The general rule under the Privacy Act is that an agency cannot disclose a record contained in a system of records unless the individual to whom the record pertains gives prior written consent to the disclosure. There are twelve exceptions to this general rule. Show
A. The “No Disclosure without Consent” Rule“No agency shall disclose any record which is contained in a system of records by any means of communication to any person, or to another agency, except pursuant to a written request by, or with the prior written consent of, the individual to whom the record pertains [subject to 12 exceptions].” 5 U.S.C. § 552a(b). Comment: Under the Privacy Act’s disclosure provision, agencies generally are prohibited from disclosing records by any means of communication – written, oral, electronic, or mechanical – without the written consent of the individual, subject to twelve exceptions. Federal officials handling personal information are “bound by the Privacy Act not to disclose any personal information and to take certain precautions to keep personal information confidential.” Big Ridge, Inc. v. Fed. Mine Safety & Health Review Comm’n, 715 F.3d 631, 650 (7th Cir. 2013); see also, e.g., Navy, Navy Exch., Naval Training Station, Naval Hosp. v. FLRA, 975 F.2d 348, 350 (7th Cir. 1992) (noting that “Privacy Act generally prohibits the federal government from disclosing personal information about an individual without the individual’s consent”). A “disclosure” can be by any means of communication – written, oral, electronic, or mechanical. See OMB 1975 Guidelines, 40 Fed. Reg. at 28,953, Bartel v. FAA, 725 F.2d 1403, 1409 (D.C. Cir. 1984) (concluding that “an absolute policy of limiting the Act’s coverage to information physically retrieved from a record would make little sense in terms of its underlying purpose” and that Privacy Act “forbids nonconsensual disclosure of records “by any means of communication”); see also, e.g., Speaker v. HHS Ctrs. for Disease Control & Prevention, 623 F.3d 1371, 1382 n.11 (11th Cir. 2010) (“Numerous courts have held that the Privacy Act protects against improper oral disclosures.”); Jacobs v. Nat’l Drug Intelligence Ctr., 423 F.3d 512, 517-19 (5th Cir. 2005) (rejecting argument that “the [Privacy Act] only protects against the disclosure of a physical document that is contained in a system of records,” and holding that “damaging information . . . taken from a protected record and inserted into a new document, which was then disclosed without the plaintiff’s consent,” violated subsection (b) because “the new document is also a protected record”); Orekoya v. Mooney, 330 F.3d 1, 6 (1st Cir. 2003) (“The Privacy Act prohibits more than dissemination of records themselves, but also ‘nonconsensual disclosure of any information that has been retrieved from a protected record’” (quoting Bartel v. FAA, 725 F.2d at 1408)); Boyd v. United States, 932 F. Supp. 2d 830, 835 (S.D. Ohio 2013) (“[w]hile the term ‘disclosure’ is not defined by the statute, it has been interpreted broadly”); Cloonan v. Holder, 768 F. Supp. 2d. 154, 163 (D.D.C. 2011) (citing Bartel, 725 F.2d at 1408); Chang v. Navy, 314 F. Supp. 2d 35, 41 n.2 (D.D.C. 2004) (citing Bartel, 725 F.2d at 1408). OMB guidelines, and some, but not all, courts have advised that disclosures can occur by either transferring a record or simply “granting access” to a record. Further, a disclosure under the Privacy Act “may be either the transfer of a record or the granting of access to a record.” OMB 1975 Guidelines, 40 Fed. Reg. at 28953 (July 9, 1975), see also Wilkerson v. Shinseki, 606 F.3d 1256, 1268 (10th Cir. 2010) (interpreting disclosure under the Privacy Act “liberally to include not only the physical disclosure of the records, but also the accessing of private records”). Regarding actionability, however, the United States Court of Appeals for the District of Columbia Circuit has required that a record actually be retrieved. Armstrong v. Geithner, 608 F.3d 854, 857 (D.C. Cir. 2010) (quoting Bartel, 725 F.2d at 1408, and holding that, to be actionable, “a disclosure generally must be the result of someone having actually retrieved the ‘record’ from that ‘system of records’; the disclosure of information is not ordinarily a violation ‘merely because the information happens to be contained in the records’”); Lambert v. United States, No. 3:15-CV-147-PLR-HBG, 2016 WL 632461, at *4-5 (E.D. Tenn. Feb. 