (same). Cf. St. Michaels Convalescent Hosp., 643 F.2d at 1373 (stating that "sole proprietorships[] are not 'individuals' and thus lack standing to raise a claim under the Privacy Act").
Privacy Act rights are personal to the individual who is the subject of the record and cannot be asserted derivatively by others. See, e.g., Parks v. IRS, 618 F.2d 677, 684-85 (10th Cir. 1980) (union lacks standing to sue for damages to its members); Word v. United States, 604 F.2d 1127, 1129 (8th Cir. 1979) (criminal defendant lacks standing to allege Privacy Act violations regarding use at trial of medical records concerning third party); Dresser Indus., 596 F.2d at 1238 (company lacks standing to litigate employees' Privacy Act claims); Sirmans v. Caldera, 27 F. Supp. 2d 248, 250 (D.D.C. 1998) (plaintiffs "may not object to the Army's failure to correct the records of other officers"); Shulman v. Sec'y of HHS, No. 94 CIV. 5506, 1997 WL 68554, at **1, 3 (S.D.N.Y. Feb. 19, 1997) (plaintiff had no standing to assert any right that might have belonged to former spouse), aff'd, No. 96-6140 (2d Cir. Sept. 3, 1997); Harbolt v. United States Dep't of Justice, No. A-84-CA-280, slip op. at 2 (W.D. Tex. Apr. 29, 1985) (prisoner lacks standing to assert Privacy Act claims of other inmates regarding disclosure of their records to him); Abramsky v. United States Consumer Prod. Safety Comm'n, 478 F. Supp. 1040, 1041-42 (S.D.N.Y. 1979) (union president cannot compel release of records pertaining to employee's termination); Attorney Gen. of the United States v. Irish N. Aid Comm., No. 77-700, 1977 U.S. Dist. LEXIS 13581, at *12 (S.D.N.Y. Oct. 7, 1977) (committee lacks standing to sue in representative capacity). But see Nat'l Fed'n of Fed. Employees v. Greenberg, 789 F. Supp. 430, 433 (D.D.C. 1992) (union has associational standing because members whose interests union seeks to represent would themselves have standing), vacated & remanded on other grounds, 983 F.2d 286 (D.C. Cir. 1993).
Note, however, that the parent of any minor, or the legal guardian of an incompetent, may act on behalf of that individual. See 5 U.S.C. § 552a(h); see also Gula v. Meese, 699 F. Supp. 956, 961 (D.D.C. 1988); cf. Maldonado Guzman v. Massanari, No. 00-2410, slip op. at 6-7 (D.P.R. Aug. 10, 2001) (holding that plaintiff had no avenue of relief in obtaining information about his emancipated daughter under Privacy Act because he did not provide documentation required by agency regulations to verify any relationship as her legal guardian), subsequent related opinion sub nom. Maldonado Guzman v. Comm'r of Soc. Sec., 182 F. Supp. 2d 216 (D.P.R. 2002). The OMB Guidelines note that subsection (h) is "discretionary and that individuals who are minors are authorized to exercise the rights given to them by the Privacy Act or, in the alternative, their parents or those acting in loco parentis may exercise them in their behalf." OMB Guidelines, 40 Fed. Reg. at 28,970; see also OMB Guidelines, 40 Fed. Reg. 56,741, 56,742 (Nov. 21, 1975) (noting that "[t]here is no absolute right of a parent to have access to a record about a child absent a court order or consent").
"maintain, collect, use or disseminate." 5 U.S.C. § 552a(a)(3).
Comment:
This definition embraces various activities with respect to records and has a meaning much broader than the common usage of the term. See OMB Guidelines, 40 Fed. Reg. 28,948, 28,951 (July 9, 1975); see also, e.g., Albright v. United States, 631 F.2d 915, 918-20 (D.C. Cir. 1980) (analyzing scope of term "maintain" in context of subsection (e)(7) challenge to record describing First Amendment-protected activity and stating that "the Act clearly prohibits even the mere collection of such a record, independent of the agency's maintenance, use or dissemination of it thereafter").
"any item, collection, or grouping of information about an individual that is maintained by an agency, including, but not limited to, his education, financial transactions, medical history, and criminal or employment history and that contains his name, or the identifying number, symbol, or other identifying particular assigned to the individual, such as a finger or voice print or a photograph." 5 U.S.C. § 552a(a)(4).
Comment:
To qualify as a Privacy Act "record," the information must identify an individual. Compare Reuber v. United States, 829 F.2d 133, 142 (D.C. Cir. 1987) (letter reprimanding individual sent to and disclosed by agency was "record" because it clearly identified individual by name and address), with Robinson v. United States Dep't of Educ., No. 87-2554, 1988 WL 5083, at *1 (E.D. Pa. Jan. 20, 1988) (letter describing individual's administrative complaint was not "record" because it did not mention his name). See also Albright v. United States, 631 F.2d 915, 920 (D.C. Cir. 1980) (subsection (e)(7) case holding that a videotape of a meeting constituted a "record" and stating that "[a]s long as the tape contains a means of identifying an individual by picture or voice, it falls within the definition of a 'record' under the Privacy Act"); Fleming v. United States R.R. Ret. Bd., No. 01 C 6289, 2002 WL 252459, at *2 (N.D. Ill. Feb. 21, 2002) (citing Robinson and holding that a summary of an investigation of plaintiff that was disclosed in a semi-annual report to Congress did not identify plaintiff and thus did not constitute a "record" because disclosure "would have identified plaintiff only to an individual who had other information that would have caused that individual to infer from the report that plaintiff was the subject of the investigation").
The OMB Guidelines state that the term "record" means "any item of information about an individual that includes an individual identifier," OMB Guidelines, 40 Fed. Reg. 28,948, 28,951 (July 9, 1975), and "'can include as little as one descriptive item about an individual,'" id. at 28,952 (quoting legislative history appearing at 120 Cong. Rec. 40,408, 40,883 (1974), reprinted in Source Book at 866, 993).
Several courts of appeals have articulated tests for determining whether an item qualifies as a "record" under the Privacy Act, resulting in three different tests for determining "record" status:
(1) Consistent with the OMB Guidelines, the Courts of Appeals for the Second and Third Circuits have broadly interpreted the term "record." See Bechhoefer v. United States Dep't of Justice Drug Enforcement Admin., 209 F.3d 57 (2d Cir. 2000); Quinn v. Stone, 978 F.2d 126 (3d Cir. 1992). The Third Circuit held that the term "record" "encompass[es] any information about an individual that is linked to that individual through an identifying particular" and is not "limited to information which taken alone directly reflects a characteristic or quality." Quinn v. Stone, 978 F.2d at 133 (out-of-date home address on roster and time card information held to be records covered by Privacy Act). The Second Circuit, after analyzing the tests established by the other courts of appeals, adopted a test "much like the Third Circuit's test." Bechhoefer, 209 F.3d at 60. The Second Circuit did so for three reasons: First, it found the Third Circuit's test to be "most consistent with the 'broad terms' . . . of the statutory definition," id.; second, it found the Third Circuit's test to be the only one consistent with the Supreme Court's decision in DOD v. FLRA, 510 U.S. 487, 494 (1994), which held that federal civil service employees' home addresses qualified for protection under the Privacy Act, Bechhoefer, 209 F.3d at 61; and, finally, it found the Third Circuit's test to be supported by the legislative history of the Privacy Act and by the guidelines issued by OMB, id. at 61-62. Emphasizing that "the legislative history makes plain that Congress intended 'personal information' . . . to have a broad meaning," the Second Circuit held that the term "record" "has 'a broad meaning encompassing,' at the very least, any personal information 'about an individual that is linked to that individual through an identifying particular.'" Id. at 62 (quoting Quinn and holding that letter containing Bechhoefer's name and "several pieces of 'personal information' about him, including his address, his voice/fax telephone number, his employment, and his membership in [an association]," was record covered by Privacy Act).
Other courts have also applied a broad interpretation of the term "record." See, e.g., Williams v. VA, 104 F.3d 670, 673-74 (4th Cir. 1997) (citing Quinn, inter alia, and stating that "[w]hether the Tobey court's distinction [(discussed below)] be accepted, the legislative history of the Act makes it clear that a 'record' was meant to 'include as little as one descriptive item about an individual,'" and finding that "draft" materials qualified as "records" because they "substantially pertain to Appellant," "contain 'information about' [him], as well as his 'name' or 'identifying number,'" and "do more than merely apply to him" (quoting legislative history, Source Book at 866)); Unt v. Aerospace Corp., 765 F.2d 1440, 1449-50 (9th Cir. 1985) (Ferguson, J., dissenting) (opining that majority's narrow interpretation of term "record" (discussed below) "is illogical, contrary to the legislative intent, and defies the case laws' consistent concern with the actual effect of a record on a person's employment when assessing that record's nature or subject"); Sullivan v. USPS, 944 F. Supp. 191, 196 (W.D.N.Y. 1996) (finding that disclosure to job applicant's employer of fact that applicant had applied for employment with Postal Service constituted disclosure of "record" under Privacy Act; although no other information was disclosed from application, rejecting Postal Service's attempt to distinguish between disclosing fact of record's existence and disclosing information contained in record, as applicant's name was part of information contained in application and Postal Service disclosed that particular applicant by that name had applied for employment); Henke v. United States Dep't of Commerce, No. 94-0189, 1996 WL 692020, at *3 (D.D.C. Aug. 19, 1994) (holding that names of four reviewers who evaluated grant applicant's proposal are applicant's "records" under Privacy Act), aff'd on other grounds, 83 F.3d 1445 (D.C. Cir. 1996).
