CONDITIONS OF DISCLOSURE TO THIRD PARTIES

A. The "No Disclosure Without Consent" Rule

"No agency shall disclose any record which is contained in a system of records by any means of communication to any person, or to another agency, except pursuant to a written request by, or with the prior written consent of, the individual to whom the record pertains [subject to 12 exceptions]." 5 U.S.C. § 552a(b).

Comment:

A "disclosure" can be by any means of communication -- written, oral, electronic, or mechanical. See OMB Guidelines, 40 Fed. Reg. 28,948, 28,953 (July 9, 1975); see also, e.g., Orekoya v. Mooney, 330 F.3d 1, 6 (1st Cir. 2003) ("The Privacy Act prohibits more than dissemination of records themselves, but also 'nonconsensual disclosure of any information that has been retrieved from a protected record.'" (quoting Bartel v. FAA, 725 F.2d 1403, 1408 (D.C. Cir. 1984))); Chang v. Dep't of the Navy, No 00-0783, 2004 WL 882030, at *5 n.2 (D.D.C. Apr. 22, 2004) ("[D]isclosure encompasses release of the contents of a record 'by any means of communication,' 5 U.S.C. § 552a(b), and not just 'the mere physical dissemination of records (or copies).'" (quoting Bartel, 725 F.2d at 1408)).

A plaintiff has the burden of demonstrating that a disclosure by the agency has occurred. See, e.g., Askew v. United States, 680 F.2d 1206, 1209-11 (8th Cir. 1982); Zerilli v. Smith, 656 F.2d 705, 715-16 (D.C. Cir. 1981); cf. Brown v. Snow, 94 Fed. Appx. 369, at *3 (7th Cir. 2004) (ruling that district court grant of summary judgment was proper where no evidence was found that record was disclosed, and stating that "burden is on the plaintiff at the summary judgment stage to come forward with specific evidence"); Lennon v. Rubin, 166 F.3d 6, 10-11 (1st Cir. 1999) (where agency employee testified that, despite memorandum indicating otherwise, she had disclosed information only within agency, and where plaintiff responded that whether his file was reviewed by other individuals is question of fact he "want[ed] decided by a fact finder, 'not an affidavit,'" stating that such "arguments misapprehend [plaintiff's] burden at the summary judgment stage"); Whyde v. Rockwell Int'l Corp., No. C2-97-1114, 2002 WL 31951269, at *2 (S.D. Ohio Dec. 4, 2002) (where only evidence that agency disclosed documents to company was presence of documents in company's records, and where plaintiff acknowledged that he may have given documents to company, stating that "[m]ere speculation will not overcome a motion for summary judgment") (appeal pending); Meldrum v. USPS, No. 5:97CV1482, slip op. at 11 (N.D. Ohio Jan. 21, 1999) (finding lack of evidence that disclosure occurred where plaintiff alleged that, among other things, file had been left in unsecured file cabinet), aff'd per curiam, No. 99-3397, 2000 WL 1477495, at *2 (6th Cir. Sept. 25, 2000).

It has frequently been held that a "disclosure" under the Privacy Act does not occur if the communication is to a person who is already aware of the information. See, e.g., Quinn v. Stone, 978 F.2d 126, 134 (3d Cir. 1992) (dictum); Kline v. HHS, 927 F.2d 522, 524 (10th Cir. 1991); Hollis v. United States Dep't of the Army, 856 F.2d 1541, 1545 (D.C. Cir. 1988); Reyes v. Supervisor of DEA, 834 F.2d 1093, 1096 n.1 (1st Cir. 1987); Schowengerdt v. Gen. Dynamics Corp., 823 F.2d 1328, 1341 (9th Cir. 1987); Pellerin v. VA, 790 F.2d 1553, 1556 (11th Cir. 1986); FDIC v. Dye, 642 F.2d 833, 836 (5th Cir. 1981); Ash v. United States, 608 F.2d 178, 179 (5th Cir. 1979); Sullivan v. USPS, 944 F. Supp. 191, 196 (W.D.N.Y. 1996); Viotti v. United States Air Force, 902 F. Supp. 1331, 1337 (D. Colo. 1995), aff'd, 153 F.3d 730 (10th Cir. 1998) (unpublished table decision); Abernethy v. IRS, 909 F. Supp. 1562, 1571 (N.D. Ga. 1995), aff'd per curiam, No. 95-9489 (11th Cir. Feb. 13, 1997); Kassel v. VA, 709 F. Supp. 1194, 1201 (D.N.H. 1989); Krowitz v. USDA, 641 F. Supp. 1536, 1545 (W.D. Mich. 1986), aff'd, 826 F.2d 1063 (6th Cir. 1987) (unpublished table decision); Golliher v. USPS, 3 Gov't Disclosure Serv. ¶ 83,114, at 83,702 (N.D. Ohio June 10, 1982); King v. Califano, 471 F. Supp. 180, 181 (D.D.C. 1979); Harper v. United States, 423 F. Supp. 192, 197 (D.S.C. 1976); see also Hoffman v. Rubin, 193 F.3d 959, 966 (8th Cir. 1999) (no Privacy Act violation found where agency disclosed same information in letter to journalist that plaintiff himself had previously provided to journalist; plaintiff "waiv[ed], in effect, his protection under the Privacy Act"); Schmidt v. VA, 218 F.R.D. 619, 630 (E.D. Wis. 2003) ("defin[ing] the term 'disclose' to mean the placing into the view of another information which was previously unknown"); Loma Linda Cmty. Hosp. v. Shalala, 907 F. Supp. 1399, 1404-05 (C.D. Cal. 1995) (policy underlying Privacy Act of protecting confidential information from disclosure not implicated by release of information health care provider had already received through patients' California "Medi-Cal" cards); Owens v. MSPB, No. 3-83-0449-R, slip op. at 2-3 (N.D. Tex. Sept. 14, 1983) (mailing of agency decision affirming employee's removal to his former attorney held not a "disclosure" as "attorney was familiar with facts of [employee's] claim" and "no new information was disclosed to him"); cf. Pippinger v. Rubin, 129 F.3d 519, 532-33 (10th Cir. 1997) (finding no evidence that disclosure "could possibly have had 'an adverse effect'" on plaintiff where recipient "had been privy to every event described in [plaintiff's] records at the time the event occurred"); Jones v. Runyon, 32 F. Supp. 2d 873, 876 (N.D. W. Va. 1998) (although finding disclosure to credit reporting service valid under routine use exception, stating further that information disclosed was already in possession of recipient and that other courts had held that Privacy Act is not violated in such cases), aff'd, 173 F.3d 850 (4th Cir. 1999) (unpublished table decision).

However, the Court of Appeals for the District of Columbia Circuit clarified that this principle does not apply to all disseminations of protected records to individuals with prior knowledge of their existence or contents. Pilon v. United States Dep't of Justice, 73 F.3d 1111, 1117-24 (D.C. Cir. 1996). In Pilon, the D.C. Circuit held that the Justice Department's transmission of a Privacy Act-protected record to a former employee of the agency constituted a "disclosure" under the Privacy Act, even though the recipient had come "into contact with the [record] in the course of his duties" while an employee. Id. The court's "review of the Privacy Act's purposes, legislative history, and integrated structure convince[d it] that Congress intended the term 'disclose' to apply in virtually all instances to an agency's unauthorized transmission of a protected record, regardless of the recipient's prior familiarity with it." Id. at 1124.

In an earlier case, Hollis v. United States Department of the Army, 856 F.2d 1541 (D.C. Cir. 1988), the D.C. Circuit had held that the release of a summary of individual child-support payments previously deducted from plaintiff's salary and sent directly to his ex-wife, who had requested it for use in pending litigation, was not an unlawful disclosure under the Privacy Act as she, being the designated recipient of the child-support payments, already knew what had been remitted to her. Id. at 1545. In Pilon, the D.C. Circuit reconciled its opinion in Hollis by "declin[ing] to extend Hollis beyond the limited factual circumstances that gave rise to it," 73 F.3d at 1112, 1124, and holding that:

[A]n agency's unauthorized release of a protected record does constitute a disclosure under the Privacy Act except in those rare instances, like Hollis, where the record merely reflects information that the agency has previously, and lawfully, disseminated outside the agency to the recipient, who is fully able to reconstruct its material contents.

Id. at 1124; cf. Osborne v. USPS, No. 94-30353, slip op. at 2-4, 6-11 (N.D. Fla. May 18, 1995) (assuming without discussion that disclosure of plaintiff's injury-compensation file to retired employee who had prepared file constituted "disclosure" for purposes of Privacy Act).

A few courts, though, have extended the principle that there is no "disclosure" to rule that the release of previously published or publicly available information is not a Privacy Act "disclosure" -- regardless of whether the particular persons who received the information were aware of the previous publication. See FDIC v. Dye, 642 F.2d at 836; Lee v. Dearment, No. 91-2175, 1992 WL 119855, at *2 (4th Cir. June 3, 1992); Smith v. Cont'l Assurance Co., No. 91-C-0963, 1991 WL 164348, at *5 (N.D. Ill. Aug. 22, 1991); Friedlander v. USPS, No. 84-0773, slip op. at 8 (D.D.C. Oct. 16, 1984); King, 471 F. Supp. at 181. But see Quinn, 978 F.2d at 134 (holding that release of information that is "merely readily accessible" to public "is a disclosure under 552a(b)"); Gowan v. United States Dep't of the Air Force, 148 F.3d 1182, 1193 (10th Cir. 1998) ("adopt[ing] the Third Circuit's reasoning [in Quinn] and hold[ing] that an agency may not defend a release of Privacy Act information simply by stating that the information is a matter of public record"); cf. Doe v. Herman, No. 297CV00043, 1999 WL 1000212, at *11 (W.D. Va. Oct. 29, 1999) (magistrate's recommendation) (agreeing with Quinn in dictum), adopted in pertinent part & rev'd in other part (W.D. Va. July 24, 2000), aff'd in part, rev'd in part, & remanded, on other grounds sub nom. Doe v. Chao, 306 F.3d 170 (4th Cir. 2002), aff'd, 124 S. Ct. 1204 (2004); Pilon v. United States Dep't of Justice, 796 F. Supp. 7, 11-12 (D.D.C. 1992) (rejecting argument that information was already public and therefore could not violate Privacy Act where agency had republished statement that was previously publicly disavowed as false by agency). The D.C. Circuit had recognized in dictum that other courts had so held, and perhaps had indicated a willingness to go that far. Hollis, 856 F.2d at 1545 (holding that a disclosure did not violate the Privacy Act because the recipient of the information already was aware of it, but stating that "[o]ther courts have echoed the sentiment that when a release consists merely of information to which the general public already has access, or which the recipient of the release already knows, the Privacy Act is not violated").

However, the D.C. Circuit's subsequent holding in Pilon v. United States Department of Justice, 73 F.3d 1111 (D.C. Cir. 1996), discussed above, appears to foreclose such a possibility. In Pilon, the D.C. Circuit further held that even under the narrow Hollis interpretation of "disclose," the agency would not be entitled to summary judgment because it had "failed to adduce sufficient evidence that [the recipient of the record] remembered and could reconstruct the document's material contents in detail at the time he received it." 73 F.3d at 1124-26. Nevertheless, the D.C. Circuit in Pilon noted that "[t]his case does not present the question of whether an agency may . . . release a document that has already been fully aired in the public domain through the press or some other means" but that "the Privacy Act approves those disclosures that are 'required' under the [FOIA] . . . and that under various FOIA exemptions, prior publication is a factor to be considered in determining whether a document properly is to be released." Id. at 1123 n.10; see also Barry v. United States Dep't of Justice, 63 F. Supp. 2d 25, 27-28 (D.D.C. 1999) (distinguishing Pilon and finding no disclosure where agency posted Inspector General report on Internet Web site, after report had already been fully released to media by Congress and had been discussed in public congressional hearing, even though some Internet users might encounter report for first time on Web site). Furthermore, though, and consistent with the D.C. Circuit's note in Pilon, one might argue that to say that no "disclosure" occurs for previously published or public information is at least somewhat inconsistent with the Supreme Court's decision in United States Department of Justice v. Reporters Committee for Freedom of the Press, 489 U.S 749, 762-71 (1989), which held that a privacy interest can exist, under the FOIA, in publicly available -- but "practically obscure" -- information, such as a criminal history record. Cf. Finley v. Nat'l Endowment for the Arts, 795 F. Supp. 1457, 1468 (C.D. Cal. 1992) (alleged disclosure of publicly available information states claim for relief under Privacy Act; recognizing Reporters Committee).

The legislative history indicates that "a court is not defined as an 'agency' nor is it intended to be a 'person' for purposes of [the Privacy Act]," and that the Act was "not designed to interfere with access to information by the courts." 120 Cong. Rec. 36,967 (1974), reprinted in Source Book at 958-59. However, the public filing of records with a court, during the course of litigation, does constitute a subsection (b) disclosure. See Laningham v. United States Navy, No. 83-3238, slip op. at 2-3 (D.D.C. Sept. 25, 1984), summary judgment granted (D.D.C. Jan. 7, 1985), aff'd per curiam, 813 F.2d 1236 (D.C. Cir. 1987); Citizens Bureau of Investigation v. FBI, No. 78-60, slip op. at 2-3 (N.D. Ohio Dec. 14, 1979). Accordingly, any such public filing must be undertaken with written consent or in accordance with either the subsection (b)(3) routine use exception or the subsection (b)(11) court order exception, both discussed below. See generally Krohn v. United States Dep't of Justice, No. 78-1536, slip op. at 3-11 (D.D.C. Mar. 19, 1984) (finding violation of Privacy Act where agency's disclosure of records as attachments to affidavit in FOIA lawsuit "did not fall within any of the exceptions listed in Section 552a"), reconsideration granted & vacated in nonpertinent part (D.D.C. Nov. 29, 1984) (discussed below).