17, 2016). But see Atkins v. Mabus, No. 12CV1390-GPC, 2014 WL 2705204, at *4-8 (S.D. Cal. June 13, 2014) (holding unauthorized access not actionable under Privacy Act, even though plaintiff’s declaration provided support for conclusion that defendant’s employees individually improperly accessed plaintiff’s private medical data); Cacho v. Chertoff, No. 06-00292(ESH), 2006 WL 3422548, at *5 (D.D.C. Nov. 28, 2006) (“[A] plaintiff cannot establish a prima facie claim under the Privacy Act simply by showing that the agency official who disclosed a protected record should never have accessed the record in the first place.”); Smith v. VA, No. CIV-06-865-R, 2007 WL 9711018 (W.D. Okla. Sept. 12, 2007) (dismissing claim of improper disclosure under subsection (b) in spite of evidence suggesting agency’s employee had unauthorized access to plaintiff’s personnel file, because agency had complied with all safeguards of Privacy Act, and had not acted intentionally or willfully to disclose, defined as “to ‘open up,’ ‘to expose to view,’ or ‘to make known, . . . especially to reveal in words’” (citations omitted)). A disclosure of information from a non-record source does not violate the Privacy Act’s disclosure provision. The disclosure of information “acquired from non-record sources – such as observation, office emails, discussions with co-workers and the ‘rumor mill’– does not violate the Privacy Act . . . even if the information disclosed is also contained in agency records.” Lambert v. United States at *5 (quoting Cloonan, 768 F. Supp. 2d. at 164); Thompson v. BOP, No. 1:10-CV-00578-JOF, 2012 WL 13072105, at *5 (N.D. Ga. Jan. 20, 2012) (For “a disclosure to be covered by section 552a(b), there must have initially been a retrieval from the system of records which was at some point a source of the information.” (citations omitted)); Savage v. Geren, No. CV-08-S-2189-NE, 2010 WL 11519448, at *13 (N.D. Ala. Nov. 15, 2010) (“[T]he Privacy Act does not prohibit disclosure of information or knowledge obtained from other sources other than ‘records.’...In particular, it does not prevent federal employees or officials from talking – even gossiping – about anything of which they have non-record-based knowledge.” (citations omitted)). For further discussion of the meaning of “disclosure” of records, see the “Definitions, Systems of Records and Disclosures under Subsection (b)” section above. In one case in which a plaintiff sought relief for alleged wrongful disclosure of items seized during the execution of a search warrant, the court found, “Appellant has failed to show that evidence seized during a search conducted in a criminal investigation constitutes records that are “contained in a system of records” under the Privacy Act. Matter of Search of 2122 21st Rd. N. Arlington, Virginia, No. 1:17-CR-00236, 2018 WL 534161, at *4 (E.D. Va. Jan. 23, 2018), aff’d sub nom. U.S. v. Search of 2122 21st Rd. N. Arlington, Virginia, 735 F. App’x 66 (4th Cir. 2018). Id. at *4. Plaintiffs maintain the burden of demonstrating that a disclosure by an agency occurred. A plaintiff has the burden of demonstrating that a “disclosure” by the agency has occurred. See, e.g., Askew v. United States, 680 F.2d 1206, 1209-11 (8th Cir. 1982); Zerilli v. Smith, 656 F.2d 705, 715-16 (D.C. Cir. 1981); Boyd v. United States, 932 F. Supp. 2d 830, 835 (S.D. Ohio 2013); cf. Hernandez v. Johnson, 514 F. App’x 492, 500 (5th Cir. 2013) (holding that “disclosure is not actionable because it identified [plaintiff] only by his first name and neither recipient knew who ‘Jaime’ was”); Luster v. Vilsack, 667 F.3d 1089, 1097-98 (10th Cir. 2011) (rejecting appellant’s contentions that “mere transmission of the documents to a fax machine at which unauthorized persons might have viewed the documents constitutes a prohibited disclosure” and that “the possibility that a record might be revealed to unauthorized readers by negligent or reckless transmission is sufficient to constitute a prohibited disclosure under the Act’”); Whyde v. Rockwell Int’l Corp., 101 F. App’x 997, 1000 (6th Cir. 2004) (“[T]he fact that [a company] somehow came into possession of documents that might have been included in plaintiff’s personnel file . . . gives rise only to a metaphysical doubt as to the existence of a genuine issue of material fact.”); Brown v. Snow, 94 F. App’x 369, 372 (7th Cir. 2004) (ruling that district court grant of summary