(2) The Courts of Appeals for the Ninth and Eleventh Circuits have limited Privacy Act coverage by adopting a narrow construction of the term "record" -- requiring that in order to qualify, the information "must reflect some quality or characteristic of the individual involved." Boyd v. Sec'y of the Navy, 709 F.2d 684, 686 (11th Cir. 1983) (per curiam) (although stating narrow test, finding that memorandum reflecting "Boyd's failure to follow the chain of command and his relationship with management" qualified as Privacy Act record); accord Unt v. Aerospace Corp., 765 F.2d 1440, 1448-49 (9th Cir. 1985) (letter written by employee -- containing allegations of mismanagement against corporation that led to his dismissal -- held not his "record" because it was "about" corporation and reflected "only indirectly on any quality or characteristic" of employee).
(3) The Court of Appeals for the District of Columbia Circuit also has adopted a narrow construction of the term by holding that in order to qualify as a "record" an item must contain "information that actually describes the individual in some way." Tobey v. NLRB, 40 F.3d 469, 471-73 (D.C. Cir. 1994). Examining the Third Circuit's statement in Quinn that information could qualify as a record "'if that piece of information were linked with an identifying particular (or was itself an identifying particular),'" the D.C. Circuit rejected the Third Circuit's interpretation "[t]o the extent that . . . [it] fails to require that information both be 'about' an individual and be linked to that individual by an identifying particular." Id. In order to qualify as a "record," the D.C. Circuit ruled, the information "must both be 'about' an individual and include his name or other identifying particular." Id. at 471. On the other hand, the D.C. Circuit rejected "as too narrow the Ninth and Eleventh Circuits' definitions" in Unt and Boyd, and stated that: "So long as the information is 'about' an individual, nothing in the Act requires that it additionally be about a 'quality or characteristic' of the individual." Tobey, 40 F.3d at 472. Ultimately, the D.C. Circuit, "[w]ithout attempting to define 'record' more specifically than [necessary] to resolve the case at bar," held that an NLRB computer system for tracking and monitoring cases did not constitute a system of records, because its files contained no information "about" individuals, despite the fact that the case information contained the initials or identifying number of the field examiner assigned to the case. Id. at 471-73. Although the court recognized that the case information could be, and apparently was, used in connection with other information to draw inferences about a field examiner's job performance, it stated that that "does not transform the [computer system] files into records about field examiners." Id. at 472-73.
Several other courts have also limited Privacy Act coverage by applying narrow constructions of the term "record." See Tripp v. DOD, 193 F. Supp. 2d 229, 236 (D.D.C. 2002) (citing Tobey and stating that salary information for position for which plaintiff had applied "is not 'about' plaintiff -- the fact that she could receive that salary had she been chosen for the position does not convert this into information 'about' plaintiff"); Voinche v. CIA, No. 98-1883, 2000 U.S. Dist. LEXIS 14291, at **8, 11-12 (D.D.C. Sept. 27, 2000) (citing Tobey and Fisher, infra, and finding that records regarding plaintiff's administrative appeal concerning a prior access request and the case files of plaintiff's prior Freedom of Information Act litigation, "while identifying plaintiff by name, are not 'about' the plaintiff, but rather are 'about' the administrative appeal and prior litigation under the FOIA"); Hassell v. Callahan, No. 97-0037-B, slip op. at 3-5 (W.D. Va. Aug. 7, 1997) (finding that public sign-up sheet that asked for name of claimant and name of his representative for disability benefits did not constitute "record"; stating that "this court is not inclined to lump the name of a person's representative within the same category as information regarding his medical or financial history"); Fisher v. NIH, 934 F. Supp. 464, 466-67, 469-72 (D.D.C. 1996) (following Tobey and finding that information in database about articles published in scientific journals that contained bibliographic information including title of article and publication, name and address of author, and summary of article and also included annotation "[scientific misconduct -- data to be reanalyzed]," provides "information 'about' the article described in each file and does not provide information 'about' [the author]," even though information "could be used to draw inferences or conclusions about [the author]"; "The fact that it is possible for a reasonable person to interpret information as describing an individual does not mean the information is about that individual for purposes of the Privacy Act."), summary affirmance granted, No. 96-5252 (D.C. Cir. Nov. 27, 1996); Wolde-Giorgis v. United States, No. 94-254, slip op. at 5-6 (D. Ariz. Dec. 9, 1994) (citing Unt with approval and holding that Postal Service claim form and information concerning estimated value of item sent through mail was "not a 'record' within the meaning of the [Privacy Act]" because it "disclosed no information about the plaintiff" and did not reflect any "'quality or characteristic' concerning the plaintiff"), aff'd, 65 F.3d 177 (9th Cir. 1995) (unpublished table decision); Ingerman v. IRS, No. 89-5396, slip op. at 6 (D.N.J. Apr. 3, 1991) ("An individual's social security number does not contain his name, identifying number or other identifying particular. . . . [A] social security number is the individual's identifying number, and therefore, it cannot qualify as a record under . . . the Privacy Act."), aff'd, 953 F.2d 1380 (3d Cir. 1992) (unpublished table decision); Nolan v. United States Dep't of Justice, No. 89-A-2035, 1991 WL 36547, at *10 (D. Colo. Mar. 18, 1991) (names of FBI Special Agents and other personnel held not requester's "record" and therefore "outside the scope of the [Privacy Act]"), aff'd, 973 F.2d 843 (10th Cir. 1992); Doe v. United States Dep't of Justice, 790 F. Supp. 17, 22 (D.D.C. 1992) (applying Nolan and alternatively holding that "names of agents involved in the investigation are properly protected from disclosure"); Shewchun v. United States Customs Serv., No. 87-2967, 1989 WL 7351, at *1 (D.D.C. Jan. 11, 1989) (letter concerning agency's disposition of plaintiff's merchandise "lacks a sufficient informational nexus with [plaintiff] (himself, as opposed to his property) to bring it within the definition of 'record'"); Blair v. United States Forest Serv., No. A85-039, slip op. at 4-5 (D. Alaska Sept. 24, 1985) ("Plan of Operation" form completed by plaintiff held not his "record" as it "reveals nothing about his personal affairs"), appeal dismissed, No. 85-4220 (9th Cir. Apr. 1, 1986); Windsor v. A Fed. Executive Agency, 614 F. Supp. 1255, 1260-61 (M.D. Tenn. 1983) (record includes only sensitive information about individual's private affairs), aff'd, 767 F.2d 923 (6th Cir. 1985) (unpublished table decision); Cohen v. United States Dep't of Labor, 3 Gov't Disclosure Serv. (P-H) ¶ 83,157, at 83,791 (D. Mass. Mar. 21, 1983) (record includes only "personal" information); AFGE v. NASA, 482 F. Supp. 281, 282-83 (S.D. Tex. 1980) (determining that sign-in/sign-out sheet was not "record" because, standing alone, it did not reveal any "substantive information about the employees"); Houston v. United States Dep't of the Treasury, 494 F. Supp. 24, 28 (D.D.C. 1979) (same as Cohen); see also Drake v. 136th Airlift Wing, Tex. Air Nat'l Guard, No. 3:98-CV-1673D, 1998 WL 872915, at **1-2 (N.D. Tex. Nov. 30, 1998) (stating that list of names of witnesses is not record, as it "does not include personal information regarding any particular individual"), aff'd, 209 F.3d 718 (5th Cir. 2000) (unpublished table decision); Benson v. United States, No. 80-15-MC, slip op. at 4 (D. Mass. June 12, 1980) (permitting withholding of OPM investigator's name where identities of informants were properly excised under subsection (k)(5)); cf. Topuridze v. FBI, No. 86-3120, 1989 WL 11709, at *2 (D.D.C. Feb. 6, 1989) (citing Unt with approval and holding that letter written about requester, authored by third party, cannot be regarded as third party's record; it "does not follow that a document reveals some quality or characteristic of an individual simply by virtue of the individual having authored the document"), reconsideration denied sub nom. Topuridze v. USIA, 772 F. Supp. 662, 664-65 (D.D.C. 1991) (after in camera review, although reaffirming that "[i]n order to be about an individual a record must 'reflect some quality or characteristic of the individual involved,'" stating that document "may well be 'about' the author," as it discussed author's family status, employment, and fear of physical retaliation if letter were disclosed to plaintiff, and ultimately ruling that it need not reach issue of whether or not letter was "about" author and denying reconsideration on ground that letter was without dispute about subject/plaintiff and therefore must be released to him).