Often during the course of litigation, an agency will be asked to produce Privacy Act-protected information pursuant to a discovery request by an opposing party. An agency in receipt of such a request must object on the ground that the Privacy Act prohibits disclosure. Although courts have unanimously held that the Privacy Act does not create a discovery privilege, see Laxalt v. McClatchy, 809 F.2d 885, 888-90 (D.C. Cir. 1987); Weahkee v. Norton, 621 F.2d 1080, 1082 (10th Cir. 1980); Forrest v. United States, No. 95-3889, 1996 WL 171539, at *2 (E.D. Pa. Apr. 11, 1996); Ford Motor Co. v. United States, 825 F. Supp. 1081, 1083 (Ct. Int'l Trade 1993); Clavir v. United States, 84 F.R.D. 612, 614 (S.D.N.Y. 1979); cf. Baldrige v. Shapiro, 455 U.S. 345, 360-62 (1982) (Census Act confidentiality provisions constitute privilege because they "embody explicit congressional intent to preclude all disclosure"), an agency can disclose Privacy Act-protected records only as permitted by the Act. The most appropriate method of disclosure in this situation is pursuant to a subsection (b)(11) court order. See generally Doe v. DiGenova, 779 F.2d 74 (D.C. Cir. 1985); Doe v. Stephens, 851 F.2d 1457 (D.C. Cir. 1988) (both discussed below under subsection (b)(11)); see also Boudreaux v. United States, No. 97-1592, 1999 WL 499911, at **1-2 (E.D. La. July 14, 1999) (recognizing the relevancy of subsection (b)(11) to the court's resolution of a dispute over a motion to compel responses to production of documents subject to the Privacy Act, but ordering in camera review of the documents so that the legitimacy of the agency objections may be determined "in the considered and cautious manner contemplated by the Privacy Act"). Indeed, the courts that have rejected the Privacy Act as a discovery privilege have pointed to subsection (b)(11)'s allowance for court-ordered disclosures in support of their holdings. See Laxalt, 809 F.2d at 888-89; Weahkee, 621 F.2d at 1082; Hernandez v. United States, No. 97-3367, 1998 WL 230200, at **2-3 (E.D. La. May 6, 1998); Forrest, 1996 WL 171539, at *2; Ford Motor Co., 825 F. Supp. at 1082-83; Clavir, 84 F.R.D. at 614; cf. Alford v. Todco, No. CIV-88-731E, slip op. at 4-5 (W.D.N.Y. June 12, 1990) ("Even assuming the Privacy Act supplies a statutory privilege . . . the plaintiff has waived any such privilege by placing his physical condition at issue."; ordering production of records); Tootle v. Seaboard Coast Line R.R., 468 So. 2d 237, 239 (Fla. Dist. Ct. App. 1984) (recognizing that privacy interests in that case "must give way to the function of the discovery of facts" and that subsection (b)(11) provides the mechanism for disclosure).

On the other hand, when an agency wishes to make an affirmative disclosure of information during litigation it may either rely on a routine use permitting such disclosure or seek a court order. Because the Privacy Act does not constitute a statutory privilege, agencies need not worry about breaching or waiving such a privilege when disclosing information pursuant to subsections (b)(3) or (b)(11). Cf. Mangino v. Dep't of the Army, No. 94-2067, 1994 WL 477260, at **5-6 (D. Kan. Aug. 24, 1994) (finding that disclosure to court was appropriate pursuant to agency routine use and stating that to extent Privacy Act created privilege, such privilege was waived by plaintiff when he placed his records at issue through litigation); Lemasters v. Thomson, No. 92 C 6158, 1993 U.S. Dist. LEXIS 7513, at **3-8 (N.D. Ill. June 3, 1993) (same finding as in Mangino, despite fact that "court ha[d] not located" applicable routine use). For further discussions of disclosures during litigation, see the discussions of subsections (b)(3) and (b)(11), below.

By its own terms, subsection (b) does not prohibit an agency from releasing to an individual his own record, contained in a system of records retrieved by his name or personal identifier, in response to his "first-party" access request under subsection (d)(1). However, as is discussed below under "Individual's Right of Access," one exception to this point could conceivably arise in the first-party access context where a record is also about another individual and is "dually retrieved." Such a position has been rejected, though, by the only court to consider it. See Topuridze v. USIA, 772 F. Supp. 662, 665-66 (D.D.C. 1991). Subsection (b) also explicitly authorizes disclosures made with the prior written consent of the individual. See, e.g., Taylor v. Potter, No. 02-1552, 2004 WL 422664, at **1-2 (D. Del. Mar. 4, 2004) (finding it to be "clear from the documents attached to Plaintiff's complaint that she provided prior written consent . . . for her medical records to be disclosed"); Scherer v. Hill, No. 02-2043, 2002 U.S. Dist. LEXIS 17872, at **6-8 (D. Kan. Sept. 17, 2002) (finding plaintiff's argument that agency violated his privacy by sending photographs of his skin condition to United States Attorney rather than directly to him to be "frivolous," as "[h]e specifically asked the 'US Attorney and the Veterans Administration' to produce the photographs" in his motion to compel, and the "Privacy Act does not prohibit the consensual disclosure of photographs or documents by an agency"); cf. Stokes v. Comm'r, Soc. Sec. Admin., 292 F. Supp. 2d 178, 181 (D. Me. 2003) ("The Privacy Act does not prevent an agency employee from discussing the contents of a protected record with the person to whom the record pertains."; finding that statement directed at the subject of the record "did not become the kind of 'disclosure' for which the Privacy Act requires written consent merely because [a third party] overheard it," especially given that the individual gave the employee consent to continue the interview in the third party's presence and thereby, in accordance with the agency regulation, "affirmatively authorized [the third party's] presence during this discussion").

Additionally, although it may seem self-evident, the fact pattern in one case caused a court to explicitly hold that an agency cannot be sued for disclosures that an individual makes himself. Abernethy, 909 F. Supp. at 1571 (plaintiff had informed employees that he was being removed from his position as their supervisor and disclosed reason for his removal).

The Act does not define "written consent." Implied consent, however, has been held to be insufficient. See Taylor v. Orr, No. 83-0389, 1983 U.S. Dist. LEXIS 20334, at *6 n.6 (D.D.C. Dec. 5, 1983) ("Implied consent is never enough" as the Act's protections "would be seriously eroded if plaintiff's written submission of [someone's] name were construed as a voluntary written consent to the disclosure of her [medical] records to him."). But see Pellerin, 790 F.2d at 1556 (applying doctrine of "equitable estoppel" to bar individual from complaining of disclosure of his record to congressmen "when he requested their assistance in gathering such information") (distinguished in Swenson v. USPS, 890 F.2d 1075, 1077-78 (9th Cir. 1989)); Jones v. Army Air Force Exchange Serv. (AAFES), No. 3:00-CV-0535, 2002 WL 32359949, at *5 (N.D. Tex. Oct. 17, 2002) (with respect to plaintiff's claim that AAFES disclosed protected information to congressional offices in violation of the Privacy Act, finding plaintiff to be "estopped from asserting such a claim because AAFES released the information pursuant to congressional office inquiries that were initiated at Plaintiff's request"); cf. Baitey v. VA, No. 8:CV89-706, slip op. at 5 (D. Neb. June 21, 1995) (concluding that "at a minimum, the phrase 'written consent' necessarily requires either (1) a medical authorization signed by [plaintiff] or (2) conduct which, coupled with the unsigned authorization, supplied the necessary written consent for the disclosure").

The scope of express consent, however, cannot be "so vague or general that it is questionable whether [the individual] knew what he was authorizing or whether the [agency] knew what documents it could lawfully release." Perry v. FBI, 759 F.2d 1271, 1276 (7th Cir. 1985), rev'd en banc on other grounds, 781 F.2d 1294 (7th Cir. 1986); see also AFGE v. United States R.R. Ret. Bd., 742 F. Supp. 450, 457 (N.D. Ill. 1990) (SF-86 "release form" held overbroad and contrary to subsection (b)); Taylor, No. 83-0389, 1983 U.S. Dist. LEXIS 20334, at *6 n.6 (D.D.C. Dec. 5, 1983) ("It is not unreasonable to require that a written consent to disclosure address the issue of such disclosure and refer specifically to the records permitted to be disclosed."); Thomas v. VA, 467 F. Supp. 458, 460 n.4 (D. Conn. 1979) (consent held adequate because it was both agency- and record-specific); cf. Fattahi v. ATF, 186 F. Supp. 2d 656, 660 (E.D. Va. 2002) (consent providing that the information on an application "may be disclosed to members of the public in order to verify the information on the application when such disclosure is not prohibited by law" was "a mere tautology: plaintiff consented to no more than that ATF may disclose information except in cases where that disclosure is prohibited"); Doe v. Herman, No. 297CV00043, 1999 WL 100012, at *9 (W.D. Va. Oct. 29, 1999) (magistrate's recommendation) (rejecting argument that when plaintiffs provided their social security numbers for purpose of determining eligibility for and amount of benefits payable, they consented to use of those numbers as identifiers on multi-captioned hearing notices sent to numerous other individuals and companies as well as to publication of numbers in compilations of opinions), adopted in pertinent part & rev'd in other part (W.D. Va. July 24, 2000), aff'd in part, rev'd in part, & remanded, on other grounds sub nom. Doe v. Chao, 306 F.3d 170 (4th Cir. 2002), aff'd, 124 S. Ct. 1204 (2004); Doe v. GSA, 544 F. Supp. 530, 539-41 (D. Md. 1982) (authorization which was neither record- nor entity-specific was insufficient under GSA's own internal interpretation of Privacy Act). But cf. Wiley v. VA, 176 F. Supp. 2d 747, 751-56 (E.D. Mich. 2001) (accepting written release signed by plaintiff in connection with application for employment that broadly authorized employer to corroborate and obtain information about plaintiff's background, without reference to particular time frame, as valid consent under Privacy Act to authorize disclosure of all 466 pages of plaintiff's VA claims file to employer to be used in connection with union grievance proceeding, even though release was signed eight years prior to disclosure; stating further that "[p]laintiff might well have forfeited his Privacy Act protection through his own selective disclosure of and reference to his VA records"). The OMB Guidelines caution that "the consent provision was not intended to permit a blanket or open-ended consent clause, i.e., one which would permit the agency to disclose a record without limit," and that, "[a]t a minimum, the consent clause should state the general purposes for, or types of recipients[ to,] which disclosure may be made." 40 Fed. Reg. at 28,954.

In light of the D.C. Circuit's decision in Summers v. United States Department of Justice, 999 F.2d 570, 572-73 (D.C. Cir. 1993), agencies whose regulations require that privacy waivers be notarized to verify identity must also accept declarations in accordance with 28 U.S.C. § 1746 (2000) (i.e., an unsworn declaration subscribed to as true under penalty of perjury). See, e.g., 28 C.F.R. § 16.41(d) (2004) (Department of Justice regulation regarding verification of identity).

B. Twelve Exceptions to the "No Disclosure Without Consent" Rule

Note that with the exception of disclosures under subsection (b)(2) (see the discussion below), disclosures under the following exceptions are permissive, not mandatory. See OMB Guidelines, 40 Fed. Reg. at 28,953.

1. 5 U.S.C. § 552a(b)(1) ("need to know" within agency)

"to those officers and employees of the agency which maintains the record who have a need for the record in the performance of their duties."

Comment:

This "need to know" exception authorizes the intra-agency disclosure of a record for necessary, official purposes. See OMB Guidelines, 40 Fed. Reg. 28,948, 28,950-01, 28,954 (July 9, 1975). The Privacy Act's legislative history indicates an intent that the term "agency" be given "its broadest statutory meaning," and it recognizes the propriety of "need to know" disclosures between various components of large agencies. See 120 Cong. Rec. 36,967 (1974), reprinted in Source Book at 958 (recognizing propriety of "need to know" disclosures between Justice Department components); see also Lora v. United States Dep't of Justice, No. 00-3072, slip op. at 14-15 (D.D.C. Apr. 9, 2004) (citing subsection (b)(1) and legislative history, and finding plaintiff's argument that Privacy Act violation occurred when INS, then component of Department of Justice, released documents to prosecutor to be without merit); Walker v. Ashcroft, No. 99-2385, slip op. at 18-20 & n.6 (D.D.C. Apr. 30, 2001) (alternative holding) (finding that disclosures from FBI field office to FBI Headquarters and then to Department of Justice prosecutors were "proper under the 'need to know' exception"; "FBI employees and federal prosecutors are considered employees of the same agency, namely the Department of Justice."), summary affirmance granted, No. 01-5222, 2002 U.S. App. LEXIS 2485, at *2 (D.C. Cir. Jan. 25, 2002).