judgment was proper where no evidence was found that record was disclosed, and stating that “burden is on the plaintiff at the summary judgment stage to come forward with specific evidence”); Lennon v. Rubin, 166 F.3d 6, 10-11 (1st Cir. 1999) (where agency employee testified that, despite memorandum indicating otherwise, she had disclosed information only within agency, and where plaintiff responded that whether his file was reviewed by other individuals is question of fact he “want[ed] decided by a fact finder, ‘not an affidavit,’” finding such “arguments misapprehend [plaintiff’s] burden at the summary judgment stage”); Russell v. Potter, No. 3:08-CV-2272, 2011 WL 1375165, at *9 (N.D. Tex. Mar. 4, 2011) (holding that plaintiff cannot prove disclosure violation where “the only agency involved, the Postal Service, received rather than ‘disclosed’ the information in question”); Collins v. FBI, No. 10-cv-03470, 2011 WL 1627025, at *7 (D.N.J. Apr. 28, 2011) (dismissing claim and stating that plaintiff’s “conclusory allegations” of unlawful disclosure, “without identifying or describing who acted against Plaintiff or what the person did, is insufficient”); Roggio v. FBI, No. 08-4991, 2009 WL 2460780, at *2 (D.N.J. Aug. 11, 2009) (concluding that plaintiffs “fail[ed] to allege sufficient facts supporting that the FBI, as opposed to some other law enforcement body, disclosed [one plaintiff’s] rap sheet” on the Internet, where plaintiffs “base[d] their allegation on . . . the mere fact that [a particular Internet] posting contained some expunged information”), reconsideration denied, No. 08-4991, 2009 WL 2634631 (D.N.J. Aug. 26, 2009); Walia v. Chertoff, No. 06-cv-6587, 2008 WL 5246014, at *11 (E.D.N.Y. Dec. 17, 2008) (concluding that plaintiff failed to make out prima facie case under subsection (b) of Privacy Act because plaintiff alleged merely that records were accessible to other individuals in office, rather than that they were actually disclosed); Buckles v. Indian Health Serv., 310 F. Supp. 2d 1060, 1068 (D.N.D. 2004) (finding that plaintiffs failed to “prove, by a preponderance of the evidence, that IHS disclosed protected information” where plaintiffs did not “have personal knowledge that [the memorandum was disclosed]” and witnesses at trial denied disclosing or receiving memorandum); Meldrum v. USPS, No. 5:97CV1482, slip op. at 11 (N.D. Ohio Jan. 21, 1999) (finding lack of evidence that disclosure occurred where plaintiff alleged that, among other things, file had been left in unsecured file cabinet), aff’d per curiam, No. 99-3397, 2000 WL 1477495, at *2 (6th Cir. Sept. 25, 2000). But cf. Speaker, 623 F.3d at 1386 (finding plaintiff’s complaint sufficient to survive summary judgment because he “need not prove his case on the pleadings” but rather “must merely provide enough factual material to raise a reasonable inference, and thus a plausible claim, that the [Ctrs. for Disease Control & Prevention] was the source of the disclosures”); Ciralsky v. CIA, 689 F. Supp. 2d 141, 156-57 (D.D.C. 2010) (concluding that plaintiff’s allegation of CIA disclosure to unidentified government officials, who were unrelated to handling of plaintiff’s case, was “not unacceptably vague” and need not include identities of alleged recipients for CIA to “understand Plaintiff’s charge”); Tolbert-Smith v. Chu, 714 F. Supp. 2d 37, 43 (D.D.C. 2010) (ruling that plaintiff had stated claim for relief under Privacy Act where plaintiff “pled that a member of [agency] management placed records referring and relating to her disability on a server accessible by other federal employees and members of the public”). Direct evidence that an agency disclosed a record is generally not required, but plaintiffs must produce more than mere speculation or conjecture. Circumstantial evidence may be sufficient to prove an unauthorized disclosure occurred, although courts generally require corroborating evidence, rather than mere speculation or conjecture. Because “plaintiffs can rarely produce direct evidence that the government has disclosed confidential information obtained from their private records, requiring such evidence would eviscerate the protections of the Privacy Act.” Speaker v. HHS Ctrs. for Disease Control & Prevention, No. 1:09-CV-1137-WSD, 2012 WL 13071495, at * 20 (N.D. Ga. Mar. 14, 2012) (citing Doe v. USPS, 317 F.3d 339, 343 (D.C. Cir. 2003); Drennon-Gala v. Holder, No. 