For a further illustration of conflicting views concerning the meaning of the term "record" in the subsection (d)(1) access context, compare Voelker v. IRS, 646 F.2d 332, 334 (8th Cir. 1981), with Nolan v. United States Dep't of Justice, No. 89-A-2035, 1991 WL 36547, at *3 (D. Colo. Mar. 18, 1991), aff'd, 973 F.2d 843 (10th Cir. 1992), and DePlanche v. Califano, 549 F. Supp. 685, 693-98 (W.D. Mich. 1982). These important cases are further discussed below under "Individual's Right of Access."
One district court, in a case concerning the Privacy Act's subsection (b)(3) routine use exception, has held that a plaintiff may choose which particular "item of information" (one document) contained within a "collection or grouping of information" disclosed (a prosecutive report indicating a potential violation of law) to denominate as a "record" and challenge as wrongfully disclosed. Covert v. Harrington, 667 F. Supp. 730, 736-37 (E.D. Wash. 1987), aff'd on other grounds, 876 F.2d 751 (9th Cir. 1989). Purporting to construe the term "record" narrowly, the district court in Covert ruled that the Department of Energy's routine use -- 47 Fed. Reg. 14,333 (Apr. 2, 1982) (permitting disclosure of relevant records where "a record" indicates a potential violation of law) -- did not permit its Inspector General to disclose personnel security questionnaires to the Justice Department for prosecution because the questionnaires themselves did not reveal a potential violation of law on their face. 667 F. Supp. at 736-37. Covert is discussed further under "Conditions of Disclosure to Third Parties," "Agency Requirements," and "Civil Remedies," below.
Note also that purely private notes -- such as personal memory refreshers -- are generally regarded as not subject to the Privacy Act because they are not "agency records." See Johnston v. Horne, 875 F.2d 1415, 1423 (9th Cir. 1989); Bowyer v. United States Dep't of the Air Force, 804 F.2d 428, 431 (7th Cir. 1986); Boyd v. Sec'y of the Navy, 709 F.2d 684, 686 (11th Cir. 1983) (per curiam); Harmer v. Perry, No. 95-4197, 1998 WL 229637, at *3 (E.D. Pa. Apr. 28, 1998), aff'd, No. 98-1532 (3d Cir. Jan. 29, 1999); Sherwin v. Dep't of Air Force, No. 90-34-CIV-3, slip op. at 2-7 (E.D.N.C. Apr. 15, 1992), aff'd, 37 F.3d 1495 (4th Cir. 1994) (unpublished table decision); Glass v. United States Dep't of Energy, No. 87-2205, 1988 WL 118408, at *1 (D.D.C. Oct. 29, 1988); Mahar v. Nat'l Parks Serv., No. 86-0398, slip op. at 16-17 (D.D.C. Dec. 23, 1987); Kalmin v. Dep't of the Navy, 605 F. Supp. 1492, 1494-95 (D.D.C. 1985); Machen v. United States Army, No. 78-582, slip op. at 4 (D.D.C. May 11, 1979); see also OMB Guidelines, 40 Fed. Reg. at 28,952 ("Uncirculated personal notes, papers and records which are retained or discarded at the author's discretion and over which the agency exercises no control or dominion (e.g., personal telephone lists) are not considered to be agency records within the meaning of the Privacy Act."); cf. FOIA Update, Vol. V, No. 4, at 3 ("OIP Guidance: 'Agency Records' vs. 'Personal Records'") (analyzing concepts of agency records and personal records under FOIA).
However, in Chapman v. NASA, 682 F.2d 526, 529 (5th Cir. 1982), the Court of Appeals for the Fifth Circuit, relying on the fair recordkeeping duties imposed by subsection (e)(5), ruled that private notes may "evanesce" into records subject to the Act when they are used to make a decision on the individual's employment status well after the evaluation period for which they were compiled. See also Lawrence v. Dole, No. 83-2876, slip op. at 5-6 (D.D.C. Dec. 12, 1985) ("[a]bsent timely incorporation into the employee's file, the private notes may not be used as a basis for an adverse employment action"); Thompson v. Dep't of Transp. United States Coast Guard, 547 F. Supp. 274, 283-84 (S.D. Fla. 1982) (timeliness requirement of subsection (e)(5) is met where private notes upon which disciplinary action is based are placed in a system of records "contemporaneously with or within a reasonable time after an adverse disciplinary action is proposed"); cf. Risch v. Henderson, 128 F. Supp. 2d 437, 441 (E.D. Mich. 1999) (stating that "another person's witnessing of a personal note converts it to a Level 2 -- Supervisor's Personnel Record, and therefore it is properly maintained under the Privacy Act" in a system of records in accordance with the agency manual). But cf. Sherwin, No. 90-34-CIV-3, slip op. at 2-7 (E.D.N.C. Apr. 15, 1992) (distinguishing Chapman and finding that notes of telephone conversations between two of plaintiff's supervisors concerning plaintiff were not "agency 'records'" because plaintiff was "well aware of the general content" of notes, "essence" of notes was incorporated in agency's records, "private notes played no role" in plaintiff's discharge, and although some of notes were shared between two supervisors, "they remained personal notes at all times").
Note that publicly available information, such as newspaper clippings or press releases, can constitute a "record." See Clarkson v. IRS, 678 F.2d 1368, 1372 (11th Cir. 1982) (permitting subsection (e)(7) challenge to agency's maintenance of newsletters and press releases); Murphy v. NSA, 2 Gov't Disclosure Serv. (P-H) ¶ 81,389, at 82,036-37 (D.D.C. Sept. 29, 1981) (same as to newspaper clippings); see also OMB Guidelines, 40 Fed. Reg. 56,741, 56,742 (Nov. 21, 1975) ("[c]ollections of newspaper clippings or other published matter about an individual maintained other than in a conventional reference library would normally be a system of records"); cf. Fisher, 934 F. Supp. at 469 (discussing difference between definition of "record" for purposes of FOIA and statutory definition under Privacy Act and rejecting argument, based on FOIA case law, that "library reference materials" are not covered by Privacy Act).
One court has relied on non-Privacy Act case law concerning grand jury records to hold that a grand jury transcript, "though in possession of the U.S. Attorney, is not a record of the Justice Department within the meaning of the Privacy Act." Kotmair v. United States Dep't of Justice, No. S 94-721, slip op. at 1 (D. Md. July 12, 1994) (citing United States v. Penrod, 609 F.2d 1092, 1097 (4th Cir. 1979), for above proposition, but then confusingly not applying same theory to analysis of FOIA accessibility), aff'd, 42 F.3d 1386 (4th Cir. 1994) (unpublished table decision).
The Privacy Act -- like the FOIA -- does not require agencies to create records that do not exist. See DeBold v. Stimson, 735 F.2d 1037, 1041 (7th Cir. 1984); Perkins v. IRS, No. 86-CV-71551, slip op. at 4 (E.D. Mich. Dec. 16, 1986); see also, e.g., Villanueva v. Dep't of Justice, 782 F.2d 528, 532 (5th Cir. 1986) (rejecting argument that the FBI was required to "find a way to provide a brief but intelligible explanation for its decision . . . without [revealing exempt information]"). But compare May v. Dep't of the Air Force, 777 F.2d 1012, 1015-17 (5th Cir. 1985) (singularly ruling that "reasonable segregation requirement" obligates agency to create and release typewritten version of handwritten evaluation forms so as not to reveal identity of evaluator under exemption (k)(7)), with Church of Scientology W. United States v. IRS, No. CV-89-5894, slip op. at 4 (C.D. Cal. Mar. 5, 1991) (FOIA decision rejecting argument based upon May, and holding that agency is not required to create records).
"a group of any records under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual." 5 U.S.C. § 552a(a)(5).
Comment:
The OMB Guidelines explain that a system of records exists if: (1) there is an "indexing or retrieval capability using identifying particulars [that is] built into the system"; and (2) the agency "does, in fact, retrieve records about individuals by reference to some personal identifier." OMB Guidelines, 40 Fed. Reg. 28,948, 28,952 (July 9, 1975). The Guidelines state that the "is retrieved by" criterion "implies that the grouping of records under the control of an agency is accessed by the agency by use of a personal identifier; not merely that a capability or potential for retrieval exists." Id. (emphasis added).
It is important to note that by its very terms the statute includes as personal identifiers items beyond the perhaps most commonly used name and social security number. As the Court of Appeals for the District of Columbia Circuit pointed out when considering a "photo file":
Recall that a system of records is "a group of any records . . . from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual." 5 U.S.C. § 552a(a)(5) (emphasis added). The term "record" includes "any item . . . about an individual . . . that contains his name, or the identifying number, symbol, or other identifying particular assigned to the individual, such as a finger or voice print or a photograph." Id. § 552a(a)(4) (emphasis added). Under the Act's plain language, then, a "system of records" may be a group of any records retrieved by an identifying particular such as a photograph. In other words, the personal identifier may be the photograph itself.