Intra-agency disclosures for improper purposes will not be condoned. See, e.g., Parks v. IRS, 618 F.2d 677, 680-81 & n.1 (10th Cir. 1980) (publication of names of employees who did not purchase savings bonds, "for solicitation purposes," held improper); MacDonald v. VA, No. 87-544-CIV-T-15A, slip op. at 8-9 (M.D. Fla. July 28, 1989) (disclosure of counseling memorandum in "callous attempt to discredit and injure" employee held improper); Koch v. United States, No. 78-273T, slip op. at 1-2 (W.D. Wash. Dec. 30, 1982) (letter of termination posted in agency's entrance hallway held improper); Smigelsky v. USPS, No. 79-110-RE, slip op. at 3-4 (D. Or. Oct. 1, 1982) (publication of employees' reasons for taking sick leave held improper); Fitzpatrick v. IRS, 1 Gov't Disclosure Serv. (P-H) ¶ 80,232, at 80,580 (N.D. Ga. Aug. 22, 1980) (disclosure of fact that employee's absence was due to "mental problems" held improper; "quelling rumors and gossip [and] satisfying curiosity is not to be equated with a need to know"), aff'd in part, vacated & remanded in part, on other grounds, 665 F.2d 327 (11th Cir. 1982); see also Bigelow v. DOD, 217 F.3d 875, 879 (D.C. Cir. 2000) (Tatel, J., dissenting) (interpreting DOD regulations to find that supervisor did not have official need to review personnel security file of individual he supervised); Vargas v. Reno, No. 99-2725, slip op. at 3, 12-13 (W.D. Tenn. Mar. 31, 2000) (denying summary judgment where no evidence was submitted to show that information about plaintiff that was disclosed to Inspector General agent in course of investigating another employee was disclosed based on agent's "need to know"); cf. Berry v. Henderson, No. 99-283-P-C, 2000 WL 761896, at **1, 3 (D. Me. May 8, 2000) (finding that agency's examination of personnel and medical records within its possession in connection with its defense in Title VII case did not satisfy subsection (b)(1) and constituted violation of Privacy Act, despite fact that agency did not contend that disclosure was proper under subsection (b)(1)).

The cases are replete with examples of proper intra-agency "need to know" disclosures. See, e.g., Bigelow v. DOD, 217 F.3d 875, 876-78 (D.C. Cir. 2000) (review of plaintiff's personnel file by immediate supervisor in connection with supervisor's "continuing duty to make sure that [plaintiff] was worthy of trust"; supervisor "had a need to examine the file in view of the doubts that had been raised in his mind about [plaintiff] and [plaintiff's] access to the country's top secrets"); Lennon v. Rubin, 166 F.3d 6, 10 (1st Cir. 1999) (citing subsection (b)(1) and finding that district court correctly granted summary judgment to defendant where, despite memorandum indicating intent to distribute information to task force that included individuals from outside agency, agency employee testified that she actually gave information only to member who was agency employee and recipient employee declared that she had never given information to other task force members); Hudson v. Reno, 130 F.3d 1193, 1206-07 (6th Cir. 1997) (disclosure of plaintiff's performance evaluation to individual who typed it originally, for retyping); Pippinger v. Rubin, 129 F.3d 519, 529-31 (10th Cir. 1997) (disclosure of identity of investigation's subject by supervisor investigating allegations of employee misconduct to staff members to assist in investigation; disclosure to agency attorney charged with defending agency's actions in related MSPB proceeding against another individual); Mount v. USPS, 79 F.3d 531, 533-34 (6th Cir. 1996) (disclosure of information in plaintiff's medical records to other employees "with responsibilities for making employment and/or disciplinary decisions regarding plaintiff"; "In light of the questions surrounding plaintiff's mental stability, each had at least an arguable need to access the information in plaintiff's medical records."); Britt v. Naval Investigative Serv., 886 F.2d 544, 549 n.2 (3d Cir. 1989) (disclosure of investigative report to commanding officer approved "since the Reserves might need to reevaluate Britt's access to sensitive information or the level of responsibility he was accorded"); Covert v. Harrington, 876 F.2d 751, 753-54 (9th Cir. 1989) (disclosure of security questionnaires to Inspector General for purpose of detecting fraud); Daly-Murphy v. Winston, 837 F.2d 348, 354-55 (9th Cir. 1988) (disclosure of letter suspending doctor's clinical privileges to participants in peer-review proceeding); Lukos v. IRS, No. 86-1100, 1987 WL 36354, at **1-2 (6th Cir. Feb. 12, 1987) (disclosure of employee's arrest record to supervisor for purpose of evaluating his conduct and to effect discipline); Howard v. Marsh, 785 F.2d 645, 647-49 (8th Cir. 1986) (disclosure of employee's personnel records to agency attorney and personnel specialist for purpose of preparing response to discrimination complaint); Hernandez v. Alexander, 671 F.2d 402, 410 (10th Cir. 1982) (disclosure of employee's EEO files to personnel advisors for purpose of determining whether personnel action should be taken against employee); Grogan v. IRS, 3 Gov't Disclosure Serv. (P-H) ¶ 82,385, at 82,977-78 (4th Cir. Mar. 22, 1982) (disclosure of questionable income tax returns prepared by professional tax preparer while he was IRS employee to IRS examiners for purpose of alerting them to possible irregularities); Beller v. Middendorf, 632 F.2d 788, 798 n.6 (9th Cir. 1980) (disclosure of record revealing serviceman's homosexuality by Naval Investigative Service to commanding officer for purpose of reporting "a ground for discharging someone under his command"); McCready v. Principi, 297 F. Supp. 2d 178, 197 n.11 (D.D.C. 2003) (although not specifically citing subsection (b)(1), finding that "limited distribution of [a memorandum concerning plaintiff] to those [within the agency] with a legitimate need to know did not violate [plaintiff's] rights under the Privacy Act"); Schmidt v. VA, 218 F.R.D. 619, 631 (E.D. Wis. 2003) (although finding no evidence of disclosure, even presuming disclosure took place finding that "VA personnel need to have access to the entire [social security number] of persons accessible through the [Computerized Patient Records System] to avoid misidentification"); Hanna v. Herman, 121 F. Supp. 2d 113, 123-24 (D.D.C. 2000) (disclosure of information by agency official about plaintiff's demotion to another supervisor was covered by "need to know" exception even though that supervisor was not within same office), summary affirmance granted sub nom. Hanna v. Chao, No. 00-5433 (D.C. Cir. Apr. 11, 2001); Khalfani v. Sec'y, VA, No. 94-CV-5720, 1999 WL 138247, at **7-8 (E.D.N.Y. Mar. 10, 1999) (disclosure of plaintiff's medical records within VA so that his supervisor could document his request for medical leave and determine level of work he could perform), appeal dismissed for appellant's failure to comply with scheduling order, No. 99-6157 (2d Cir. Oct. 10, 2000); Blazy v. Tenet, 979 F. Supp. 10, 26 (D.D.C. 1997) (disclosure of status of plaintiff's security investigation to his supervisor and disclosure of records needed by members of Employee Review Panel responsible for assessing plaintiff's employment performance and prospects), summary affirmance granted, No. 97-5330, 1998 WL 315583 (D.C. Cir. May 12, 1998); Porter v. USPS, No. CV595-30, slip op. at 23-24 (S.D. Ga. July 24, 1997) (disclosure of employee's medical records to supervisory personnel in order to "figure out exactly what level of duty [employee] was fit and able to perform"), aff'd, 166 F.3d 352 (11th Cir. 1998) (unpublished table decision); Jones v. Dep't of the Air Force, 947 F. Supp. 1507, 1515-16 (D. Colo. 1996) (Air Force investigator's review of plaintiff's medical and mental health records and publication of statements about the records in report of investigation compiled in preparation for plaintiff's court-martial, which was distributed to certain Air Force personnel); Viotti v. United States Air Force, 902 F. Supp. 1331, 1337 (D. Colo. 1995) (disclosure by general to academic department staff that he was removing acting head of department because he had lost confidence in his leadership; subsequent disclosure by new head of department to department staff of same information regarding removal of prior department head), aff'd, 153 F.3d 730 (10th Cir. 1998) (unpublished table decision); Abernethy v. IRS, 909 F. Supp. 1562, 1570-71 (N.D. Ga. 1995) ("[investigatory] panel's review of Plaintiff's performance appraisals was not a violation of the Privacy Act because the members had a need to know the contents of the appraisals"; member of the panel that recommended that plaintiff be removed from management in response to an EEO informal class complaint "had a need to know the contents of the [EEO] complaint file"), aff'd per curiam, No. 95-9489 (11th Cir. Feb. 13, 1997); Magee v. USPS, 903 F. Supp. 1022, 1029 (W.D. La. 1995) (disclosure of employee's medical report following fitness-for-duty examination to Postmaster of Post Office where employee worked to determine whether employee could perform essential functions of job and to Postmaster's supervisor who was to review Postmaster's decision), aff'd, 79 F.3d 1145 (5th Cir. 1996) (unpublished table decision); McNeill v. IRS, No. 93-2204, 1995 U.S. Dist. LEXIS 2372, at *8 (D.D.C. Feb. 7, 1995) (disclosures made to Treasury Department's Equal Employment Opportunity (EEO) personnel in course of their investigation of EEO allegations initiated by plaintiff); Harry v. USPS, 867 F. Supp. 1199, 1206 (M.D. Pa. 1994) (disclosure from one internal subdivision of Postal Service to another -- the Inspection Service (Inspector General) -- which was conducting an investigation), aff'd sub nom. Harry v. USPS, Marvin T. Runyon, 60 F.3d 815 (3d Cir. 1995) (unpublished table decision); Hass v. United States Air Force, 848 F. Supp. 926, 932 (D. Kan. 1994) (disclosure of mental health evaluation to officers who ultimately made decision to revoke plaintiff's security clearance and discharge her); Lachenmyer v. Frank, No. 88-2414, slip op. at 3-4 (C.D. Ill. July 16, 1990) (disclosure of investigative report, referencing employee's admission that he had been treated for alcohol abuse, to supervisor); Williams v. Reilly, 743 F. Supp. 168, 175 (S.D.N.Y. 1990) (admission of drug use disclosed by the Naval Investigative Service to plaintiff's employer, the Defense Logistics Agency); Bengle v. Reilly, No. 88-587, 1990 U.S. Dist. LEXIS 2006, at *21 (D.D.C. Feb. 28, 1990) (disclosure to personnel consulted by employee's supervisors in order to address employee's complaints); Glass v. United States Dep't of Energy, No. 87-2205, 1988 WL 118408, at *1 (D.D.C. Oct. 29, 1988) (disclosure to "officials or counsel for the agency for use in the exercise of their responsibility for management of the agency or for defense of litigation initiated by plaintiff"); Krowitz v. USDA, 641 F. Supp. 1536, 1545-46 (W.D. Mich. 1986) (details of employee's performance status disclosed to other personnel who were assigned to assist plaintiff), aff'd, 826 F.2d 1063 (6th Cir. 1987) (unpublished table decision); Marcotte v. Sec'y of Def., 618 F. Supp. 756, 763 (D. Kan. 1985) (disclosure of "talking paper" chronicling officer's attempts to correct effectiveness ratings to Inspector General for purpose of responding to officer's challenge to "staff advisories"); Nutter v. VA, No. 84-2392, slip op. at 8-9 (D.D.C. July 9, 1985) (disclosure of record reflecting employee's impending indictment to personnel responsible for responding to public and press inquiries); Brooks v. Grinstead, 3 Gov't Disclosure Serv. (P-H) ¶ 83,054, at 83,551-53 (E.D. Pa. Dec. 12, 1982) (disclosure of employee's security file to supervisor for purpose of ascertaining employee's trustworthiness); Carin v. United States, 1 Gov't Disclosure Serv. (P-H) ¶ 80,193, at 80,492 & n.1 (D.D.C. Aug. 5, 1980) (disclosure of employee's EEO complaint to other employees during grievance process); Lydia R. v. United States Army, No. 78-069, slip op. at 3-6 (D.S.C. Feb. 28, 1979) (disclosure of derogatory information from employee's file to officer for purpose of determining appropriateness of assigning employee to particular position); Gill v. DOD, 92 M.S.P.R. 23, 31-32 (2002) (finding that agency failed to establish that appellant's disclosure to EEO counselor was unauthorized, as disclosure appeared to fall within (b)(1) exception, where appellant provided records at request of EEO counselor in support of appellant's claim that she was disparately treated).

Although subsection (b)(1) permits disclosure only to "those officers and employees of the agency which maintains the record," two courts have upheld a disclosure to a contractor who serves the function of an agency employee. See Coakley v. United States Dep't of Transp., No. 93-1420, 1994 U.S. Dist. LEXIS 21402, at **3-4 (D.D.C. Apr. 7, 1994) (holding that an EEO investigator who was an independent contractor "must be considered an employee of DOT for Privacy Act purposes" and that the disclosure of information by a former DOT employee to that contractor, "[g]iven that the disclosure in question occurred in connection with an official agency investigation . . . must be considered an intra-agency communication under the Act"); Hulett v. Dep't of the Navy, No. TH 85-310-C, slip op. at 3-4 (S.D. Ind. Oct. 26, 1987) (disclosure of medical and personnel records to contractor/psychiatrist for purpose of assisting him in performing "fitness for duty" examination), aff'd, 866 F.2d 432 (7th Cir. 1988) (unpublished table decision); cf. Gill v. DOD, 92 M.S.P.R. at 32 n.7 (in case before the MSPB where the agency was in the unusual position of having to establish a violation of the Privacy Act in order to defend its disciplinary action against plaintiff for wrongful disclosure, finding that although the record indicated that the EEO counselor to whom the disclosure was made "was employed by a contractor, rather than directly by the agency . . . the EEO counselor was performing an administrative function for which the agency was responsible, and the agency ha[d] not argued nor established that the EEO counselor was not an officer or employee of the agency for the purposes of 5 U.S.C. § 552a(b)(1)," and stating further that "[i]t is clear that, for particular purposes, the Privacy Act provides that any government contractor and any employee of such contractor shall be considered an employee of an agency" (citing 5 U.S.C. § 552a(m))). Another court, however, has held to the contrary on facts nearly identical to those in Hulett. Taylor v. Orr, No. 83-0389, 1983 U.S. Dist. LEXIS 20334, at **7-10 (D.D.C. Dec. 5, 1983); cf. Appendix I to OMB Circular No. A-130 -- Federal Agency Responsibilities for Maintaining Records About Individuals, 61 Fed. Reg. 6428, 6439 (Feb. 20, 1996) (directing agencies that provide by contract for the operation of a system of records to "review the [system] notice to ensure that it contains a routine use . . . permitting disclosure to the contractor and his or her personnel"). See generally OMB Guidelines, 40 Fed. Reg. at 28,954 (noting that "movement of records between personnel of different agencies may in some instances be viewed as intra-agency disclosures if that movement is in connection with an inter-agency support agreement").