1:08-CV-3210-JEC, 2011 WL 1225784 (N.D. Ga. Mar. 30, 2011). At least one court has held that there will be an “adverse inference” against an agency that destroys evidence in order to undermine the plaintiff’s ability to prove that a disclosure occurred. One district court has concluded that when an agency destroys evidence in order to undermine the plaintiff’s ability to prove that a disclosure occurred, there will be an adverse inference against the agency. See Beaven v. DOJ, No. 03-84, 2007 WL 1032301, at *17 (E.D. Ky. Mar. 30, 2007) (concluding that “whether by use of the adverse inference” or “by a preponderance of the evidence” standard, “officials who inspected the folder found evidence that an inmate had tampered with it,” and finding that “disclosure” occurred in violation of Privacy Act), aff’d in part, rev’d in part & remanded, on other grounds, 622 F.3d 540 (6th Cir. 2010). Many, but not all, courts have held that a disclosure does not occur if the disclosure is to a person who was already aware of the information. Many, but not all, courts have held that a “disclosure” under the Privacy Act does not occur if the communication is to a person who is already aware of the information. See, e.g., Hoffman v. Rubin, 193 F.3d 959, 966 (8th Cir. 1999) (finding no Privacy Act violation where agency disclosed same information in letter to journalist that plaintiff himself had previously provided to journalist; plaintiff “waiv[ed], in effect, his protection under the Privacy Act”); Quinn v. Stone, 978 F.2d 126, 134 (3d Cir. 1992) (dictum); Kline v. HHS, 927 F.2d 522, 524 (10th Cir. 1991); Hollis v. Army, 856 F.2d 1541, 1545 (D.C. Cir. 1988); Reyes v. DEA, 834 F.2d 1093, 1096 n.1 (1st Cir. 1987); Schowengerdt v. Gen. Dynamics Corp., 823 F.2d 1328, 1341 (9th Cir. 1987); Pellerin v. VA, 790 F.2d 1553, 1556 (11th Cir. 1986); FDIC v. Dye, 642 F.2d 833, 836 (5th Cir. 1981); Ash v. United States, 608 F.2d 178, 179 (5th Cir. 1979); Mudd v. Army, No. 2:05-cv-137, 2007 WL 4358262, at *5 (M.D. Fla. Dec. 10, 2007) (finding no “disclosure” because by time agency posted statement on its web site, plaintiff had been quoted in newspaper saying he received letter of admonishment, another newspaper article had referred to letter, and plaintiff had testified before Congress regarding letter; also finding no “disclosure” of report because at time agency provided link to report on its web site, “the entire [report] had been the subject of a press release and news conference by a separate and independent agency . . . and had been released to the media by the same”); Schmidt v. VA, 218 F.R.D. 619, 630 (E.D. Wis. 2003) (“defin[ing] the term ‘disclose’ to mean the placing into the view of another information which was previously unknown”); Barry v. DOJ, 63 F. Supp. 2d 25, 26-28 (D.D.C. 1999); Sullivan v. USPS, 944 F. Supp. 191, 196 (W.D.N.Y. 1996); Loma Linda Cmty. Hosp. v. Shalala, 907 F. Supp. 1399, 1404-05 (C.D. Cal. 1995) (commenting that policy underlying Privacy Act protecting confidential information from disclosure not implicated by release of information health care provider had already received through patients’ California “Medi-Cal” cards); Viotti v. Air Force, 902 F. Supp. 1331, 1337 (D. Colo. 1995), aff’d, 153 F.3d 730 (10th Cir. 1998) (unpublished table decision); Abernethy v. IRS, 909 F. Supp. 1562, 1571 (N.D. Ga. 1995), aff’d per curiam, No. 95-9489 (11th Cir. Feb. 13, 1997); Kassel v. VA, 709 F. Supp. 1194, 1201 (D.N.H. 1989); Krowitz v. USDA, 641 F. Supp. 1536, 1545 (W.D. Mich. 1986), aff’d, 826 F.2d 1063 (6th Cir. 1987) (unpublished table decision); Owens v. MSPB, No. 3-83-0449-R, slip op. at 2-3 (N.D. Tex. Sept. 14, 1983) (mailing of agency decision affirming employee’s removal to his former attorney held not “disclosure” because “attorney was familiar with facts of [employee’s] claim” and “no new information was disclosed to him”); Golliher v. USPS, 3 Gov’t Disclosure Serv. ¶ 83,114, at 83,702 (N.D. Ohio June 10, 1982); King v. Califano, 471 F. Supp. 180, 181 (D.D.C. 1979); Harper v. United States, 423 F. Supp. 192, 197 (D.S.C. 1976); cf. Pippinger v. Rubin, 129 F.3d 519, 532-33 (10th Cir. 1997) (finding no evidence that disclosure “could possibly have had ‘an adverse effect’” on plaintiff where recipient “had been privy to every event described in [plaintiff’s] records at the time the event occurred”); Leighton v. CIA, 412 F. Supp. 2d 30, 39 (D.D.C. 2006) (citing