Maydak v. United States, 363 F.3d 512, 519-20 (D.C. Cir. 2004) (remanding case to district court to determine whether prisons' compilation of photographs constitutes system of records). But see Ingerman v. IRS, No. 89-5396, slip op. at 6 (D.N.J. Apr. 3, 1991) ("An individual's social security number does not contain his name, identifying number, or other identifying particular. . . . [A] social security number is the individual's identifying number, and therefore, it cannot qualify as a record under . . . the Privacy Act."), aff'd, 953 F.2d 1380 (3d Cir. 1992) (unpublished table decision).
The D.C. Circuit also has addressed the "system of records" definition in the context of computerized information in Henke v. United States Department of Commerce, 83 F.3d 1453 (D.C. Cir. 1996), and noted that "the OMB guidelines make it clear that it is not sufficient that an agency has the capability to retrieve information indexed under a person's name, but the agency must in fact retrieve records in this way in order for a system of records to exist." Id. at 1460 n.12; see also Chang v. Dep't of the Navy, No. 00-0783, 2004 WL 882030, at *4 (D.D.C. Apr. 22, 2004) ("[A]n agency's failure to acknowledge that it maintains a system of records will not protect the agency from statutory consequences if there is evidence that the agency in practice retrieves information about individuals by their names or personal identifiers . . . however, mere retrievability -- that is, the capability to retrieve -- is not enough."); McCready v. Principi, 297 F. Supp. 2d 178, 185 (D.D.C. 2003) ("Only when 'there is actual retrieval of records keyed to individuals' in some way does the Privacy Act apply." (quoting Henke)). The issue in Henke was whether or not computerized databases that contained information concerning technology grant proposals submitted by businesses constituted a "system of records" as to individuals listed as the "contact persons" for the grant applications, where the agency had acknowledged that "it could theoretically retrieve information by the name of the contact person." Id. at 1457-58. The D.C. Circuit looked to Congress's use of the words "is retrieved" in the statute's definition of a system of records and focused on whether the agency "in practice" retrieved information. Id. at 1459-61. The court held "that in determining whether an agency maintains a system of records keyed to individuals, the court should view the entirety of the situation, including the agency's function, the purpose for which the information was gathered, and the agency's actual retrieval practice and policies." Id. at 1461.
Applying this test, the D.C. Circuit determined that the agency did "not maintain a system of records keyed to individuals listed in the contact person fields of its databases" because the agency's "purpose in requesting the name of a technical contact [was] essentially administrative and [was] not even necessary for the conduct of the [program's] operations," nor was there "any evidence that the names of contact persons [were] used regularly or even frequently to obtain information about those persons." Id. at 1456, 1461-62; cf. Walker v. Ashcroft, No. 99-2385, slip op. at 17-18 (D.D.C. Apr. 30, 2001) (alternative holding) (applying Henke and finding no evidence that the FBI "independently collected, gathered or maintained" a document containing plaintiff's prescription drug information given to the FBI by a state investigator, or that the FBI "could, in practice, actually retrieve the record by reference to [plaintiff's] name"), summary affirmance granted on other grounds, No. 01-5222, 2002 U.S. App. LEXIS 2485 (D.C. Cir. Jan. 25, 2002); Alexander v. FBI, 193 F.R.D. 1, 6-8 (D.D.C. 2000) (applying Henke and finding that the agency maintained a system of records, considering the "purpose for which the information was gathered and the ordinary retrieval practices and procedures"), mandamus denied per curiam sub nom. In re: Executive Office of the President, 215 F.3d 20 (D.C. Cir. 2000); Smith v. Henderson, No. C-99-4665, 1999 WL 1029862, at *5 (N.D. Cal. Oct. 29, 1999) (applying Henke and finding that "locked drawer containing a file folder in which [were] kept . . . notes or various other pieces of paper relating to special circumstances hires" did not constitute a system of records because the agency "did not utilize the drawer to systematically file and retrieve information about individuals indexed by their names"), aff'd sub nom. Smith v. Potter, 17 Fed. Appx. 731 (9th Cir. 2001). But cf. Williams v. VA, 104 F.3d 670, 674-77 & n.4 (4th Cir. 1997) (although remanding case for further factual development as to whether records were contained within system of records, and noting that it was "express[ing] no opinion on the Henke court's rationale when applied to circumstances where a plaintiff seeks to use retrieval capability to transform a group of records into a 'system of records,' as in Henke," nevertheless finding the "narrow Henke rationale . . . unconvincing" in circumstances before the court where there "appear[ed] to exist already a formal system of records," where "published characteristics of the agency's formal system of records ha[d] not kept current with advances in and typical uses of computer technology," and where record was "poorly developed" on such point).
Other district courts have also reached this result in the context of computerized information. See Chang v. Dep't of the Navy, No. 00-0783, 2004 WL 882030, at *4 (D.D.C. Apr. 22, 2004) (applying Henke, rejecting plaintiff's assertion that document was retrievable by searching within the computer files of the relevant officers, and stating that "[p]laintiff's assertion that it is 'technically possible' to retrieve the [document] by searching for [plaintiff's] name is insufficient to meet the requirement that the data was retrieved in such a manner"); Fisher v. NIH, 934 F. Supp. 464, 472-73 (D.D.C. 1996) (applying Henke and stating: "[T]he primary practice and policy of the agency [during the time of the alleged disclosures] was to index and retrieve the investigatory files by the name of the institution in which the alleged misconduct occurred, rather than by the name of the individual scientist accused of committing the misconduct. The fact that it was possible to use plaintiff's name to identify a file containing information about the plaintiff is irrelevant."), summary affirmance granted, No. 96-5252 (D.C. Cir. Nov. 27, 1996); Beckette v. USPS, No. 88-802, slip op. at 19-22 (E.D. Va. July 3, 1989) (Although the plaintiff demonstrated that the agency "could retrieve . . . records by way of an individual's name or other personal identifier," that fact "does not make those records a Privacy Act system of records. The relevant inquiry is whether the records or the information they contain are [in fact] retrieved by name or other personal identifier.").
Another district court, in considering whether an agency's Web site constituted a system of records, also looked to the OMB Guidelines and the reasoning of Henke. In McCready v. Principi, the District Court for the District of Columbia stated that "[b]ecause of the purpose and context of the Privacy Act, the Court finds that the practice of retrieval by name or other personal identifier must be an agency practice to create a system of records and not a 'practice' by those outside the agency." Thus, the court held that the VA's Web site did not constitute a system of records, because the VA did "not retrieve documents therefrom by the use of any personal identifier." 297 F. Supp. 2d at 198-99.
The D.C. Circuit in Henke, in looking to the "purpose" for which the information was gathered, also drew a distinction between information gathered for investigatory purposes and information gathered for, in that case, administrative purposes. The court stated that where information is compiled about individuals "primarily for investigatory purposes, Privacy Act concerns are at their zenith, and if there is evidence of even a few retrievals of information keyed to individuals' names, it may well be the case that the agency is maintaining a system of records." 83 F.3d at 1461; see also Maydak v. United States, 363 F.3d at 520 (quoting Henke and remanding case to district court to determine whether prisons' compilation of photographs constitutes system of records and instructing district court to "take into account 'the entirety of the situation, including the agency's function, the purpose for which the information was gathered, and the agency's actual retrieval practices and policies'"); Fisher, 934 F. Supp. at 473 (quoting Henke but determining that agency's "primary practice and policy" was to retrieve investigatory files by name of institution rather than by name of individual); cf. Doe v. Veneman, 230 F. Supp. 2d 739, 752 (W.D. Tex. 2002) (quoting language from Henke regarding "even a few retrievals," and determining that noninvestigatory information "f[e]ll within the ambit of the Privacy Act" where information could "be retrieved by personal identifiers" and information was maintained in "single data repository from which more than 200 different types of reports [we]re generated," all from the raw data entered into the system) (appeal pending); Walker, No. 99-2385, slip op. at 17-18 (D.D.C. Apr. 30, 2001) (alternative holding) (applying Henke and finding no evidence that the FBI "independently collected, gathered or maintained" a document containing plaintiff's prescription drug information given to the FBI by a state investigator, or that the FBI "could, in practice, actually retrieve the record by reference to [plaintiff's] name").
The Court of Appeals for the Tenth Circuit, in Pippinger v. Rubin, finding the approach in Henke "instructive," held that "consistent with Henke, a properly 'narrow' construction of 5 U.S.C. § 552a(a)(5)" led it to the conclusion that an Internal Revenue Service database containing an "abstraction" of information from two existing Privacy Act systems did not constitute a new system of records because it could be "accessed only by the same users, and only for the same purposes, as those published in the Federal Register for the original 'system[s] of records.'" 129 F.3d 519, 526-27 (10th Cir. 1997).