2. 5 U.S.C. § 552a(b)(2) (required FOIA disclosure)

"required under section 552 of this title."

Comment:

The point of this exception is that the Privacy Act never prohibits a disclosure that the Freedom of Information Act actually requires. See Greentree v. United States Customs Serv., 674 F.2d 74, 79 (D.C. Cir. 1982) (subsection (b)(2) "represents a Congressional mandate that the Privacy Act not be used as a barrier to FOIA access").

Thus, if an agency is in receipt of a FOIA request for information about an individual that is contained in a system of records and that is not properly withholdable under any FOIA exemption, then it follows that the agency is "required under Section 552 of this title" to disclose the information to the FOIA requester. This would be a permissible subsection (b)(2) disclosure. However, if a FOIA exemption -- typically, Exemption 6 or Exemption 7(C) -- applies to a Privacy Act-protected record, the Privacy Act prohibits an agency from making a "discretionary" FOIA release because that disclosure would not be "required" by the FOIA within the meaning of subsection (b)(2). See, e.g., DOD v. FLRA, 510 U.S. 487, 502 (1994); United States Dep't of the Navy v. FLRA, 975 F.2d 348, 354-56 (7th Cir. 1992); DOD v. FLRA, 964 F.2d 26, 30 n.6 (D.C. Cir. 1992); Andrews v. VA, 838 F.2d 418, 422-24 & n.8 (10th Cir. 1988); Robbins v. HHS, No. 1:95-cv-3258, slip op. at 2-9 (N.D. Ga. Aug. 13, 1996), aff'd, No. 96-9000 (11th Cir. July 8, 1997); Kassel v. VA, 709 F. Supp. 1194, 1199-1200 (D.N.H. 1989); Howard v. Marsh, 654 F. Supp. 853, 855-56 (E.D. Mo. 1986); Fla. Med. Ass'n v. HEW, 479 F. Supp. 1291, 1305-07 (M.D. Fla. 1979); Providence Journal Co. v. FBI, 460 F. Supp. 762, 767 (D.R.I. 1978), rev'd on other grounds, 602 F.2d 1010 (1st Cir. 1979); Phila. Newspapers, Inc. v. United States Dep't of Justice, 405 F. Supp. 8, 10 (E.D. Pa. 1975); see also OMB Guidelines, 40 Fed. Reg. 28,948, 28,954 (July 9, 1975).

In United States Department of Justice v. Reporters Committee for Freedom of the Press, 489 U.S. 749, 762-75 (1989), the Supreme Court significantly expanded the breadths of FOIA Exemptions 6 and 7(C). The Court ruled that a privacy interest may exist in publicly available information -- such as the criminal history records (rap sheets) there at issue -- where the information is "practically obscure." Id. at 764-71. Even more significantly, the Court held that the identity of the FOIA requester, and any socially useful purpose for which the request was made, are not to be considered in evaluating whether the "public interest" would be served by disclosure. Id. at 771-75. The Court determined that the magnitude of the public interest side of the balancing process can be assessed only by reference to whether disclosure of the requested records directly advances the "core purpose" of the FOIA -- to shed light on the operations and activities of the government. Id. at 774-75.

In light of Reporters Committee, personal information of the sort protected by the Privacy Act is less likely to be "required" to be disclosed under the FOIA, within the meaning of subsection (b)(2). Specifically, where an agency determines that the only "public interest" that would be furthered by a disclosure is a nonqualifying one under Reporters Committee (even where it believes that disclosure would be in furtherance of good public policy generally), it no longer may balance in favor of disclosure under the FOIA and therefore disclosure will be prohibited under the Privacy Act -- unless authorized by another Privacy Act exception or by written consent. See, e.g., DOD v. FLRA, 510 U.S. at 497-502 (declining to "import the policy considerations that are made explicit in the Labor Statute into the FOIA Exemption 6 balancing analysis" and, following the principles of Reporters Committee, holding that home addresses of bargaining unit employees are covered by FOIA Exemption 6 and thus that Privacy Act "prohibits their release to the unions"); Schwarz v. INTERPOL, No. 94-4111, 1995 U.S. App. LEXIS 3987, at **4-7 & n.2 (10th Cir. Feb. 28, 1995) (balancing under Reporters Committee and holding that individual clearly has protected privacy interest in avoiding disclosure of his whereabouts to third parties; disclosure of this information would not "contribute anything to the public's understanding of the operations or activities of the government"; and thus any information was exempt from disclosure under FOIA Exemption 7(C) and does not fall within Privacy Act exception (b)(2)); FLRA v. United States Dep't of Commerce, 962 F.2d 1055, 1059 (D.C. Cir. 1992) (Privacy Act prohibits disclosure of identities of individuals who received outstanding or commendable personnel evaluations, as such information falls within FOIA Exemption 6); Doe v. Veneman, 230 F. Supp. 2d 739, 748-52 (W.D. Tex. 2002) (in reverse FOIA lawsuit where information regarding government program for protection of livestock using livestock-protection collars already had been released, finding that no personally identifying information about particular ranchers and farmers participating in program "could shed any further light on workings of the [program]," that information thus was protected by FOIA Exemption 6, and that its disclosure therefore was prohibited by the Privacy Act) (appeal pending); Fort Hall Landowners Alliance, Inc. v. Bureau of Indian Affairs, No. CV-99-00052-E-BLW, slip op. at 7-14 (D. Idaho Mar. 17, 2000) (finding that document that "contains only names and addresses . . . does not provide information shedding light on how the BIA is performing its duties," and that "[h]aving determined that disclosure of the information is not required by FOIA . . . the Privacy Act prohibits disclosure of the information"); Burke v. United States Dep't of Justice, No. 96-1739, 1999 WL 1032814, at **3-5 (D.D.C. Sept. 30, 1999) (stating that the "Privacy Act prohibits the FBI from disclosing information about a living third party without a written privacy waiver, unless FOIA requires disclosure," and upholding the FBI's refusal to confirm or deny the existence of investigative records related to third parties in response to a FOIA request); see also FOIA Update, Vol. X, No. 2, at 6 ("Privacy Protection Under the Supreme Court's Reporters Committee Decision"). As a result of Reporters Committee, agencies depend more on the subsection (b)(3) routine use exception to make compatible disclosures of records that are no longer required by the FOIA to be disclosed. See, e.g., USDA v. FLRA, 876 F.2d 50, 51 (8th Cir. 1989); see also FLRA v. United States Dep't of the Treasury, 884 F.2d 1446, 1450 & n.2 (D.C. Cir. 1989).

The Court of Appeals for the District of Columbia Circuit significantly limited the utility of subsection (b)(2) in Bartel v. FAA, 725 F.2d 1403 (D.C. Cir. 1984). In Bartel, the D.C. Circuit held that subsection (b)(2) cannot be invoked unless an agency actually has a FOIA request in hand. 725 F.2d at 1411-13; see also Chang v. Dep't of the Navy, No. 00-0783, 2004 WL 882030, at *5 (D.D.C. Apr. 22, 2004) (citing Bartel, and noting that defendant agency conceded that it "had no FOIA request in hand"). In one case prior to Bartel, it similarly had been held that subsection (b)(2) was not available as a defense for the disclosure of information in the absence of a FOIA request. Zeller v. United States, 467 F. Supp. 487, 503 (E.D.N.Y. 1979) (finding subsection (b)(2) inapplicable to the "voluntary re-release" of a prior press release (that had been made prior to the effective date of the Privacy Act) as "nothing in the FOIA appears to require such information to be released in the absence of a request therefor").

The D.C. Circuit's approach in Bartel has not been taken by some other courts. See Cochran v. United States, 770 F.2d 949, 957-58 & n.14 (11th Cir. 1985) (applying subsection (b)(2) -- in absence of written FOIA request -- because requested records would not be withholdable under any FOIA exemption); Jafari v. Dep't of the Navy, 728 F.2d 247, 249-50 (4th Cir. 1984) (same); see also Fla. Med. Ass'n, 479 F. Supp. at 1301, 1305-07. However, because the D.C. Circuit is the jurisdiction of "universal venue" under the Privacy Act (which means that any Privacy Act lawsuit for wrongful disclosure could be filed within that judicial circuit), see 5 U.S.C. § 552a(g)(5), its holding in Bartel is of paramount importance. See FOIA Update, Vol. V, No. 3, at 2 ("FOIA Counselor Q & A") (discussing Bartel).

Note, though, that the Bartel decision left open the possibility that certain types of information "traditionally released by an agency to the public" might properly be disclosed even in the absence of an actual FOIA request. 725 F.2d at 1413 (dictum). Reacting to Bartel, OMB issued guidance indicating that records that have "traditionally" been considered to be in the public domain, and those that are required to be disclosed to the public -- such as final opinions of agencies and press releases -- can be released without waiting for an actual FOIA request. OMB Guidelines, 52 Fed. Reg. 12,990, 12,992-93 (Apr. 20, 1987) (discussing Bartel, in context of guidance on "call detail" programs, and referring to OMB Memorandum For The Senior Agency Officials For Information Resources Management (May 24, 1985) at 4-6 (unpublished)). The District Court for the District of Columbia twice has applied this aspect of Bartel. In Tripp v. DOD, 193 F. Supp. 2d 229, 236 (D.D.C. 2002), the D.C. District Court held that "the names, titles, salaries, and salary-levels of public employees are information generally in the public domain" and thus that they are not prohibited from disclosure under subsection (b)(2). In Chang v. Dep't of the Navy, No. 00-0783, 2004 WL 882030, at **6-8, the District Court found that the Privacy Act was not violated where the Navy disclosed information to the media about plaintiff's nonjudicial punishment, because the information was "releasable" under the FOIA, and the Navy had asserted that it "traditionally releases information that would be releasable under the FOIA to the press without a formal FOIA request," and was able to point to a Navy regulation to that effect. Id. At least one pre-Bartel case also appears to support this idea. Owens v. MSPB, No. 3-83-0449-R, slip op. at 3 (N.D. Tex. Sept. 14, 1983) (finding that inadvertent disclosure to plaintiff's former attorney of initial decision rendered by MSPB did not violate Privacy Act, because "the Board's proper treatment of its initial decisions as final decisions for purposes of FOIA makes these decisions part of the public domain -- and the release of public information simply cannot be an unlawful disclosure under the Privacy Act"). But see Zeller v. United States, 467 F. Supp. 487, 503 (E.D.N.Y. 1979) (finding subsection (b)(2) inapplicable to the "voluntary re-release" of a press release that had been made four years earlier, as "nothing in the FOIA appears to require such information to be released in the absence of a request therefor").

3. 5 U.S.C. § 552a(b)(3) (routine uses)

"for a routine use as defined in subsection (a)(7) of this section and described under subsection (e)(4)(D)."

Cross-references:

Subsection (e)(4)(D) requires Federal Register publication of "each routine use of the records contained in the system, including the categories of users and the purpose of such use."

Subsection (a)(7) defines the term "routine use" to mean "with respect to the disclosure of a record, the use of such record for a purpose which is compatible with the purpose for which it was collected."

Comment:

The routine use exception, because of its potential breadth, is one of the most controversial provisions in the Act. See Privacy Commission Report at 517-18. The trend in recent cases is toward a narrower construction of the exception. The White House directed the Office of Management and Budget to issue additional guidance regarding the routine use exception in an executive memorandum on privacy sent to the heads of executive departments and agencies six years ago. Memorandum on Privacy and Personal Information in Federal Records, 34 Weekly Comp. Pres. Doc. 870 (May 14, 1998), which can be accessed at: http://www.whitehouse.gov/omb/memoranda/m99-05-a.html. See also FOIA Update, Vol. XIX, No. 2, at 1 ("President Issues Privacy Act-Related Memorandum to All Federal Agencies") (providing summary of executive memorandum).

It should be noted that the routine use exception "was developed to permit other than intra-agency disclosures" and that therefore "[i]t is not necessary . . . to include intra-agency transfers in the portion of the system notice covering routine uses." OMB Guidelines, 40 Fed. Reg. 56,741, 56,742 (Dec. 4, 1975).

By its terms, this exception sets forth two requirements for a proper routine use disclosure: (1) Federal Register publication, thereby providing constructive notice; and (2) compatibility. See, e.g., Britt v. Naval Investigative Serv., 886 F.2d 544, 547-50 (3d Cir. 1989); Shannon v. Gen. Elec. Co., 812 F. Supp. 308, 316 (N.D.N.Y. 1993).

However, the Court of Appeals for the Ninth Circuit has engrafted a third requirement onto this exception: Actual notice of the routine use under subsection (e)(3)(C) (i.e., at the time of information collection from the individual). Covert v. Harrington, 876 F.2d 751, 754-56 (9th Cir. 1989) (discussed below); accord Puerta v. HHS, No. 99-55497, 2000 WL 863974, at **1-2 (9th Cir. June 28, 2000), aff'g No. EDCV 94-0148, slip op. at 7 (C.D. Cal. Jan. 5, 1999). Subsequently, the Court of Appeals for the District of Columbia Circuit cited this aspect of Covert with approval and remanded a case for determination as to whether (e)(3)(C) notice was provided, stating that "[a]lthough the statute itself does not provide, in so many terms, that an agency's failure to provide employees with actual notice of its routine uses would prevent a disclosure from qualifying as a 'routine use,' that conclusion seems implicit in the structure and purpose of the Act." USPS v. Nat'l Ass'n of Letter Carriers, 9 F.3d 138, 146 (D.C. Cir. 1993).