Hollis and expressing doubt as to whether disclosure at issue “has presented any new information to those in the intelligence community”); Jones v. Runyon, 32 F. Supp. 2d 873, 876 (N.D. W. Va. 1998) (although finding disclosure to credit reporting service valid under routine use exception, concluding information disclosed was already in possession of recipient and other courts had held that Privacy Act is not violated in such cases), aff’d, 173 F.3d 850 (4th Cir. 1999) (unpublished table decision). However, the Court of Appeals for the District of Columbia Circuit clarified that some disseminations of protected records to individuals with prior knowledge of their existence or contents are “disclosures” under the Privacy Act. Pilon v. DOJ, 73 F.3d 1111, 1117-24 (D.C. Cir. 1996). In Pilon, the D.C. Circuit held that the Justice Department’s transmission of a Privacy Act-protected record to a former employee of the agency constituted a “disclosure” under the Privacy Act, even though the recipient had come “into contact with the [record] in the course of his duties” while an employee. Id. The court’s “review of the Privacy Act’s purposes, legislative history, and integrated structure convince[d it] that Congress intended the term ‘disclose’ to apply in virtually all instances to an agency’s unauthorized transmission of a protected record, regardless of the recipient’s prior familiarity with it.” Id. at 1124. In an earlier case, Hollis v. Army, 856 F.2d 1541 (D.C. Cir. 1988), the D.C. Circuit had held that the release of a summary of individual child-support payments previously deducted from plaintiff’s salary and sent directly to his ex-wife, who had requested it for use in pending litigation, was not an unlawful disclosure under the Privacy Act as she already knew what had been remitted to her. Id. at 1545. In Pilon, the D.C. Circuit reconciled its opinion in Hollis by “declin[ing] to extend Hollis beyond the limited factual circumstances that gave rise to it,” 73 F.3d at 1112, 1124, and holding that: [A]n agency’s unauthorized release of a protected record does constitute a disclosure under the Privacy Act except in those rare instances, like Hollis, where the record merely reflects information that the agency has previously, and lawfully, disseminated outside the agency to the recipient, who is fully able to reconstruct its material contents. Id. at 1124; cf. Osborne v. USPS, No. 94-30353, slip op. at 2-4, 6-11 (N.D. Fla. May 18, 1995) (assuming without discussion that disclosure of plaintiff’s injury-compensation file to retired employee who had prepared file constituted “disclosure” for purposes of Privacy Act). Courts are split over whether a disclosure occurs if the information disclosed is publicly available or was previously published. Courts have also split over whether the disclosure of information that is readily accessible to the public constitutes a “disclosure” under the Privacy Act. The Court of Appeals for the Fifth Circuit, along with several district courts, has concluded that there is no “disclosure” in the release of previously published or publicly available information under the Privacy Act, regardless of whether the particular persons who received the information were aware of the previous publication. FDIC v. Dye, 642 F.2d at 836; Banks v. Butler, No. 5:08cv336, 2010 WL 4537902, at *6 (S.D. Miss. Sept. 23, 2010); Drennon-Gala v. Holder, No. 1:08-CV0321G, 2011 WL 1225784, at *8 (N.D. Ga. Mar. 30, 2011); Mudd v. Army, 2007 WL 4358262, at *5 (finding no “disclosure” where, inter alia, agency had posted statement on its web site, newspapers had referred to letter, plaintiff had testified before Congress regarding letter, and the entire report had been released to the press and in a news conference by another agency); Smith v. Cont’l Assurance Co., No. 91-C-0963, 1991 WL 164348, at *5 (N.D. Ill. Aug. 22, 1991); King, 471 F. Supp. at 181; cf. Sierra Pac. Indus. v. USDA, No. 11-1250, 2012 WL 245973, at *4 (E.D. Cal. Jan. 25, 2012) (finding that Privacy Act did not require sealing documents where “substance of the information . . . [was] already in the public record in one form or another”). The Third, Ninth, Tenth, and D.C. Circuits, however, have held that the release of information that is “merely readily accessible to the public” does constitute a disclosure under subsection (b). See, e.g., Quinn v. Stone, 978 F.2d 126, 134 (3d Cir. 