The highly technical "system of records" definition is perhaps the single most important Privacy Act concept, because (with some exceptions discussed below) it makes coverage under the Act dependent upon the method of retrieval of a record rather than its substantive content. See Baker v. Dep't of the Navy, 814 F.2d 1381, 1384 (9th Cir. 1987); Shannon v. Gen. Elec. Co., 812 F. Supp. 308, 321 (N.D.N.Y. 1993); see also Crumpton v. United States, 843 F. Supp. 751, 755-56 (D.D.C. 1994) (although records disclosed to press under FOIA contained information about plaintiff, they were not retrieved by her name and therefore Privacy Act did not apply), aff'd on other grounds sub nom. Crumpton v. Stone, 59 F.3d 1400 (D.C. Cir. 1995). Indeed, a major criticism of the Privacy Act is that it can easily be circumvented by not filing records in name-retrieved formats. See Privacy Commission Report at 503-04 & n.7. A recognition of this potential for abuse has led some courts to relax the "actual retrieval" standard in particular cases (examples in cases cited below). Moreover, certain subsections of the Act (discussed below) have been construed to apply even to records not incorporated into a "system of records."
With varying degrees of clarity, the courts generally have ruled that a disclosure in violation of subsection (b) does not occur unless the plaintiff's record was actually retrieved by reference to his name or personal identifier. See, e.g., McCready v. Principi, 297 F. Supp. 2d 178, 195-97 (D.D.C. 2003) (dismissing allegation that publication on Internet of Office of Inspector General's audit reports concerning mismanagement by plaintiff violated subsection (b), because reports were not in system of records; also finding no violation as to another document where a "folder was created for the [document] for tracking purposes" in a departmentwide electronic tracking system that was "clearly a Privacy Act system of records," but where "the document itself was never scanned into the [tracking system] electronically" and thus the document could not "be retrieved either electronically or in manual form through the use of any personal identifier"); Bechhoefer v. United States Dep't of Justice, 179 F. Supp. 2d 93, 95-101 (W.D.N.Y. 2001) (summary judgment granted on the ground that the disclosed record "never became part of a system of records" where DEA agent had "stuck it in his desk drawer along with a number o[f] other miscellaneous documents, and later retrieved it from that drawer, from his own memory and personal knowledge of where he kept it"; noting, too, that plaintiff's claim that agent may have looked at plaintiff's name on record to retrieve it from drawer "confuses retrieving a document with identifying the document. If one is looking for a letter from a particular person, one will probably look at the name on the letter in order to identify it as the letter being sought. If that letter is in a stack of unrelated, miscellaneous documents, however, it cannot be said to be contained within a group of records organized in such a fashion that information can be retrieved by an individual's name."), aff'd, 312 F.3d 563, 567-68 & n.1 (2d Cir. 2002) (affirming on ground that "an assortment of papers excluded from the agency's formal files because they are deemed not relevant to the agency's mission and left in a desk drawer are not part of the agency's system of records, to which the obligations of the Act apply," and accordingly finding no need to consider agency's further argument concerning single instance of retrieval by individual's name), cert. denied sub nom. Bechhoefer v. DEA, 539 U.S. 514 (2003); Barhorst v. Marsh, 765 F. Supp. 995, 999-1000 (E.D. Mo. 1991) (Privacy Act claim under subsection (b) dismissed on alternative grounds where record retrieved by job announcement number, not by individual's name; noting that "'mere potential for retrieval' by name or other identifier is insufficient to satisfy the 'system of records' requirement" (quoting Fagot v. FDIC, 584 F. Supp. 1168, 1175 (D.P.R. 1984), aff'd in part & rev'd in part, 760 F.2d 252 (1st Cir. 1985) (unpublished table decision))). But see Wall v. IRS, No. 1:88-CV-1942, 1989 U.S. Dist. LEXIS 9427, at **4-7 (N.D. Ga. July 5, 1989) (because agency official retrieved applicant's folder by name from file maintained under vacancy announcement number, records were kept within "system of records" and thus subsection (b) was applicable).
Nevertheless, the Court of Appeals for the First Circuit has held that "the unauthorized disclosure by one agency of protected information obtained from a record in another agency's system is a prohibited disclosure under the Act, unless the disclosure falls within the statutory exceptions." Orekoya v. Mooney, 330 F.3d 1, 6-7 (1st Cir. 2003). In Orekoya, the First Circuit, although ultimately affirming the district court on other grounds, disagreed with the district court's determination that such a disclosure was not a violation of the Privacy Act, and it stated that the language of the Privacy Act "does not support the view that an agency may immunize itself from liability by obtaining information from a different agency's system of records and then saying its further unauthorized disclosure is protected because its own system of records was not the original source." Id. In a somewhat similar vein, the District Court for the District of Columbia has considered the actual retrieval standard in a circumstance in which it was undisputed that the documents at issue were not retrieved from a system of records, but it also was undisputed that "underlying documents, from which the documents were compiled, were contained in a system of records." Chang v. Dep't of the Navy, No. 00-0783, 2004 WL 882030, at *5 (D.D.C. Apr. 22, 2004). Specifically, in that case the plaintiff, a commander of a vessel that was involved in a maritime collision, contended that the Navy had violated the Privacy Act by disclosing details of his nonjudicial punishment hearing and a punitive letter of reprimand both to the media, in the form of a press release and "query responses" prepared to answer press inquiries, and to Members of Congress, in the form of an "information paper." Id. at *1. After the agency asserted that the documents at issue were not retrieved from a system of records, but rather that the "information paper" was retrieved by reference to the name of the requesting Member of Congress and the "query response" and press release were retrieved by reference to the ship's name, the D.C. District Court proceeded to look beneath those documents to the "underlying documents, from which the documents were compiled," and it being undisputed that those underlying documents were contained within a system of records, stated that "[u]nder Bartel," infra, "the Court must find in these circumstances that information contained in a system of records was disclosed." Id. at **4-5.
Several courts have stated that the first element a plaintiff must prove in a wrongful disclosure suit is that the information disclosed is a record within a system of records. See Quinn v. Stone, 978 F.2d 126, 131 (3d Cir. 1992); Kinchen v. USPS, No. 90-1180, slip op. at 5 (W.D. Tenn. June 17, 1994); Hass v. United States Air Force, 848 F. Supp. 926, 932 (D. Kan. 1994); Swenson v. USPS, No. S-87-1282, 1994 U.S. Dist. LEXIS 16524, at **14-15 (E.D. Cal. Mar. 10, 1994); see also Davis v. Runyon, No. 96-4400, 1998 WL 96558, at **4-5 (6th Cir. Feb. 23, 1998) (affirming district court's dismissal of Privacy Act wrongful disclosure claim where appellant had failed to allege any facts as to whether "'information' was a 'record' contained in a 'system of records,'" whether it was "disclos[ed] within the meaning of the Act," whether disclosure had "adverse effect," or whether disclosure was "willful or intentional"); Doe v. United States Dep't of the Interior, No. 95-1665, slip op. at 2-5 (D.D.C. Mar. 11, 1996) (alleged disclosure that plaintiff was HIV positive and had been treated for AIDS-related illnesses was not violation of Privacy Act because "[w]hile it appears to be true that some breach in confidentiality occurred . . . plaintiff cannot show that the breach stemmed from an improper disclosure of plaintiff's personnel records"); Mittleman v. United States Dep't of the Treasury, 919 F. Supp. 461, 468 (D.D.C. 1995) ("statement of general provisions of law" that was "not a disclosure of information retained in the [agency's] records on plaintiff . . . does not implicate the general nondisclosure provisions of the Privacy Act"), aff'd in part & remanded in part on other grounds, 104 F.3d 410 (D.C. Cir. 1997). But cf. Doe v. USPS, 317 F.3d 339, 342-43 (D.C. Cir. 2003) (ruling that genuine issues of material fact as to whether plaintiff's supervisor told co-workers about his HIV status and whether supervisor learned of that status from plaintiff's Privacy Act-protected Family and Medical Leave Act form precluded summary judgment for agency on plaintiff's claim for wrongful disclosure even through "evidence of retrieval [wa]s purely circumstantial"; "[B]ecause plaintiffs can rarely produce direct evidence that the government has disclosed confidential information obtained from their private records, requiring such evidence would eviscerate the protections of the Privacy Act.").