Federal Register Constructive Notice

The routine use exception's notice requirement "is intended to serve as a caution to agencies to think out in advance what uses [they] will make of information." 120 Cong. Rec. 40,881 (1974), reprinted in Source Book at 987. Indeed, it is possible for a routine use to be deemed facially invalid if it fails to satisfy subsection (e)(4)(D) -- i.e., if it does not specify "the categories of users and the purpose of such use." See Britt, 886 F.2d at 547-48 (dictum) (suggesting that routine use (50 Fed. Reg. 22,802-03 (May 29, 1985)) permitting disclosure to "federal regulatory agencies with investigative units" is overbroad as it "does not provide adequate notice to individuals as to what information concerning them will be released and the purposes of such release"); cf. Krohn v. United States Dep't of Justice, No. 78-1536, slip op. at 4-7 (D.D.C. Mar. 19, 1984) ("to qualify as a 'routine use,' the agency must . . . publish in the Federal Register . . . 'each routine use of the records contained in the system, including the categories of users and the purpose of such use'"), reconsideration granted & vacated in nonpertinent part (D.D.C. Nov. 29, 1984) (discussed below).

It is well settled that the "scope of [a] routine use is confined to the published definition." Doe v. Naval Air Station, Pensacola, Fla., 768 F.2d 1229, 1231 (11th Cir. 1985); see also Parks v. IRS, 618 F.2d 677, 681-82 (10th Cir. 1980); Quilico v. United States Navy, No. 80-C-3568, 1983 U.S. Dist. LEXIS 14090, at **9-12 (N.D. Ill. Sept. 2, 1983); Local 2047, AFGE v. Def. Gen. Supply Ctr., 423 F. Supp. 481, 484-86 (E.D. Va. 1976), aff'd, 573 F.2d 184 (4th Cir. 1978). In other words, a particular disclosure is unauthorized if it does not fall within the clear terms of the routine use. See, e.g., Swenson v. USPS, 890 F.2d 1075, 1078 (9th Cir. 1989) (47 Fed. Reg. 1203 (Jan. 11, 1982) held inapplicable to agency's disclosure of record referencing employee's EEO complaints to her congressmen as their inquiries were not "made at the request of" employee); Tijerina v. Walters, 821 F.2d 789, 798 (D.C. Cir. 1987) (47 Fed. Reg. 24,012 (June 2, 1982) held inapplicable to VA's unsolicited letter notifying state board of bar examiners of possible fraud committed by bar applicant because no violation of state law was "reasonably imminent," and letter was not in response to "official request"); Doe v. DiGenova, 779 F.2d 74, 86 (D.C. Cir. 1985) (43 Fed. Reg. 44,743 (1978) held inapplicable to VA psychiatric report because disclosed record itself did not "indicate a potential violation of law"); Bechhoefer v. United States Dep't of Justice, 179 F. Supp. 2d 93, 101-02 (W.D.N.Y. 2001) (although granting agency summary judgment on other grounds, finding that where a letter was collected by the agency due to its initial interest in investigating plaintiff's allegations of illegal drug activity by a local law enforcement agency, and was disclosed to that agency's investigator whose interest was in investigating possible unlawful, non-drug-related activity by plaintiff himself, such disclosure was not proper pursuant to a routine use providing for the disclosure to state and local law enforcement and regulatory agencies for law enforcement and regulatory purposes and stating that "it is difficult to see how [the] disclosure could be said to have been compatible with the purpose for which the letter was collected"), aff'd on other grounds, 312 F.3d 563 (2002), cert. denied sub nom. Bechhoefer v. DEA, 539 U.S. 514 (2003); Pontecorvo v. FBI, No. 00-1511, slip op. at 13-15 (D.D.C. Sept. 30, 2001) (denying agency summary judgment and ordering discovery to determine whether the agency "overstepped [the] explicit restrictions" contained in its routine use); Vargas v. Reno, No. 99-2725, slip op. at 3, 12-13 (W.D. Tenn. Mar. 31, 2000) (routine uses permitting disclosure to appropriate agency when record indicates potential violation of law and to investigating agency in response to its request when information is relevant and necessary to investigation did not apply to disclosure of plaintiff's record, which was "'owned' by the Office of Personnel Management," to Department of Justice Inspector General agent conducting investigation of another employee; "The mere existence of an investigation at a facility is not sufficient to allow an investigating agent access to the records of every employee who is employed at that facility."); Greene v. VA, No. C-76-461-S, slip op. at 3-6 (M.D.N.C. July 3, 1978) (40 Fed. Reg. 38,105 (1975) held inapplicable to VA's disclosure of medical evaluation to state licensing bureau because routine use permitted disclosure only to facilitate VA decision); see also Covert, 667 F. Supp. at 736-39 (discussed below).

Note that an agency's construction of its routine use should be entitled to deference. See Dep't of the Air Force, Scott Air Force Base, Ill. v. FLRA, 104 F.3d 1396, 1402 (D.C. Cir. 1997); FLRA v. United States Dep't of the Treasury, 884 F.2d 1446, 1455-56 (D.C. Cir. 1989). But see NLRB v. USPS, 790 F. Supp. 31, 33 (D.D.C. 1992) (rejecting Postal Service's interpretation of its own routine use).

Compatibility

The precise meaning of the term "compatible" is quite uncertain and must be assessed on a case-by-case basis. According to OMB, the "compatibility" concept encompasses (1) functionally equivalent uses, and (2) other uses that are necessary and proper. OMB Guidelines, 52 Fed. Reg. 12,990, 12,993 (Apr. 20, 1987).

The leading case on "compatibility" is Britt v. Naval Investigative Service, 886 F.2d at 547-50, in which the Court of Appeals for the Third Circuit in 1989 ruled that the Naval Investigative Service's gratuitous disclosure of records, describing a then-pending criminal investigation of a Marine Corps reservist, to that individual's civilian employer (the Immigration and Naturalization Service), was not "compatible" with the "case-specific purpose for collecting" such records. Id. In holding that the employment/suitability purpose for disclosure was incompatible with the criminal law enforcement purpose for collection, the Third Circuit deemed it significant that "the [Immigration and Naturalization Service] was not conducting its own criminal investigation of the same activity or any other activity" by the subject, and that the records at issue concerned "merely a preliminary investigation with no inculpatory findings." Id. at 549-50. Employing especially broad language, the Third Circuit pointedly condemned the agency's equating of "compatibility" with mere "relevance" to the recipient entity, observing that "[t]here must be a more concrete relationship or similarity, some meaningful degree of convergence, between the disclosing agency's purpose in gathering the information and in its disclosure." Id. (citing Covert, 876 F.2d at 755 (dictum); Mazaleski v. Truesdale, 562 F.2d 701, 713 n.31 (D.C. Cir. 1977) (dictum)); accord Swenson, 890 F.2d at 1078; cf. Quinn v. Stone, 978 F.2d 126, 139 (3d Cir. 1992) (Nygaard, J., dissenting) (concluding that disclosure was authorized by routine use because disclosure was compatible with one of the purposes for collection, even if not with main purpose for collection).

More recently, the D.C. Circuit interpreted the term "compatibility" in considering a routine use providing for disclosure to labor organizations as part of the collective bargaining process. The court stated that application of the "common usage" of the word would require simply that "a proposed disclosure would not actually frustrate the purposes for which the information was gathered." USPS v. Nat'l Ass'n of Letter Carriers, 9 F.3d 138, 144 (D.C. Cir. 1993). The D.C. Circuit recognized the "far tighter nexus" that was required by the Third and Ninth Circuits in Britt and Swenson, and that is consistent with the legislative history, but stated:

Whatever the merit of the decisions of prior courts that have held . . . that a finding of a substantial similarity of purpose might be appropriate in the non-labor law context in order to effectuate congressional intent, the compatibility requirement imposed by section 552a(a)(7) cannot be understood to prevent an agency from disclosing to a union information as part of the collective bargaining process.

Id. at 145. In a concurring opinion, Judge Williams agreed with the disposition of the case, but noted that he did not share the "belief that the meaning of 'compatible' . . . may depend on the identity of the entity to which the information is being disclosed." Id. at 147 n.1 (Williams, J., concurring). Rather, seeing "no conflict between the purposes for which the information was collected and those for which it will be disclosed," he found the disclosure to be compatible without further inquiry. Id. at 146-47. But cf. Pontecorvo v. FBI, No. 00-1511, slip op. at 10-11 (D.D.C. Sept. 30, 2001) (recognizing the D.C. Circuit's holding in USPS case, but finding "the test articulated by the Third and Ninth circuits to be controlling" in the non-labor law context).

There are two examples of "compatible" routine uses that frequently occur in the law enforcement context. First, in the context of investigations/prosecutions, law enforcement agencies may routinely share law enforcement records with one another. See OMB Guidelines, 40 Fed. Reg. at 28,955 (proper routine use is "transfer by a law enforcement agency of protective intelligence information to the Secret Service"); see also, e.g., 28 U.S.C. § 534 (2000) (authorizing Attorney General to exchange criminal records with "authorized officials of the Federal Government, the States, cities, and penal and other institutions"). Second, agencies may routinely disclose any records indicating a possible violation of law (regardless of the purpose for collection) to law enforcement agencies for purposes of investigation/prosecution. See OMB Guidelines, 40 Fed. Reg. at 28,953, 28,955; 120 Cong. Rec. 36,967, 40,884 (1974), reprinted in Source Book at 957-58, 995 (remarks of Congressman Moorhead); see also, e.g., 28U.S.C. § 535(b) (2000) (requiring agencies of the executive branch to expeditiously report "[a]ny information, allegation, or complaint" relating to crimes involving government officers and employees to United States Attorney General). These kinds of routine uses have been criticized on the ground that they circumvent the more restrictive requirements of subsection (b)(7). See Privacy Commission Report at 517-18; see also Britt, 886 F.2d at 548 n.1 (dictum); Covert, 667 F. Supp. at 739, 742 (dictum). Yet they have never been successfully challenged on that basis. Cf. Nwangoro v. Dep't of the Army, 952 F. Supp. 394, 398 (N.D. Tex. 1996) (disclosure by Military Police of financial records obtained in an ongoing criminal investigation to foreign customs officials likewise involved in an investigation of possible infractions of foreign tax and customs laws was "permitted by the 'routine use' exception and d[id] not constitute a violation of the Privacy Act"); Little v. FBI, 793 F. Supp. 652, 655 (D. Md. 1992) (disclosure did not violate Privacy Act prohibition because it was made pursuant to routine use that allows disclosure of personnel matters to other government agencies when directly related to enforcement function of recipient agency), aff'd on other grounds, 1 F.3d 255 (4th Cir. 1993).

In Covert v. Harrington, 667 F. Supp. at 736-39, however, the district court held that a routine use permitting the Department of Energy's Inspector General to disclose to the Justice Department relevant records when "a record" indicates a potential violation of law, 47 Fed. Reg. 14,333 (Apr. 2, 1982), did not permit the disclosure of personnel security questionnaires submitted by the plaintiffs because such questionnaires did not on their face reveal potential violations of law. The court rejected the agency's argument that disclosure was proper because each questionnaire was disclosed as part of a prosecutive report that (when viewed as a whole) did reveal a potential violation of law. Id. at 736-37. Further, the court found that the Inspector General's disclosure of the questionnaires to the Justice Department (for a criminal fraud prosecution) was not compatible with the purpose for which they were originally collected by the Department of Energy (for a security-clearance eligibility determination), notwithstanding the fact that the questionnaires were subsequently acquired by the Inspector General -- on an intra-agency "need to know" basis pursuant to 5 U.S.C. § 552a(b)(1) -- for the purpose of a fraud investigation. Id. at 737-39.

On cross-appeals, a divided panel of the Court of Appeals for the Ninth Circuit affirmed the district court's judgment on other grounds. Covert, 876 F.2d at 754-56. The panel majority held that the Department of Energy's failure to provide actual notice of the routine use on the questionnaires at the time of original collection, under subsection (e)(3)(C), precluded the Department of Energy from later invoking that routine use under subsection (b)(3). Id. at 755-56; see also Puerta v. HHS, No. 99-55497, 2000 WL 863974, at **1-2 (9th Cir. June 28, 2000) (following Covert, but finding that agency had provided notice of routine use on form used to collect information), aff'g No. EDCV 94-0148, slip op. at 7 (C.D. Cal. Jan. 5, 1999); USPS v. Nat'l Ass'n of Letter Carriers, 9 F.3d at 146 (citing Covert with approval and remanding case for factual determination as to whether subsection (e)(3)(C) notice was given); Pontecorvo, No. 00-1511, slip op. at 12 (D.D.C. Sept. 30, 2001) (stating that agency must comply with subsection (e)(3)(C) "in order to substantiate an exception for 'routine use'"). No other court had ever so held. See the additional discussion under subsection (e)(3), below.

In Doe v. Stephens, 851 F.2d 1457, 1465-67 (D.C. Cir. 1988), the Court of Appeals for the District of Columbia Circuit held that a VA routine use -- permitting disclosure of records "in order for the VA to respond to and comply with the issuance of a federal subpoena [47 Fed. Reg. 51,841 (Nov. 17, 1982)]" -- was invalid under the Administrative Procedure Act because it was inconsistent with the Privacy Act as interpreted in Doe v. DiGenova, 779 F.2d at 78-84 -- where the court had found that disclosures pursuant to subpoenas were not permitted by the subsection (b)(11) court order exception. In light of Doe v. Stephens, the decision in Fields v. Leuver, No. 83-0967, slip op. at 5-7 (D.D.C. Sept. 22, 1983) (upholding routine use permitting disclosure of payroll records "in response to a court subpoena"), is unreliable. But cf. Osborne v. USPS, No. 94-30353, slip op. at 6-9 (N.D. Fla. May 18, 1995) (holding on alternative ground that disclosure of plaintiff's injury-compensation file to retired employee who had prepared file and who had been subpoenaed by plaintiff and was expecting to be deposed on matters documented in file was proper pursuant to routine use that "'specifically contemplates that information may be released in response to relevant discovery and that any manner of response allowed by the rules of the forum may be employed'").