1992) (holding that “[t]o define disclosure so narrowly as to exclude information that is readily accessible to the public would render superfluous the detailed statutory scheme of twelve exceptions to the prohibition on disclosure”); see also Gowan v. Air Force, 148 F.3d 1182, 1193 (10th Cir. 1998) (“adopt[ing] the Third Circuit’s reasoning [in Quinn] and hold[ing] that an agency may not defend a release of Privacy Act information simply by stating that the information is a matter of public record”); Scarborough v. Harvey, 493 F. Supp. 2d 1, 15-16 n.29 (D.D.C. 2007) (agreeing with Quinn and concluding that “the unqualified language of the Privacy Act,” which protects individual’s “criminal . . . history,” does not exclude information that is readily accessible to public); cf. Wright v. FBI, 241 F. App’x 367, 369 (9th Cir. 2007) (noting that “issue of whether a Privacy Act claim can be based on a defendant’s disclosure of information previously disclosed to the public is a matter of first impression,” and directing district court to stay proceedings until plaintiff “obtains from the district court . . . an order defining the scope of his claims and, potentially, stating that court’s position on whether the Privacy Act applies to information previously disclosed to the public”); Pilon v. DOJ, 796 F. Supp. 7, 11-12 (D.D.C. 1992) (rejecting argument that information was already public and therefore could not violate Privacy Act where agency had republished statement that was previously publicly disavowed as false by agency). The D.C. Circuit’s opinions in Hollis and Pilon, both discussed above, provide some insight into its view of whether the release of information that is already available to the public constitutes a “disclosure” under the Privacy Act. In Hollis, issued in 1988, the D.C. Circuit had recognized in dictum that other courts had held that the release of previously published material did not constitute a disclosure, and suggested that it might take that approach. Hollis, 856 F.2d at 1545. The court had held that a disclosure did not violate the Privacy Act because the recipient of the information already was aware of it, but that “[o]ther courts have echoed the sentiment that when a release consists merely of information to which the general public already has access, or which the recipient of the release already knows, the Privacy Act is not violated.” However, the D.C. Circuit’s subsequent holding in 1996 in Pilon appears to foreclose such a possibility. In Pilon, the D.C. Circuit held that even under the narrow Hollis interpretation of “disclose,” the agency would not be entitled to summary judgment because it had “failed to adduce sufficient evidence that [the recipient of the record] remembered and could reconstruct the document’s material contents in detail at the time he received it.” 73 F.3d at 1124-26. Nevertheless, the D.C. Circuit in Pilon noted that “[t]his case does not present the question of whether an agency may . . . release a document that has already been fully aired in the public domain through the press or some other means” but that “the Privacy Act approves those disclosures that are ‘required’ under the [FOIA] . . . and that under various FOIA exemptions, prior publication is a factor to be considered in determining whether a document properly is to be released.” Id. at 1123 n.10; see also Barry v. DOJ, 63 F. Supp. 2d 25, 27-28 (D.D.C. 1999) (distinguishing Pilon and finding no disclosure where agency posted Inspector General report on Internet website, after report had already been fully released to media by Congress and had been discussed in public congressional hearing, even though some Internet users might encounter report for first time on website). Furthermore, though, and consistent with the D.C. Circuit’s note in Pilon, one might argue that to say that no “disclosure” occurs for previously published or public information is at least somewhat inconsistent with the Supreme Court’s decision in DOJ v. Reporters Comm. for Freedom of the Press, 489 U.S 749, 762-71 (1989), which held that a privacy interest can exist, under the FOIA, in publicly available – but “practically obscure” – information, such as a criminal history record. Cf. Finley v. NEA, 795 F. Supp. 1457, 1468 (C.D. Cal. 1992) (alleged disclosure of publicly available information states claim for relief under Privacy Act; recognizing Reporters Comm.). The United