In fact, the Court of Appeals for the First Circuit has held that a Complaint that fails to allege a disclosure from a "system of records" is facially deficient. Beaulieu v. IRS, 865 F.2d 1351, 1352 (1st Cir. 1989); see also Mumme v. United States Dep't of Labor, 150 F. Supp. 2d 162, 175 (D. Me. 2001), aff'd, No. 01-2256 (1st Cir. June 12, 2002); Whitson v. Dep't of the Army, No. SA-86-CA-1173, slip op. at 8-12 (W.D. Tex. Feb. 25, 1988); Bernson v. ICC, 625 F. Supp. 10, 13 (D. Mass. 1984). However, other courts, including the Court of Appeals for the District of Columbia Circuit, have not held pleadings in Privacy Act cases to such a strict standard. See Krieger v. Fadely, 211 F.3d 134, 136-37 (D.C. Cir. 2000) (holding that Complaint that alleged wrongful disclosure of records "subject to protection under the Privacy Act" thereby "alleged the essential elements of [plaintiff's] claim and put the government on notice," and that "[n]othing more was required to survive a motion to dismiss for failure to state a claim"; "If his lawsuit went forward, there would come a time when [plaintiff] would have to identify the particular records [defendant] unlawfully disclosed. But that point surely was not as early as the pleading stage."); Tripp v. DOD, 219 F. Supp. 2d 85, 89-91 (D.D.C. 2002) (where Complaint "alleged that during a specific time period a specific defendant repeatedly released information about plaintiff to the press and public that is contained in a Privacy Act system of records, including but not limited to the contents of plaintiff's security forms and other personnel files," following Krieger to hold that Federal Rule of Civil Procedure 8 "does not require plaintiff to plead facts to further elaborate which records were released, by which DOD officials, to which members of the press or public, or on which specific dates"); Tripp v. DOD, 193 F. Supp. 2d 229, 237 (D.D.C. 2002) (following Krieger and "the liberal pleading standard permitted by the Federal Rules of Civil Procedure"); Johnson v. Rinaldi, No. 1:99CV170, 2001 U.S. Dist. LEXIS 9833, at **16-18 (M.D.N.C. Apr. 13, 2001) (stating that the "Federal Rules of Civil Procedure require only that the complaint put Defendants on notice" and that the plaintiff "need not use the exact words 'record' or 'system of records' or state facts sufficient to show that the documents in dispute meet those legal definitions"); cf. Sterling v. United States, 798 F. Supp. 47, 49 (D.D.C. 1992) (individual is "not barred from stating a claim for monetary damages [under (g)(1)(D)] merely because the record did not contain 'personal information' about him and was not retrieved through a search of indices bearing his name or other identifying characteristics"), subsequent related opinion, Sterling v. United States, 826 F. Supp. 570, 571-72 (D.D.C. 1993), summary affirmance granted, No. 93-5264 (D.C. Cir. Mar. 11, 1994).
Thus, it has frequently been held that subsection (b) is not violated when a dissemination is made on the basis of knowledge acquired independent of actual retrieval from an agency's system of records (such as a disclosure purely from memory), regardless of whether the identical information also happens to be contained in the agency's systems of records. The leading case articulating the "actual retrieval" and "independent knowledge" concepts is Savarese v. HEW, 479 F. Supp. 304, 308 (N.D. Ga. 1979), aff'd, 620 F.2d 298 (5th Cir. 1980) (unpublished table decision), in which the court ruled that for a disclosure to be covered by subsection (b), "there must have initially been a retrieval from the system of records which was at some point a source of the information." 479 F. Supp. at 308. In adopting this stringent "actual retrieval" test, the court in Savarese reasoned that a more relaxed rule could result in excessive governmental liability, or an unworkable requirement that agency employees "have a pansophic recall concerning every record within every system of records within the agency." Id.
There are numerous subsection (b) cases that follow Savarese and apply the "actual retrieval" and "independent knowledge" concepts in varying factual situations. See, e.g., Kline v. HHS, 927 F.2d 522, 524 (10th Cir. 1991); Manuel v. VA Hosp., 857 F.2d 1112, 1119-20 (6th Cir. 1988); Thomas v. United States Dep't of Energy, 719 F.2d 342, 344-46 (10th Cir. 1983); Boyd v. Sec'y of the Navy, 709 F.2d 684, 687 (11th Cir. 1983) (per curiam); Doyle v. Behan, 670 F.2d 535, 538-39 & n.5 (5th Cir. 1982) (per curiam); Hanley v. United States Dep't of Justice, 623 F.2d 1138, 1139 (6th Cir. 1980) (per curiam); Krieger v. Fadely, 199 F.R.D. at 13 (ruling that discovery request seeking all communications that supervisor had with anyone, irrespective of any relation between communication and Privacy Act-protected record, was overbroad, and stating that Privacy Act "does not create a monastic vow of silence which prohibits governmental employees from telling others what they saw and heard merely because what they saw or heard may also be the topic of a record in a protected file"); Fisher v. NIH, 934 F. Supp. 464, 473-74 (D.D.C. 1996) (plaintiff failed to demonstrate that individuals who disclosed information learned it from investigatory file or through direct involvement in investigation), summary affirmance granted, No. 96-5252 (D.C. Cir. Nov. 27, 1996); Balbinot v. United States, 872 F. Supp. 546, 549-51 (C.D. Ill. 1994); Coakley v. United States Dep't of Transp., No. 93-1420, 1994 U.S. Dist. LEXIS 21402, at **2-3 (D.D.C. Apr. 7, 1994); Swenson, No. S-87-1282, 1994 U.S. Dist. LEXIS 16524, at **19-22 (E.D. Cal. Mar. 10, 1994); Gibbs v. Brady, 773 F. Supp. 454, 458 (D.D.C. 1991); McGregor v. Greer, 748 F. Supp. 881, 885-86 (D.D.C. 1990); Avant v. Postal Serv., No. 88-T-173-S, slip op. at 4-5 (M.D. Ala. May 4, 1990); Howard v. Marsh, 654 F. Supp. 853, 855 (E.D. Mo. 1986); Krowitz v. USDA, 641 F. Supp. 1536, 1545 (W.D. Mich. 1986), aff'd, 826 F.2d 1063 (6th Cir. 1987) (unpublished table decision); Blanton v. United States Dep't of Justice, No. 82-0452, slip op. at 4-5 (D.D.C. Feb. 17, 1984); Sanchez v. United States, 3 Gov't Disclosure Serv. (P-H) ¶ 83,116, at 83,708-09 (S.D. Tex. Sept. 10, 1982); Golliher v. USPS, 3 Gov't Disclosure Serv. (P-H) ¶ 83,114, at 83,703 (N.D. Ohio June 10, 1982); Thomas v. United States Dep't of the Navy, No. C81-0654-L(A), slip op. at 2-3 (W.D. Ky. Nov. 4, 1982), aff'd, 732 F.2d 156 (6th Cir. 1984) (unpublished table decision); Olberding v. DOD, 564 F. Supp. 907, 913 (S.D. Iowa 1982), aff'd per curiam, 709 F.2d 621 (8th Cir. 1983); Balk v. United States Int'l Communications Agency, No. 81-0896, slip op. at 2-4 (D.D.C. May 7, 1982), aff'd, 704 F.2d 1293 (D.C. Cir. 1983) (unpublished table decision); Johnson v. United States Dep't of the Air Force, 526 F. Supp. 679, 681 (W.D. Okla. 1980), aff'd, 703 F.2d 583 (Fed. Cir. 1981) (unpublished table decision); Carin v. United States, 1 Gov't Disclosure Serv. (P-H) ¶ 80,193, at 80,491-92 (D.D.C. Aug. 5, 1980); Jackson v. VA, 503 F. Supp. 653, 655-57 (N.D. Ill. 1980); King v. Califano, 471 F. Supp. 180, 181 (D.D.C. 1979); Greene v. VA, No. C-76-461-S, slip op. at 6-7 (M.D.N.C. July 3, 1978); see also Stephens v. TVA, 754 F. Supp. 579, 582 (E.D. Tenn. 1990) (comparing Olberding and Jackson and noting "confusion in the law with respect to whether the Privacy Act bars the disclosure of personal information obtained indirectly as opposed to directly from a system of records"); cf. Rice v. United States, 166 F.3d 1088, 1092 n.4 (10th Cir. 1999) (in action for wrongful disclosure in violation of tax code, noting that plaintiff similarly had no Privacy Act claim for IRS's disclosure in press releases of information regarding plaintiff's criminal trial and conviction because information disclosed was procured by agency public affairs officer through review of indictment and attendance at plaintiff's trial and sentencing); Smith v. Henderson, No. C-96-4665, 1999 WL 1029862, at **6-7 (N.D. Cal. Oct. 29, 1999) (although finding no evidence of existence of written record retrieved from system of records, finding further that alleged disclosure was made from information "obtained independently of any system of records"), aff'd sub nom. Smith v. Potter, 17 Fed. Appx. 731 (9th Cir. 2001); Viotti v. United States Air Force, 902 F. Supp. 1331, 1338 (D. Colo. 1995) ("Section 552a(b) contemplates a 'system of records' as being the direct or indirect source of the information disclosed" and although agency employee admitted disclosure of information to press "based on personal knowledge," plaintiff "was obligated to come forward with some evidence indicating the existence of a triable issue of fact as to the identity of the 'indirect' source" of disclosure to press), aff'd, 153 F.3d 730 (10th Cir. 1998) (unpublished table decision); Mittleman, 919 F. Supp. at 469 (although no evidence indicated that there had been disclosure of information about plaintiff, even assuming there had been, information at issue would not have been subject to restrictions of Privacy Act because "it was a belief . . . derived from conversations . . . and which was acquired independent from a system of records"); Doe v. United States Dep't of the Interior, No. 95-1665, slip op. at 4-5 (D.D.C. Mar. 11, 1996) (where plaintiff could "not show that the breach [in confidentiality] stemmed from an improper disclosure of [his] records," stating further that "[t]his is especially true in light of the fact that several other employees knew of, and could have told . . . of, plaintiff's illness").