A particular area of controversy concerns whether the routine use exception can be invoked to publicly file records in court. The Act's legislative history recognizes the "compatibility" of this type of disclosure. See 120 Cong. Rec. 40,405, 40,884 (1974), reprinted in Source Book at 858, 995 (routine use appropriate where Justice Department "presents evidence [tax information from IRS] against the individual" in court); see also Schuenemeyer v. United States, No. SA-85-773, slip op. at 1-2, 4 (W.D. Tex. Mar. 31, 1988) (finding no violation of Privacy Act for disclosure of litigant's medical records to Justice Department and U.S. Claims Court, as the information was used "in preparing the position of the USAF before the [court]," and was authorized under agency routine use).

In Krohn v. United States Department of Justice, No. 78-1536, slip op. at 4-7 (D.D.C. Mar. 19, 1984), however, the court invalidated an FBI routine use allowing for "dissemination [of records] during appropriate legal proceedings," finding that such a routine use was impermissibly "vague" and was "capable of being construed so broadly as to encompass all legal proceedings." In response to Krohn, OMB issued guidance to agencies in which it suggested a model routine use -- employing a "relevant and necessary to the litigation" standard -- to permit the public filing of protected records with a court. OMB Memorandum for the Senior Agency Officials for Information Resources Management 2-4 (May 24, 1985) (unpublished). Many agencies, including the Justice Department, have adopted "post-Krohn" routine uses designed to authorize the public filing of relevant records in court. See, e.g., 66 Fed. Reg. 36,593, 36,594 (July 12, 2001) (routine use [number 7] applicable to records in Justice Department's "Civil Division Case File System"); 63 Fed. Reg. 8666, 8667-68 (Feb. 20, 1998) (routine uses [letters "o" and "p"] applicable to records in U.S. Attorney's Office's "Civil Case Files").

It should be noted that none of the "post-Krohn" routine uses -- such as the ones cited above which employ an "arguably relevant to the litigation" standard -- have been successfully challenged in the courts. Cf. Russell v. GSA, 935 F. Supp. 1142, 1145-46 (D. Colo. 1996) (without analyzing propriety of routine use, finding disclosure in public pleadings of information regarding investigation of plaintiff was permissible under routine use providing for disclosure in proceeding before court where agency is party and records are determined "to be arguably relevant to the litigation"); Osborne, No. 94-30353, slip op. at 6-9 (N.D. Fla. May 18, 1995) (holding on alternative ground that disclosure of plaintiff's injury-compensation file to retired employee who had prepared file and who had been subpoenaed by plaintiff and was expecting to be deposed on matters documented in file was proper pursuant to routine use providing for disclosures "incident to litigation" and "in a proceeding before a court" because "deposition was a proceeding before [the] Court"); Sheptin v. United States Dep't of Justice, No. 91-2806, 1992 U.S. Dist. LEXIS 6221, at **6-7 (D.D.C. Apr. 30, 1992) (no wrongful disclosure where agency routine uses permit use of presentence report during course of habeas proceeding). Such challenges could arise, either based upon an argument that the routine use does not satisfy the "compatibility" requirement of subsection (a)(7) of the Act, cf. Britt, 886 F.2d at 547-50 (mere "relevance" to recipient entity held to be improper standard for a "compatible" routine use disclosure), or based upon an argument that the routine use effectively circumvents the more restrictive, privacy-protective requirements of subsection (b)(11), cf. Doe v. Stephens, 851 F.2d at 1465-67 (agency cannot use routine use exception to disclose records in response to subpoena where court had earlier ruled that such disclosure was improper under subsection (b)(11)).

Numerous types of information sharing between agencies and with organizations or individuals have been upheld as valid routine uses. See, e.g., Puerta v. HHS, No. 99-55497, 2000 WL 863974, at **1-2 (9th Cir. June 28, 2000) (disclosure of grant proposal to qualified expert who was member of peer review group for evaluation of proposal), aff'g No. EDCV 94-0148, slip op. at 7 (C.D. Cal. Jan. 5, 1999); Pippinger v. Rubin, 129 F.3d 519, 531-32 (10th Cir. 1997) (disclosure of plaintiff's personnel information to MSPB in deposition testimony in another individual's related MSPB proceeding, and to the other individual, his attorney, and court reporter in conjunction with MSPB proceeding); Taylor v. United States, 106 F.3d 833, 836-37 (8th Cir. 1997) (disclosure of federal taxpayer information collected for purpose of federal tax administration to state tax officials for purpose of state tax administration), aff'g Taylor v. IRS, 186 B.R. 441, 446-47, 453-54 (N.D. Iowa 1995); Mount v. USPS, 79 F.3d 531, 534 (6th Cir. 1996) (disclosure of plaintiff's medical information to union official representing him in administrative action in which his mental health was central issue); Alphin v. FAA, No. 89-2405, 1990 WL 52830, at *1 (4th Cir. Apr. 13, 1990) (disclosure of enforcement investigation final report to subject's customers); Hastings v. Judicial Conference of the United States, 770 F.2d 1093, 1104 (D.C. Cir. 1985) (disclosure of criminal investigative records to judicial committee investigating judge); United States v. Miller, 643 F.2d 713, 715 (10th Cir. 1981) (records submitted by individual to parole officer became part of Justice Department files and Department's use in criminal investigation constitutes routine use); United States v. Collins, 596 F.2d 166, 168 (6th Cir. 1979) (HEW's disclosure of plaintiff's Medicaid cost reports to Justice Department for use in criminal case against plaintiff); Chang v. Dep't of the Navy, No. 00-0783, 2004 WL 882030, at **9-10 (D.D.C. Apr. 22, 2004) (disclosure to Members of Congress for purposes of responding to constituent inquiries where, if constituent is other than record subject, only information releasable under FOIA could be disclosed); Mandel v. OPM, 244 F. Supp. 2d 146, 152 (E.D.N.Y. 2003) (alternative holding) (disclosure of information about plaintiff -- including summary of charges, supporting information, and copy of OPM's investigation -- to his former supervisors in connection with their testimony at plaintiff's MSPB hearing following determination that plaintiff was unsuitable for federal employment due to prior employment record and failure to disclose history), aff'd on other grounds, 79 Fed. Appx. 479 (2d Cir. 2003); Fattahi v. ATF, 186 F. Supp. 2d 656, 661-64 (E.D. Va. 2002) (disclosure of fact that plaintiff had applied for federal firearms license to condominium association's counsel for purposes of determining whether firearms dealer could operate out of plaintiff's specific residential unit), aff'd, 328 F.3d 176, 181 (4th Cir. 2003) (agreeing with the district court "that ATF's routine use must be given 'a practical reading' such that disclosures are in accordance with the routine use when they are 'reasonably necessary to verify pertinent information, [and] not just [when] verification cannot conceivably be obtained by any other means'"); Mumme v. United States Dep't of Labor, 150 F. Supp. 2d 162, 174 (D. Me. 2001) (alleged disclosure to agency's examining physician from investigation file detailing possible health care fraud by former government worker who was being examined regarding continuing eligibility for disability benefits), aff'd, No. 01-2256 (1st Cir. June 12, 2002); Contursi v. USPS, No. 98CV112, slip op. at 2-3 (S.D. Cal. July 6, 1999) (disclosure to county agency in response to its request in connection with investigation of employee), aff'd, 238 F.3d 428 (9th Cir. 2000) (unpublished table decision); Jones v. Runyon, 32 F. Supp. 2d 873, 876 (N.D. W. Va. 1998) (disclosure to credit reporting service of information about plaintiff when requesting employment reports in course of routine investigation of possible workers' compensation fraud), aff'd, 173 F.3d 850 (4th Cir. 1999) (unpublished table decision); Blazy v. Tenet, 979 F. Supp. 10, 26 (D.D.C. 1997) (CIA's disclosure of information about employee to FBI while FBI was investigating employee's application for FBI employment), summary affirmance granted, No. 97-5330, 1998 WL 315583 (D.C. Cir. May 12, 1998); Magee v. USPS, 903 F. Supp. 1022, 1029 (W.D. La. 1995) (disclosure of employee's medical records to clinical psychologist hired by agency to perform fitness-for-duty examination on employee), aff'd, 79 F.3d 1145 (5th Cir. 1996) (unpublished table decision); McNeill v. IRS, No. 93-2204, 1995 U.S. Dist. LEXIS 2372, at *6 (D.D.C. Feb. 7, 1995) (disclosure of IRS personnel records to prospective federal agency employer); Harry v. USPS, 867 F. Supp. 1199, 1206-07 (M.D. Pa. 1994) (disclosure of documents regarding individual's employment history, including details of settlement agreement, in response to congressional inquiries "made at the prompting of that individual"), aff'd sub nom. Harry v. USPS, Marvin T. Runyon, 60 F.3d 815 (3d Cir. 1995) (unpublished table decision); Lachenmyer v. Frank, No. 88-2414, slip op. at 4 (C.D. Ill. July 16, 1990) (disclosure of investigative report to persons at arbitration hearing held proper under routine use permitting disclosure of "record relating to a case or matter" in a "hearing in accordance with the procedures governing such proceeding or hearing"); Choe v. Smith, No. C-87-1764R, slip op. at 10-11 (W.D. Wash. Apr. 20, 1989) (INS's disclosure to its informant during investigation "to elicit information required by the Service to carry out its functions and statutory mandates"), aff'd, 935 F.2d 274 (9th Cir. 1991) (unpublished table decision); Brown v. FBI, No. 87-C-9982, 1988 WL 79653, at *1 (N.D. Ill. July 25, 1988) (disclosure of rap sheet to local police department); Ely v. Dep't of Justice, 610 F. Supp. 942, 945-46 (N.D. Ill. 1985) (disclosure to plaintiff's lawyer), aff'd, 792 F.2d 142 (7th Cir. 1986) (unpublished table decision); Kimberlin v. United States Dep't of Justice, 605 F. Supp. 79, 82-83 (N.D. Ill. 1985) (Bureau of Prisons' disclosure of prisoner's commissary account record to probation officer), aff'd, 788 F.2d 434 (7th Cir. 1986); Burley v. DEA, 443 F. Supp. 619, 623-24 (M.D. Tenn. 1977) (transmittal of DEA records to state pharmacy board); Harper v. United States, 423 F. Supp. 192, 198-99 (D.S.C. 1976) (IRS's disclosure of plaintiff's identity to other targets of investigation); see also Gowan v. United States Dep't of the Air Force, 148 F.3d 1182, 1187, 1194 (10th Cir. 1998) (disclosure of information regarding individual to Members of Congress in response to inquiries made pursuant to individual's letters requesting assistance; stating that such disclosure is not "incompatible" and thus "would likely be protected under the routine use exception").

Four courts have required an agency to invoke its routine use to permit disclosure to unions of names of employees on the theory that refusal to so disclose was an unfair labor practice under the National Labor Relations Act. See NLRB v. USPS, No. 92-2358, 1994 WL 47743, at **3-4 (4th Cir. Feb. 16, 1994); NLRB v. USPS, 888 F.2d 1568, 1572-73 (11th Cir. 1989); NLRB v. USPS, 841 F.2d 141, 144-45 & n.3 (6th Cir. 1988); NLRB v. USPS, 790 F. Supp. 31, 33 (D.D.C. 1992); see also USPS v. Nat'l Ass'n of Letter Carriers, 9 F.3d at 141-46 (holding that "if Postal Service could disclose the information under [its routine use] then it must disclose that information, because in the absence of a Privacy Act defense the arbitrator's award must be enforced," but remanding case for determination as to whether proper (e)(3)(C) notice was given before requiring invocation of routine use); FLRA v. United States Dep't of the Navy, 966 F.2d 747, 761-65 (3d Cir. 1992) (alternative holding) (en banc) (release to union of home addresses of bargaining unit employees pursuant to routine use was required under Federal Service Labor-Management Relations Act).

In addition, the Court of Appeals for the District of Columbia Circuit, in Department of the Air Force v. FLRA, granted enforcement of a Federal Labor Relations Authority decision requiring the Air Force to disclose to a union a disciplinary letter that was issued to a bargaining unit employee's supervisor. 104 F.3d 1396, 1399, 1401-02 (D.C. Cir. 1997). The court held that the Federal Labor-Management Relations Statute required disclosure of the letter, and that because the "union's request f[ell] within the Act's 'routine use' exception, the Privacy Act d[id] not bar disclosure," and that the union therefore was entitled to disclosure of the letter. Id. at 1401-02.

Apart from the FOIA (see subsection (b)(2)) and the Debt Collection Act (see subsection (b)(12)), the Privacy Act makes no provision for any nonconsensual disclosures that are provided for by other statutes. See, e.g., 42 U.S.C. § 653 (2000) (establishing "Parent Locator Service" and requiring agencies to comply with requests from Secretary of HHS for addresses and places of employment of absent parents "[n]otwithstanding any other provision of law"). Recognizing this difficulty, the OMB Guidelines advise that "[s]uch disclosures, which are in effect congressionally mandated 'routine uses,' should still be established as 'routine uses' pursuant to subsections (e)(11) and (e)(4)(D)." OMB Guidelines, 40 Fed. Reg. at 28,954.

4. 5 U.S.C. § 552a(b)(4) (Bureau of the Census)

"to the Bureau of the Census for purposes of planning or carrying out a census or survey or related activity pursuant to the provisions of Title 13."

Comment:

For a discussion of this provision, see OMB Guidelines, 40 Fed. Reg. 28,948, 28,954 (July 9, 1975).