States Court of Appeals for the Fourth Circuit has issued contradictory unpublished decisions on the issue of whether release of publicly available information constitutes a disclosure. Compare Lee v. Dearment, 966 F.2d 1442 (4th Cir. 1992) (unpublished table case) (upholding district court’s determination that “the Act does not prohibit disclosure of information which is already open to the public, or if the receiver already knew of it” (citing Hollis v. Army, 856 F.2d at 1545)), and Dye, 642 F.2d at 836, with Doe v. Herman, No. 297CV00043, 1999 WL 1000212, at *11 (W.D. Va. Oct. 29, 1999) (magistrate’s recommendation) (agreeing with Quinn v. Stone, 798 F.2d at 134, in dictum and concluding that discussion of social security numbers at public hearing did not free agency to disclose those numbers), adopted in pertinent part & rev’d in other part (W.D. Va. July 24, 2000), aff’d in part, rev’d in part & remanded, on other grounds sub nom. Doe v. Chao, 306 F.3d 170 (4th Cir. 2002) (finding that plaintiff had not established “actual damages” from disclosure), aff’d, 540 U.S. 614 (2004). The Ninth Circuit has applied the “single publication rule,” in which the court limits aggregate, unauthorized disclosures to only one cause of action, where an agency disclosed records on an agency web page. On a related point, the Ninth Circuit held in a subsection (b) case that the “single publication rule” applies to postings on an agency’s web site such that “the aggregate communication can give rise to only one cause of action.” See Oja v. Army Corps of Eng’rs, 440 F.3d 1122, 1130-33 (9th Cir. 2006) (affirming summary judgment for Army Corps which had posted employees’ personal information on its public website). However, the court also ruled that with regard to “the same private information at a different URL address [within the same Web site] . . . that disclosure constitutes a separate and distinct publication – one not foreclosed by the single publication rule – and [the agency] might be liable for a separate violation of the Privacy Act.” Id. at 1133-34. A public filing of records with a court during the course of litigation constitutes a disclosure. The fact that “a court is not defined as an ‘agency’ or as a ‘person’ for purposes of [the Privacy Act],” (see Definitions, infra), indicates the Act was “not designed to interfere with access to information by the courts.” 120 Cong. Rec. 36,967 (1974), reprinted in Source Book at 958-59. Even so, the public filing of records with a court, during the course of litigation, does constitute a subsection (b) disclosure. See Laningham v. Navy, No. 83-3238, slip op. at 2-3 (D.D.C. Sept. 25, 1984), summary judgment granted (D.D.C. Jan. 7, 1985), aff’d per curiam, 813 F.2d 1236 (D.C. Cir. 1987); Citizens Bureau of Investigation v. FBI, No. 78-60, slip op. at 2-3 (N.D. Ohio Dec. 14, 1979). Accordingly, any such public filing must be undertaken with written consent or in accordance with either the subsection (b)(3) routine use exception or the subsection (b)(11) court order exception, both discussed below. See generally Krohn v. DOJ, No. 78-1536, slip op. at 3-11 (D.D.C. Mar. 19, 1984) (finding violation of Privacy Act where agency’s disclosure of records as attachments to affidavit in FOIA lawsuit “did not fall within any of the exceptions listed in Section 552a”), reconsideration granted & vacated in nonpertinent part (D.D.C. Nov. 29, 1984) (discussed below). The Privacy Act disclosure provision does not require heightened discovery requirements. Often during the course of litigation, an agency will be asked to produce Privacy Act-protected information pursuant to a discovery request by an opposing party. The Privacy Act “does not create a qualified discovery privilege” or “any other kind of privilege or bar that requires a party to show actual need as a prerequisite to invoking discovery,” and courts generally consider whether to allow discovery under “the usual discovery standards” of the Federal Rules of Civil Procedure.” Laxalt v. McClatchy, 809 F.2d 885, 888 (D.C. Cir. 1987); see also Weahkee v. Norton, 621 F.2d 1080, 1082 (10th Cir. 1980); Garraway v. Ciufo, No. 117CV00533DADGSAPC, 2020 WL 1263562, at *8 (E.D. Cal. Mar. 16, 2020); Pennsylvania v. Navient Corp., 348 F. Supp. 3d 394, 398 (M.D. Pa. 2018); Ala. & Gulf Coast Ry. v. United States, No. CA 10-0352, 2011 WL 1838882, at *3 (S.D. Ala. May 13, 2011); Golez v. Potter, No. 