However, the Court of Appeals for the District of Columbia Circuit, in Bartel v. FAA, 725 F.2d 1403, 1408-11 (D.C. Cir. 1984), held that the "actual retrieval" standard is inapplicable where a disclosure is undertaken by agency personnel who had a role in creating the record that contains the released information. In other words, the "independent knowledge" defense is not available to such agency personnel. See id. This particular aspect of Bartel has been noted with approval by several other courts. See Manuel, 857 F.2d at 1120 & n.1; Stokes v. Comm'r, Soc. Sec. Admin., 292 F. Supp. 2d 178, 181 (D. Me. 2003) ("[A]gency employees who . . . create or initiate records are not shielded from the Privacy Act merely because they do not have to consult or retrieve those records before disclosing the information that they contain."); Pilon v. United States Dep't of Justice, 796 F. Supp. 7, 12 (D.D.C. 1992) (denying agency's motion to dismiss or alternatively for summary judgment where information "obviously stem[med] from confidential Department documents and oral statements derived therefrom"); Kassel v. VA, 709 F. Supp. 1194, 1201 (D.N.H. 1989); Cochran v. United States, No. 83-216, slip op. at 9-13 (S.D. Ga. July 2, 1984), aff'd, 770 F.2d 949 (11th Cir. 1985); Fitzpatrick v. IRS, 1 Gov't Disclosure Serv. (P-H) ¶ 80,232, at 80,580 (N.D. Ga. Aug. 22, 1980), aff'd in part, vacated & remanded in part, on other grounds, 665 F.2d 327 (11th Cir. 1982). But cf. Abernethy v. IRS, 909 F. Supp. 1562, 1570 (N.D. Ga. 1995) (holding that alleged statements made to other IRS employees that plaintiff was being investigated pertaining to allegations of EEO violations, assuming they were in fact made, did not violate the Act "because information allegedly disclosed was not actually retrieved from a system of records" even though individual alleged to have made such statements was same individual who ordered investigation), aff'd per curiam, No. 95-9489 (11th Cir. Feb. 13, 1997).
In particular, the Court of Appeals for the Ninth Circuit held that an Administrative Law Judge for the Department of Health and Human Services violated the Privacy Act when he stated in an opinion that one of the parties' attorneys had been placed on a Performance Improvement Plan (PIP) while he was employed at HHS -- despite the fact that there was no actual retrieval by the ALJ -- because, as the creator of the PIP, the ALJ had personal knowledge of the matter. Wilborn v. HHS, 49 F.3d 597, 600-02 (9th Cir. 1995). The Ninth Circuit noted the similarity of the facts to those of Bartel and held that "'independent knowledge,' gained by the creation of records, cannot be used to sidestep the Privacy Act." Id. at 601. Additionally, it rejected the lower court's reasoning that not only was there no retrieval, but there was no longer a record capable of being retrieved because as the result of a grievance action, all records relating to the PIP had been required to be expunged from the agency's records and in fact were expunged by the ALJ himself. Id. at 599-602. The Ninth Circuit found the district court's ruling "inconsistent with the spirit of the Privacy Act," and stated that the "fact that the agency ordered expungement of all information relating to the PIP makes the ALJ's disclosure, if anything, more rather than less objectionable." Id. at 602.
2. Access and Amendment: Subsections (d)(1) and (d)(2)
One of Congress's underlying concerns in narrowly defining a "system of records" appears to have been efficiency -- i.e., a concern that any broader definition would require elaborate cross-references among records and/or burdensome hand-searches for records. See OMB Guidelines, 40 Fed. Reg. at 28,957; see also Baker v. Dep't of the Navy, 814 F.2d 1381, 1385 (9th Cir. 1987); Carpenter v. IRS, 938 F. Supp. 521, 522-23 (S.D. Ind. 1996).
Consistent with OMB's guidance, numerous courts have held that, under subsection (d)(1), an individual has no Privacy Act right of access to his record if it is not indexed and retrieved by his name or personal identifier. See Bettersworth v. FDIC, 248 F.3d 386, 391-92 (5th Cir. 2001); Gowan v. United States Dep't of the Air Force, 148 F.3d 1182, 1191 (10th Cir. 1998); Williams v. VA, 104 F.3d 670, 673 (4th Cir. 1997); Henke v. United States Dep't of Commerce, 83 F.3d 1453, 1458-62 (D.C. Cir. 1996); Manuel v. VA Hosp., 857 F.2d 1112, 1116-17 (6th Cir. 1988); Baker, 814 F.2d at 1383-84; Cuccaro v. Sec'y of Labor, 770 F.2d 355, 360-61 (3d Cir. 1985); Wren v. Heckler, 744 F.2d 86, 89 (10th Cir. 1984); McCready v. Principi, 297 F. Supp. 2d 178, 188 (D.D.C. 2003); Springmann v. United States Dep't of State, No. 93-1238, slip op. at 9 n.2 (D.D.C. Apr. 21, 1997); Fuller v. IRS, No. 96-888, 1997 WL 191034, at **3-5 (W.D. Pa. Mar. 4, 1997); Carpenter, 938 F. Supp. at 522-23; Quinn v. HHS, 838 F. Supp. 70, 76 (W.D.N.Y. 1993); Shewchun v. United States Customs Serv., No. 87-2967, 1989 WL 7351, at *2 (D.D.C. Jan. 11, 1989); Bryant v. Dep't of the Air Force, No. 85-4096, slip op. at 4 (D.D.C. Mar. 31, 1986); Fagot v. FDIC, 584 F. Supp. 1168, 1174-75 (D.P.R. 1984), aff'd in part & rev'd in part, 760 F.2d 252 (1st Cir. 1985) (unpublished table decision); Grachow v. United States Customs Serv., 504 F. Supp. 632, 634-36 (D.D.C. 1980); Smiertka v. United States Dep't of the Treasury, 447 F. Supp. 221, 228 (D.D.C. 1978), remanded on other grounds, 604 F.2d 698 (D.C. Cir. 1979); see also OMB Guidelines, 40 Fed. Reg. at 28,957 (giving examples).
Likewise, with regard to amendment, several courts have ruled that where an individual's record is being maintained allegedly in violation of subsection (e)(1) or (e)(5), the individual has no Privacy Act right to amend his record, under subsection (d)(2), if it is not indexed and retrieved by his name or personal identifier. See Baker, 814 F.2d at 1384-85 ("the scope of accessibility and the scope of amendment are coextensive"); McCready v. Principi, 297 F. Supp. 2d at 188; Seldowitz v. Office of the IG of the United States Dep't of State, No. 99-1031, slip op. at 19-23 (E.D. Va. June 21, 2002), aff'd per curiam, No. 02-1850, 2004 WL 193130 (4th Cir. Feb. 3, 2004); Pototsky v. Dep't of the Navy, 717 F. Supp. 20, 22 (D. Mass. 1989) (following Baker), aff'd per curiam, 907 F.2d 142 (1st Cir. 1990) (unpublished table decision); see also Clarkson v. IRS, 678 F.2d 1368, 1376-77 (11th Cir. 1982) (although finding that subsections (e)(1) and (e)(5) apply only to records contained in a system of records, "find[ing] it both necessary and appropriate to construe the plain meaning of the language of subsections (d)(2) and (d)(3) to authorize the amendment or expungement of all records which are maintained in violation of subsection (e)(7)").
However, with respect to access under subsection (d)(1), and amendment under subsection (d)(2), several courts have cautioned that an agency's purposeful filing of records in a non-name retrieved format, in order to evade those provisions, will not be permitted. See, e.g., Pototsky v. Dep't of the Navy, No. 89-1891, slip op. at 2 (1st Cir. Apr. 3, 1990) (per curiam); Baker, 814 F.2d at 1385; Kalmin v. Dep't of the Navy, 605 F. Supp. 1492, 1495 n.5 (D.D.C. 1985); see also Manuel, 857 F.2d at 1120 ("The Court does not want to give a signal to federal agencies that they should evade their responsibility to place records within their 'system of records' in violation of the [Act].").