5. 5 U.S.C. § 552a(b)(5) (statistical research)

"to a recipient who has provided the agency with advance adequate written assurance that the record will be used solely as a statistical research or reporting record, and the record is to be transferred in a form that is not individually identifiable."

Comment:

The term "statistical record" is defined in the Act as a record that is not used in making individual determinations. 5 U.S.C. § 552a(a)(6). One might question whether this exception to subsection (b) is anomalous: The information it permits to be released is arguably not a "record," see 5 U.S.C. § 552a(a)(4), or a "disclosure," see 5 U.S.C. § 552a(b), in the first place as it is not identifiable to any individual. However, the OMB Guidelines provide a plausible explanation for this unique provision: "One may infer from the legislative history and other portions of the Act that an objective of this provision is to reduce the possibility of matching and analysis of statistical records with other records to reconstruct individually identifiable records." OMB Guidelines, 40 Fed. Reg. 28,948, 28,954 (July 9, 1975).

6. 5  U.S.C. § 552a(b)(6) (National Archives)

"to the National Archives and Records Administration as a record which has sufficient historical or other value to warrant its continued preservation by the United States Government, or for evaluation by the Archivist of the United States or the designee of the Archivist to determine whether the record has such value."

Comment:

For a discussion of this provision, see OMB Guidelines, 40 Fed. Reg. 28,948, 28,955 (July 9, 1975).

7. 5 U.S.C. § 552a(b)(7) (law enforcement request)

"to another agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States for a civil or criminal law enforcement activity if the activity is authorized by law, and if the head of the agency or instrumentality has made a written request to the agency which maintains the record specifying the particular portion desired and the law enforcement activity for which the record is sought."

Comment:

This provision, in addition to providing for disclosures to federal law enforcement agencies, also allows an agency, "upon receipt of a written request, [to] disclose a record to another agency or unit of State or local government for a civil or criminal law enforcement activity." OMB Guidelines, 40 Fed. Reg. 28,948, 28,955 (July 9, 1975).

Note that the request must be submitted in writing and generally must be from the head of the agency or instrumentality. See Doe v. DiGenova, 779 F.2d 74, 85 (D.C. Cir. 1985); Doe v. Naval Air Station, 768 F.2d 1229, 1232-33 (11th Cir. 1985); see also Reyes v. Supervisor of DEA, 834 F.2d 1093, 1095 (1st Cir. 1987); United States v. Collins, 596 F.2d 166, 168 (6th Cir. 1979); SEC v. Dimensional Entm't Corp., 518 F. Supp. 773, 775 (S.D.N.Y. 1981).

Record-requesting authority may be delegated down to lower-level agency officials when necessary, but not below the "section chief" level. See OMB Guidelines, 40 Fed. Reg. at 28,955; see also 120 Cong. Rec. 36,967 (1974), reprinted in Source Book at 958. The Department of Justice has delegated record-requesting authority to the "head of a component or a United States Attorney, or either's designee." 28 C.F.R. § 16.40(c) (2004); cf. Lora v. INS, No. 2:02cv756, 2002 WL 32488472, at *2 (E.D. Va. Oct. 8, 2002) (applying subsection (b)(7) to disclosure of information from INS file upon request of Assistant United States Attorney), aff'd per curiam, 61 Fed. Appx. 80 (4th Cir. 2003).

8. 5 U.S.C. § 552a(b)(8) (health or safety of an individual)

"to a person pursuant to a showing of compelling circumstances affecting the health or safety of an individual if upon such disclosure notification is transmitted to the last known address of such individual."

Comment:

For cases discussing this provision, see Schwarz v. INTERPOL, No. 94-4111, 1995 U.S. App. LEXIS 3987, at *6 n.2 (10th Cir. Feb. 28, 1995) (unsubstantiated allegations alone do not constitute "showing of compelling circumstances"); Schwarz v. United States Dep't of Treasury, 131 F. Supp. 2d 142, 146-47 (D.D.C. 2000) (same, citing Schwarz v. INTERPOL), summary affirmance granted, No. 00-5453 (D.C. Cir. May 10, 2001); and DePlanche v. Califano, 549 F. Supp. 685, 703-04 (W.D. Mich. 1982) (emphasizing emergency nature of exception). According to the OMB Guidelines, the individual about whom records are disclosed "need not necessarily be the individual whose health or safety is at peril; e.g., release of dental records on several individuals in order to identify an individual who was injured in an accident." OMB Guidelines, 40 Fed. Reg. 28,948, 28,955 (July 9, 1975). This construction, while certainly sensible as a policy matter, appears to conflict somewhat with the actual wording of subsection (b)(8).

9. 5 U.S.C. § 552a(b)(9) (Congress)

"to either House of Congress, or, to the extent of matter within its jurisdiction, any committee or subcommittee thereof, any joint committee of Congress or subcommittee of any such joint committee."

Comment:

This exception does not authorize the disclosure of a Privacy Act-protected record to an individual Member of Congress acting on his or her own behalf or on behalf of a constituent. See OMB Guidelines, 40 Fed. Reg. 28,948, 28,955 (July 9, 1975); 40 Fed. Reg. 56,741, 56,742 (Nov. 21, 1975); see also Swenson v. USPS, 890 F.2d 1075, 1077 (9th Cir. 1989); Lee v. Dearment, No. 91-2175,1992 WL 119855, at *2 (4th Cir. June 3, 1992); cf. Chang v. Dep't of the Navy, No. 00-0783, 2004 WL 882030, at **9-10 (D.D.C. Apr. 22, 2004) (discussing subsection (b)(9), but ultimately finding disclosure to be proper pursuant to routine use permitting disclosure to Members of Congress making inquiries on behalf of constituents). See generally FOIA Update, Vol. V, No. 1, at 3-4 ("Congressional Access Under FOIA") (interpreting counterpart provision of FOIA).

The Court of Appeals for the Second Circuit in Devine v. United States, in holding that the unsolicited disclosure of an Inspector General letter to a congressional subcommittee chairman and member fell "squarely within the ambit of § 552a(b)(9)," rejected the appellant's argument that subsection (b)(9) should not apply if the government agency knew or should have known that the information would eventually be released to the public. 202 F.3d 547, 551-53 (2d Cir. 2000).

10. 5 U.S.C. § 552a(b)(10) (General Accounting Office)

"to the Comptroller General, or any of his authorized representatives, in the course of the performance of the duties of the General Accounting Office."

11. 5 U.S.C. § 552a(b)(11) (court order)

"pursuant to the order of a court of competent jurisdiction."

Comment:

This exception -- like the subsection (b)(3) routine use exception -- has generated a great deal of uncertainty. Unfortunately, neither the Act's legislative history, see 120 Cong. Rec. 36,959 (1974), reprinted in Source Book at 936, nor the OMB Guidelines, see 40 Fed. Reg. 28,948, 28,955 (July 9, 1975), shed light on its meaning.

As a general proposition, it appears that the essential point of this exception is that the Privacy Act "cannot be used to block the normal course of court proceedings, including court-ordered discovery." Clavir v. United States, 84 F.R.D. 612, 614 (S.D.N.Y. 1979); see also, e.g., Martin v. United States, 1 Cl. Ct. 775, 780-82 (Cl. Ct. 1983); Newman v. United States, No. 81-2480, slip op. at 3 (D.D.C. Sept. 13, 1982).

What Does "Court Order" Mean?

In Doe v. DiGenova, 779 F.2d 74, 77-85 (D.C. Cir. 1985), the Court of Appeals for the District of Columbia Circuit decisively ruled that a subpoena routinely issued by a court clerk -- such as a federal grand jury subpoena -- is not a "court order" within the meaning of this exception because it is not "specifically approved" by a judge. Prior to Doe v. DiGenova, a split of authority existed on this point. Compare Bruce v. United States, 621 F.2d 914, 916 (8th Cir. 1980) (dictum) (subpoena is not court order), and Stiles v. Atlanta Gas Light Co., 453 F. Supp. 798, 800 (N.D. Ga. 1978) (same), with Adams v. United States Lines, No. 80-0952, slip op. at 2-3 (E.D. La. Mar. 16, 1981) (subpoena is court order). Cf. Moore v. USPS, 609 F. Supp. 681, 682 (E.D.N.Y. 1985) (subpoena is court order where it is required to be approved by judge under state law).

Note that an agency cannot avoid the result in Doe v. DiGenova by relying on a routine use that seeks to authorize disclosure pursuant to a subpoena. See Doe v. Stephens, 851 F.2d 1457, 1465-67 (D.C. Cir. 1988) (discussed above under routine use exception).

What is the Standard for Issuance of a Court Order?

Unlike similar provisions in other federal confidentiality statutes, see, e.g., 42 U.S.C. § 290dd-2 (2000) (listing "good cause" factors to be weighed by court in evaluating applications for orders permitting disclosure of records pertaining to substance abuse), subsection (b)(11) contains no standard governing the issuance of an order authorizing the disclosure of otherwise protected Privacy Act information. However, several courts have addressed the issue with varying degrees of clarity. It has been held, for example, that because the Privacy Act does not itself create a qualified discovery "privilege," a showing of "need" is not a prerequisite to initiating discovery of protected records. See Laxalt v. McClatchy, 809 F.2d 885, 888-90 (D.C. Cir. 1987); see also Weahkee v. Norton, 621 F.2d 1080, 1082 (10th Cir. 1980) (noting that objection to discovery of protected records "does not state a claim of privilege"); Bosaw v. NTEU, 887 F. Supp. 1199, 1215-17 (S.D. Ind. 1995) (citing Laxalt with approval, although ultimately determining that court did not have jurisdiction to rule on merits of case); Ford Motor Co. v. United States, 825 F. Supp. 1081, 1083 (Ct. Int'l Trade 1993) ("[T]he Privacy Act does not establish a qualified discovery privilege that requires a party seeking disclosure under 5 U.S.C. § 552a(b)(11) to prove that its need for the information outweighs the privacy interest of the individual to whom the information relates."); Clavir v. United States, 84 F.R.D. at 614 ("it has never been suggested that the Privacy Act was intended to serve as a limiting amendment to . . . the Federal Rules of Civil Procedure"); cf. Baldrige v. Shapiro, 455 U.S. 345, 360-62 (1981) (Census Act held to constitute statutorily created discovery "privilege" because it precludes all disclosure of raw census data despite need demonstrated by litigant).

Rather, the D.C. Circuit's decision in Laxalt v. McClatchy establishes that the only test for discovery of Privacy Act-protected records is "relevance" under Rule 26(b)(1) of the Federal Rules of Civil Procedure. 809 F.2d at 888-90; see also, e.g., Snyder v. United States, No. 02-0976, 2003 WL 21088123, at **2-3 (E.D. La. May 12, 2003); Lynn v. Radford, No. 99-71007, 2001 WL 514360, at *3 (E.D. Mich. Mar. 16, 2001); Anderson v. Cornejo, No. 97 C 7556, 2001 WL 219639, at *3 (N.D. Ill. Mar. 6, 2001); Hernandez v. United States, No. 97-3367, 1998 WL 230200, at **2-3 (E.D. La. May 6, 1998); Forrest v. United States, No. 95-3889, 1996 WL 171539, at *2 (E.D. Pa. Apr. 11, 1996); Bosaw, 887 F. Supp. at 1216-17 (citing Laxalt with approval, although ultimately determining that court did not have jurisdiction to rule on merits of case); Ford Motor Co., 825 F. Supp. at 1083-84; Mary Imogene Bassett Hosp. v. Sullivan, 136 F.R.D. 42, 49 (N.D.N.Y. 1991); O'Neill v. Engels, 125 F.R.D. 518, 520 (S.D. Fla. 1989); Murray v. United States, No. 84-2364, slip op. at 1-3 (D. Kan. Feb. 21, 1988); Broderick v. Shad, 117 F.R.D. 306, 312 (D.D.C. 1987); Smith v. Regan, No. 81-1401, slip op. at 1-2 (D.D.C. Jan. 9, 1984); In re Grand Jury Subpoenas Issued to USPS, 535 F. Supp. 31, 33 (E.D. Tenn. 1981); Christy v. United States, 68 F.R.D. 375, 378 (N.D. Tex. 1975). But see Perry v. State Farm Fire & Cas. Co., 734 F.2d 1441, 1447 (11th Cir. 1984) (requests for court orders "should be evaluated by balancing the need for the disclosure against the potential harm to the subject of the disclosure"); Newman, No. 81-2480, slip op. at 3 (D.D.C. Sept. 13, 1982) (evaluating "legitimacy" of discovery requests and "need" for records as factors governing issuance of court order).