Following the rationale of the Fifth Circuit Court of Appeals in Chapman v. NASA, 682 F.2d 526, 529 (5th Cir. 1982), several courts have recognized a subsection (e)(5) duty to incorporate records into a system of records (thus making them subject to access and amendment) where such records are used by the agency in taking an adverse action against the individual. See MacDonald v. VA, No. 87-544-CIV-T-15A, slip op. at 2-5 (M.D. Fla. Feb. 8, 1988); Lawrence v. Dole, No. 83-2876, slip op. at 5-6 (D.D.C. Dec. 12, 1985); Waldrop v. United States Dep't of the Air Force, 3 Gov't Disclosure Serv. (P-H) ¶ 83,016, at 83,453 (S.D. Ill. Aug. 5, 1981); Nelson v. EEOC, No. 83-C-983, slip op. at 6-11 (E.D. Wis. Feb. 14, 1984); cf. Manuel, 857 F.2d at 1117-19 (no duty to place records within system of records where records "are not part of an official agency investigation into activities of the individual requesting the records, and where the records requested do not have an adverse effect on the individual"). But cf. Horowitz v. Peace Corps, No. 00-0848, slip op. at 15-18 (D.D.C. Oct. 12, 2001) (denying plaintiff access to draft Administrative Separation Report (ASR) that was not in "system of records" where Peace Corps manual required that ASR be filed after administrative separation, but must not be completed if volunteer resigns prior to any decision on administrative separation, and issue remained as to whether an administrative separation decision had been made); Gowan v. Dep't of the Air Force, No. 90-94, slip op. at 7, 11, 13, 16, 30, 33 (D.N.M. Sept. 1, 1995) (although ultimately finding access claim moot, stating that "personal notes and legal research" in file "marked 'Ethics'" that was originally kept in desk of Deputy Staff Judge Advocate but that was later given to Criminal Military Justice Section and used in connection with court martial hearing were not in system of records for purposes of either Privacy Act access or accuracy lawsuit for damages), aff'd, 148 F.3d 1182, 1191 (10th Cir. 1998) (concluding "that the word 'Ethics' was not a personal identifier" and stating that it did "not find the district court's rulings regarding those documents to be clearly erroneous").
The "system of records" threshold requirement is not necessarily applicable to all subsections of the Act. See OMB Guidelines, 40 Fed. Reg. at 28,952 (system of records definition "limits the applicability of some of the provisions of the Act") (emphasis added). But see Privacy Commission Report at 503-04 (assuming that definition limits entire Act); cf. Henke v. United States Dep't of Commerce, 83 F.3d 1453, 1459 (D.C. Cir. 1996) ("[T]he determination that a system of records exists triggers virtually all of the other substantive provisions of the Privacy Act."); McCready v. Principi, 297 F. Supp. 2d 178, 185 (D.D.C. 2003) ("For almost all circumstances, the Act extends only to those records that are in a 'system of records' which is a specific term of art.").
For example, in Albright v. United States, 631 F.2d 915, 918-20 (D.C. Cir. 1980), the Court of Appeals for the District of Columbia Circuit held that subsection (e)(7) -- which restricts agencies from maintaining records describing how an individual exercises his First Amendment rights -- applies even to records not incorporated into a system of records. Albright involved a challenge on subsection (e)(7) grounds to an agency's maintenance of a videotape -- kept in a file cabinet in an envelope that was not labeled by any individual's name -- of a meeting between a personnel officer and agency employees affected by the officer's job reclassification decision. Id. at 918. Relying on both the broad definition of "maintain," 5 U.S.C. § 552a(a)(3), and the "special and sensitive treatment accorded First Amendment rights," the D.C. Circuit held that the mere collection of a record regarding those rights could be a violation of subsection (e)(7), regardless of whether the record was contained in a system of records retrieved by an individual's name or personal identifier. Id. at 919-20; see also Maydak v. United States, 363 F.3d 512, 516, 518-19 (D.C. Cir. 2004) (reaffirming holding in Albright).
Albright's broad construction of subsection (e)(7) has been adopted by several other courts. See MacPherson v. IRS, 803 F.2d 479, 481 (9th Cir. 1986); Boyd, 709 F.2d at 687; Clarkson, 678 F.2d at 1373-77; Fagot, 584 F. Supp. at 1175. Further, the Court of Appeals for the Eleventh Circuit in Clarkson, 678 F.2d at 1375-77, held that, at least with respect to alleged violations of subsection (e)(7), the Act's amendment provision (subsection (d)(2)) also can apply to a record not incorporated into a system of records. However, Judge Tjoflat's concurring opinion in Clarkson intimated that something more than a bare allegation of a subsection (e)(7) violation would be necessary in order for an agency to be obligated to search beyond its systems of records for potentially offensive materials. Id. at 1378-79.
Two district courts have gone even further. In Connelly v. Comptroller of the Currency, 673 F. Supp. 1419, 1424 (S.D. Tex. 1987), rev'd on other grounds, 876 F.2d 1209 (5th Cir. 1989), the court construed the broad "any record" language contained in 5 U.S.C. § 552a(g)(1)(C) to permit a damages action arising from an allegedly inaccurate record that was not incorporated into a system of records. In a subsequent opinion, the court in Connelly went on to find a cause of action under subsections (e)(5) and (g)(1)(C) with regard to records not in a system. Connelly v. Comptroller of the Currency, No. H-84-3783, slip op. at 3-4, 42-43 (S.D. Tex. June 3, 1991). In Reuber v. United States, No. 81-1857, slip op. at 5 (D.D.C. Oct. 27, 1982), partial summary judgment denied (D.D.C. Aug. 15, 1983), partial summary judgment granted (D.D.C. Apr. 13, 1984), subsequent decision (D.D.C. Sept. 6, 1984), aff'd on other grounds, 829 F.2d 133 (D.C. Cir. 1987), the district court relied on Albright for the proposition that subsections (d)(2), (e)(1)-(2), (e)(5)-(7), and (e)(10) all apply to a record not incorporated into a system of records. See also Fiorella v. HEW, 2 Gov't Disclosure Serv. (P-H) ¶ 81,363, at 81,946 n.1 (W.D. Wash. Mar. 9, 1981) (noting that subsections (e)(5) and (e)(7) "are parallel in structure and would seem to require the same statutory construction").
Other courts, however, have declined to follow such an approach and have limited the applicability of the Privacy Act requirements that are contained in subsections other than (e)(7) to records that are maintained in a system of records. See, e.g., Gowan v. United States Dep't of the Air Force, 148 F.3d 1182, 1192 (10th Cir. 1998) (holding that appellant "ha[d] no § 552a(e)(5) cause of action" for maintenance of report that was not maintained in system of records); Clarkson, 678 F.2d at 1377 (declining to extend Albright rationale to subsections (e)(1) and (e)(5)); Bettersworth v. FDIC, No. A-97-CA-624, slip op. at 10 (W.D. Tex. Feb. 1, 2000) (magistrate's recommendation) (recognizing holding in Connelly, but noting that both subsections (d)(1) and (g)(1)(C) contain same "system of records" language, and stating that court is "unpersuaded that Congress intended any other meaning than what has previously been applied"), adopted (W.D. Tex. Feb. 17, 2000), aff'd on other grounds, 248 F.3d 386 (5th Cir. 2001); Felsen v. HHS, No. CCB-95-975, slip op. at 61-62, 65 (D. Md. Sept. 30, 1998) (granting defendants summary judgment on alternative ground that subsection (e)(2) is inapplicable to records not included in system of records); Barhorst, 765 F. Supp. at 999-1000 (dismissing, on alternative grounds, Privacy Act claims under subsections (b), (e)(1)-(3), (e)(5)-(6), and (e)(10) because of finding that information was not in system of records; information was retrieved by job announcement number, not by name or other identifying particular).
Albright and its progeny establish that the "system of records" limitation on the scope of the Act is not uniformly applicable to all of the statute's subsections. As is apparent from the above discussion, there has been some uncertainty about which particular subsections of the statute are limited to records contained in a "system of records."
Recently, however, both the Court of Appeals for the District of Columbia Circuit and the District Court for the District of Columbia have been confronted with the opportunity of extending the holding in Albright to other subsections of § 552a(e). Both have declined to do so. In Maydak v. United States, 363 F.3d 512, 517-19 (D.C. Cir. 2004), the D.C. Circuit held that in accordance with the OMB Guidelines, the requirements contained in subsections (e)(1), (2), (3), and (10) are "triggered only if the records are actually incorporated into a system of records." The D.C. Circuit explained that it reached a different conclusion as to subsection (e)(7) in Albright because of "'Congress'[s] own special concern for the protection of First Amendment rights,'" id. at 518 (quoting Albright, 631 F.2d at 919), and it went on to state that "at least in comparison to the other subsections at issue, subsection 552a(e)(7) proves the exception rather than the rule," id. at 519. Similarly, the D.C. District Court in McCready v. Principi explicitly ruled that the "analysis and reasoning [of Albright and Clarkson with regard to subsection (e)(7)] do not apply to the other subsections of § 552(e)." 297 F. Supp. 2d at 187. It went on to state that "[subs]ection (e) itself starts with reference to a system of records . . . and the distinction as to (e)(7) exists only because of constitutional concerns." Id. The court in McCready also found that the system of records requirement limits damages claims under subsections (g)(1)(C) and (D), id., and that it likewise applies to subsection (c)'s accounting provisions, id. at 198, as well as to subsection (e)(10)'s safeguards requirement, id. at 197-98 & n.13.
Go to Table of Contents ||
Previous Section Policy Objectives ||
Next Section Conditions of Disclosure to Third Parties