However, it is important to note that a protective order limiting discovery under Rule 26(c) of the Federal Rules of Civil Procedure (based, if appropriate, upon a court's careful in camera inspection) is a proper procedural device for protecting particularly sensitive Privacy Act-protected records when subsection (b)(11) court orders are sought. See Laxalt, 809 F.2d at 889-90; see also, e.g., Boudreaux v. United States, No. 97-1592, 1999 WL 499911, at **1-2 (E.D. La. July 14, 1999) (recognizing relevancy of subsection (b)(11) to court's resolution of dispute over motion to compel responses to production of documents subject to Privacy Act, but ordering in camera review of documents so that legitimacy of agency objections may be determined "in the considered and cautious manner contemplated by the Privacy Act"); Gary v. United States, No. 3:97-cv-658, 1998 U.S. Dist. LEXIS 16722, at **10-11 (E.D. Tenn. Sept. 4, 1998) (finding that while third party's personnel file may contain relevant information, disclosure of that file must be made pursuant to protective order); Bustillo v. Hawk, No. 97-WM-445, 1998 WL 299980, at **4-6 (D. Colo. May 28, 1998) (ordering defendant to provide United States Marshals Service with addresses of individually named defendants for service of process on behalf of inmate and ordering that addresses be safeguarded by Marshals Service); Hernandez, No. 97-3367, 1998 WL 230200, at **2-3 (E.D. La. May 6, 1998) (granting motion to compel agency to produce individual's personnel file "which is likely to contain information 'relevant to the subject matter involved in the pending action,'" but accommodating "legitimate privacy and confidentiality concerns" with protective order); Wright v. United States, No. 95-0274, 1996 WL 525324 (D.D.C. Sept. 10, 1996) (order "pursuant to the Privacy Act and Rule 26 of the Federal Rules of Civil Procedure" establishing procedures to be followed by parties "[i]n order to permit the parties to use information relevant to th[e] case without undermining the legislative purposes underlying the Privacy Act"); Bosaw, 887 F. Supp. at 1216-17 (citing Laxalt with approval, although ultimately determining that court did not have jurisdiction to rule on merits of case); PHE, Inc. v. Dep't of Justice, No. 90-0693, slip op. at 13 & accompanying order (D.D.C. Nov. 14, 1991); Mary Imogene Bassett Hosp. v. Sullivan, 136 F.R.D. at 49; Avirgan v. Hull, Misc. No. 88-0112, slip op. at 1-3 (Bankr. D.D.C. May 2, 1988); Baron & Assocs. v. United States Dep't of the Army, No. 84-2021, slip op. at 2-4 (D.D.C. Apr. 1, 1985); Granton v. HHS, No. 83-C-3538, 1984 U.S. Dist. LEXIS 19113, at **2-3 (N.D. Ill. Feb. 27, 1984); White House Vigil for the ERA Comm. v. Watt, No. 83-1243, slip op. at 1-3 (D.D.C. Oct. 14, 1983); LaBuguen v. Bolger, No. 82-C-6803, 1983 U.S. Dist. LEXIS 13559 (N.D. Ill. Sept. 21, 1983) (order); Clymer v. Grzegorek, 515 F. Supp. 938, 942 (E.D. Va. 1981); cf. Forrest, 1996 WL 171539, at **2-3 (parties ordered to "explore the possibility of entering into a voluntary confidentiality agreement regarding protecting the privacy interests of those individuals affected by disclosure"); Loma Linda Cmty. Hosp. v. Shalala, 907 F. Supp. 1399, 1405 (C.D. Cal. 1995) ("Even if release of the data . . . had unexpectedly included information not already known to [the recipient], a confidentiality order could have been imposed to protect the privacy interests in issue."); Williams v. McCausland, No. 90 Civ. 7563, 1992 WL 309826, at *3 (S.D.N.Y. Oct. 15, 1992) (parties directed to agree on and execute appropriate protective stipulation for information sought in discovery that, under Privacy Act's subsection (b)(2) standard, would not be required to be disclosed under FOIA); cf. Jacobs v. Schiffer, 204 F.3d 259, 264-66 & n.5 (D.C. Cir. 2000) (where the information that an employee wished to disclose to his private attorney was covered by the Privacy Act, inter alia, recognizing superiority of First Amendment rights and "[o]bserving that there is a "critical distinction between disclosures in the attorney-client context and public disclosures," and pointing to the attorney's "willingness to enter into a protective order" as relevant to the balancing of "the employee's interests in communication with the government's interests in preventing communication").

In some instances, it even may be appropriate for a court to entirely deny discovery. See, e.g., Farnsworth v. Proctor & Gamble Co., 758 F.2d 1545, 1546-48 (11th Cir. 1985); Oslund v. United States, 125 F.R.D. 110, 114-15 (D. Minn. 1989); cf. Barnett v. Dillon, 890 F. Supp. 83, 88 (N.D.N.Y. 1995) (declining to order disclosure of FBI investigative records protected by Privacy Act to arrestees despite their assertion that records were essential to proper prosecution and presentment of claims in their civil rights lawsuit).

In Redland Soccer Club, Inc. v. Department of the Army of the United States, No. 1:CV-90-1072, slip op. 1-3 & accompanying order (M.D. Pa. Jan. 14, 1991), aff'd, rev'd & remanded on other grounds, 55 F.3d 827 (3d Cir. 1995), the court, recognizing the "defendants' initial reluctance to respond to plaintiffs' [discovery] requests without a specific order of court [as] a reasonable precaution in light of the terms of the Privacy Act," solved the dilemma by ordering the Army to respond to "all properly framed discovery requests in th[e] proceeding" and that such responses were to "be deemed made pursuant to an order of court." Id.

Must an Agency Obtain a Court Order to Publicly File Protected Records with the Court?

As noted above, the Act's legislative history indicates that a court is not a "person" or "agency" within the meaning of subsection (b), and that the Act was "not designed to interfere with access to information by the courts." 120 Cong. Rec. 36,967 (1974), reprinted in Source Book at 958-59.

However, the nonconsensual public filing of protected records with a court, during the course of litigation, does constitute a subsection (b) disclosure. See Laningham v. United States Navy, No. 83-3238, slip op. at 2-3 (D.D.C. Sept. 25, 1984), summary judgment granted (D.D.C. Jan. 7, 1985), aff'd per curiam, 813 F.2d 1236 (D.C. Cir. 1987); Citizens Bureau of Investigation v. FBI, No. 78-60, slip op. at 3 (N.D. Ohio Dec. 14, 1979). Thus, such public filing is proper only if it is undertaken pursuant to: (1) the subsection (b)(3) routine use exception (previously discussed), or (2) the subsection (b)(11) court order exception. See generally Krohn v. United States Dep't of Justice, No. 78-1536, slip op. at 3-11 (D.D.C. Mar. 19, 1984) (finding violation of Privacy Act where agency's disclosure of records as attachments to affidavit in FOIA lawsuit "did not fall within any of the exceptions listed in Section 552a"), reconsideration granted & vacated in nonpertinent part (D.D.C. Nov. 29, 1984).

Where the routine use exception is unavailable, an agency should obtain a subsection (b)(11) court order permitting such public filing. Cf. Doe v. DiGenova, 779 F.2d at 85 n.20 ("This is not to say that a prosecutor, a defendant, or a civil litigant, cannot submit an in camera ex parte application for a [subsection (b)(11)] court order."). However, in light of Laningham, No. 83-3238, slip op. at 2-3 (D.D.C. Sept. 25, 1984), agencies should take care to apprise the court of the Privacy Act-related basis for seeking the order. In Laningham, the district court ruled that the government's nonconsensual disclosure of plaintiff's "disability evaluation" records to the United States Claims Court was improper -- even though such records were filed only after the agency's motion for leave to file "out of time" was granted. Id. The court held that subsection (b)(11) applies only when "for compelling reasons, the court specifically orders that a document be disclosed," and it rejected the agency's argument that the exception applies whenever records happen to be filed with leave of court. Id. at 4.

One unique solution to the problem of filing Privacy Act-protected records in court is illustrated by In re A Motion for a Standing Order, in which the Court of Veterans Appeals issued a "standing order" permitting the Secretary of Veterans Affairs to routinely file relevant records from veterans' case files in all future proceedings with that court. 1 Vet. App. 555, 558-59 (Ct. Vet. App. 1990) (per curiam); cf. Perkins v. United States, No. 99-3031, 2001 WL 194928, at *3 (D.D.C. Feb. 21, 2001) (pursuant to subsection (b)(11), authorizing parties to seek admission into evidence at trial in that case of any materials subject to stipulated protective order).

What Does "Competent Jurisdiction" Mean?

One of the few Privacy Act decisions to even mention this oft-overlooked requirement is Laxalt v. McClatchy, 809 F.2d at 890-91. In that case, the Court of Appeals for the District of Columbia Circuit appeared to equate the term "competent jurisdiction" with personal jurisdiction, noting that the requests for discovery of the nonparty agency's records "were within the jurisdiction of the District Court for the District of Columbia" as "[n]either party contends that the District Court lacked personal jurisdiction over the FBI's custodian of records." Id.

Of course, where an agency is a proper party in a federal case, the district court's personal jurisdiction over the agency presumably exists and thus court-ordered discovery of the agency's records is clearly proper under subsection (b)(11).

However, where a party seeks discovery of a nonparty agency's records -- pursuant to a subpoena duces tecum issued under Rule 45 of the Federal Rules of Civil Procedure -- Laxalt suggests that the district court issuing the discovery order must have personal jurisdiction over the nonparty agency in order to be regarded as a court of "competent jurisdiction" within the meaning of subsection (b)(11). See 809 F.2d at 890-91; cf. Mason v. S. Bend Cmty. Sch. Corp., 990 F. Supp. 1096, 1097-99 (N.D. Ind. 1997) (determining that Social Security Administration's regulations "generally do not authorize the release of . . . records upon order of a court, even a federal court, in the absence of a special circumstance as defined by the statutes and regulations" and thus finding SSA not to be in contempt of court for failure to comply with prior order compelling SSA, a nonparty, to produce documents). But cf. Lohrenz v. Donnelly, 187 F.R.D. 1, 8-9 (D.D.C. 1999) (finding that requisite showing of good cause had been made by nonparty agency, and providing for entry of protective order with no discussion of jurisdiction over nonparty agency). The issue of whether personal jurisdiction exists in this kind of situation is not always a clear-cut one -- particularly where the nonparty agency's records are kept at a place beyond the territorial jurisdiction of the district court that issued the discovery order. Indeed, this very issue was apparently raised but not decided in Laxalt, 809 F.2d at 890-91 (finding it unnecessary to decide whether federal district court in Nevada would have had jurisdiction to order discovery of FBI records located in District of Columbia).

The existence of "competent jurisdiction" is likewise questionable whenever a state court orders the disclosure of a nonparty federal agency's records -- because ordinarily the doctrine of "sovereign immunity" will preclude state court jurisdiction over a federal agency or official. See, e.g., Bosaw, 887 F. Supp. at 1210-17 (state court lacked jurisdiction to order federal officers to produce documents because government did not explicitly waive its sovereign immunity and, because federal court's jurisdiction in this case was derivative of state court's jurisdiction, federal court was likewise barred from ordering officers to produce documents); Boron Oil Co. v. Downie, 873 F.2d 67, 70-71 (4th Cir. 1989) (state court subpoena held to constitute "action" against United States and thus sovereign immunity applied even though EPA was not party in suit); Sharon Lease Oil Co. v. FERC, 691 F. Supp. 381, 383-85 (D.D.C. 1988) (state court subpoena quashed as state court lacked jurisdiction to compel nonparty federal official to testify or produce documents absent waiver of sovereign immunity); see also Moore v. Armour Pharm. Co., 129 F.R.D. 551, 555 (N.D. Ga. 1990) (citing additional cases on point); cf. Louisiana v. Sparks, 978 F.2d 226, 235 n.15 (5th Cir. 1992) (noting that "[t]here is no indication that [subsection (b)(11)] evinces congressional intent to broadly waive the sovereign immunity of [federal] agencies . . . when ordered to comply with state court subpoenas").

Nevertheless, in Robinett v. State Farm Mutual Automobile Insurance Company, No. 02-0842, 2002 WL 31498992, at **3-4 (E.D. La. Nov. 7, 2002), aff'd per curiam, 83 Fed. Appx. 638 (5th Cir. 2003), petition for cert. filed, 72 U.S.L.W. 3615 (U.S. Mar. 10, 2004) (No. 03-1306), the court looked to subsection (b)(11) and held that State Farm "properly obtained" an order from the state court for release of plaintiff's medical records where "plaintiff's medical condition was relevant to the litigation," and that the Department of Veterans Affairs' "determination that plaintiff's records were subject to release based on the court order . . . was therefore correct." The district court's holding in Robinett was affirmed per curiam by the Court of Appeals for the Fifth Circuit, which specifically stated that the medical records were "released pursuant to the exception for orders of a court of competent jurisdiction contained in 5 U.S.C. § 552a(b)(11)." 83 Fed. Appx. at 639; see also Moore v. USPS, 609 F. Supp. 681, 682 (E.D.N.Y. 1985) (assuming without explanation that state court subpoena, required by state law to be approved by judge, constituted proper subsection (b)(11) court order; issue of "competent jurisdiction" was not addressed); cf. Henson v. Brown, No. 95-213, slip op. at 4-5 (D. Md. June 23, 1995) (although not disputed by parties, stating that judge's signature elevated subpoena to court order within meaning of subsection (b)(11) in context of determining whether defendant complied with order).

In addition, at least one state court has ruled that it has "competent jurisdiction" to issue a subsection (b)(11) court order permitting the disclosure of a Privacy Act-protected record. Tootle v. Seaboard Coast Line R.R., 468 So. 2d 237, 239 (Fla. Dist. Ct. App. 1984); cf. Saulter v. Mun. Court for the Oakland-Piedmont Judicial Dist., 142 Cal. App. 3d 266, 275 (Cal. Ct. App. 1977) (suggesting that state court can order state prosecutor to subpoena federal records for purpose of disclosing them to criminal defendant in discovery).

Agencies that construe state court orders as providing authority to disclose under subsection (b)(11) should be aware that compliance with such an order might be taken by a court as acquiescence to the court's jurisdiction, notwithstanding applicable principles of sovereign immunity.

12. 5 U.S.C. § 552a(b)(12) (Debt Collection Act)

"to a consumer reporting agency in accordance with section 3711(e) of Title 31."

Comment:

This disclosure exception was added to the original eleven exceptions by the Debt Collection Act of 1982. It authorizes agencies to disclose bad-debt information to credit bureaus. Before doing so, however, agencies must complete a series of due process steps designed to validate the debt and to offer the individual an opportunity to repay it. See OMB Guidelines, 48 Fed. Reg. 15,556-60 (Apr. 11, 1983).

Go to Table of Contents || Previous Section Definitions || Next Section Accounting of Certain Disclosures