09-cv-965, 2011 WL 6002612, at *1-2 (S.D. Cal. Nov. 29, 2011) (“The exceptions allowed in the Privacy Act of 1974 are not applicable here. . . . Accordingly, the Privacy Act . . . precludes the [agency] from complying with Plaintiff’s discovery request.”); Forrest v. United States, No. 95-3889, 1996 WL 171539, at *2 (E.D. Pa. Apr. 11, 1996); Ford Motor Co. v. United States, 825 F. Supp. 1081, 1083 (Ct. Int’l Trade 1993); Clavir v. United States, 84 F.R.D. 612, 614 (S.D.N.Y. 1979); cf. Baldrige v. Shapiro, 455 U.S. 345, 360-62 (1982) (finding that Census Act confidentiality provisions create a privilege against disclosure of raw census data in discovery because they “embody explicit congressional intent to preclude all disclosure”). Agencies may affirmatively disclose Privacy Act-protected records during litigation, so long as the disclosure is made in accordance with the Privacy Act’s disclosure provision Although courts have unanimously held that the Privacy Act does not create a privilege against discovery, an agency can disclose Privacy Act-protected records if permitted by the Act. The most appropriate method of disclosure in this situation may be pursuant to a subsection (b)(11) court order. See generally Doe v. DiGenova, 779 F.2d 74 (D.C. Cir. 1985); Doe v. Stephens, 851 F.2d 1457 (D.C. Cir. 1988) (both discussed below under subsection (b)(11)). Indeed, the courts that have rejected the Privacy Act as a discovery privilege have referenced subsection (b)(11)’s allowance for court-ordered disclosures. See Laxalt, 809 F.2d at 888-89; Weahkee, 621 F.2d at 1082; Garraway v. Ciufo, No. 117CV00533DADGSAPC, 2020 WL 1263562, at *8 (E.D. Cal. Mar. 16, 2020) (records that might otherwise be protected by the Act may still be discovered through litigation if ordered by a court); Lightsey v. Potter, No. 1:04-CV-3110-ODE, 2006 WL 8431955 (N.D. Ga. July 27, 2006); Hernandez v. United States, No. 97-3367, 1998 WL 230200, at *2-3 (E.D. La. May 6, 1998); Forrest, 1996 WL 171539, at *2; Ford Motor Co., 825 F. Supp. at 1082-83; Clavir, 84 F.R.D. at 614; cf. Alford v. Todco, No. CIV-88-731E, slip op. at 4-5 (W.D.N.Y. June 12, 1990) (ordering production of records and concluding that “[e]ven assuming the Privacy Act supplies a statutory privilege . . . the plaintiff has waived any such privilege by placing his physical condition at issue”); Tootle v. Seaboard Coast Line R.R., 468 So. 2d 237, 239 (Fla. Dist. Ct. App. 1984) (recognizing that privacy interests in that case “must give way to the function of the discovery of facts” and that subsection (b)(11) provides the mechanism for disclosure). When an agency wishes to make an affirmative disclosure of information during litigation it may either rely on a routine use permitting such disclosure or seek a court order. Because the Privacy Act does not constitute a statutory privilege, agencies need not worry about breaching or waiving such a privilege when disclosing information pursuant to subsections (b)(3) or (b)(11). Cf. Mangino v. Army, No. 94-2067, 1994 WL 477260, at *5-6 (D. Kan. Aug. 24, 1994) (finding that disclosure to court was appropriate pursuant to agency routine use and stating that to extent Privacy Act created privilege, such privilege was waived by plaintiff when he placed his records at issue through litigation); Lemasters v. Thomson, No. 92 C 6158, 1993 U.S. Dist. LEXIS 7513, at *3-8 (N.D. Ill. June 3, 1993) (same finding as in Mangino, despite fact that “court ha[d] not located” applicable routine use). See also Vaughan v. Ky. Army Nat’l, No. 3:12-33, 2013 WL 1856418, at *4 (E.D. Ky. May 1, 2013) (finding that routine use disclosure to Department of Justice was appropriate for purposes of defending agency against claims pertaining to plaintiff’s records at issue in litigation). For further discussions of disclosures during litigation, see “Conditions of Disclosure to Third Parties,” subsections “5 U.S.C. § 552a(b)(3) - Routine Uses” and “5 U.S.C. § 552a(b)(11) - Court Order,” below. Agencies are not prohibited from disclosing to an individual his own record in response to a “first party” access request pursuant to the Privacy Act’s access provisions. By its own terms, subsection (b) does not prohibit an agency from releasing to an individual his own record, contained in a system of records retrieved by his name or personal identifier, in response to his “first-party” access request under subsection (d)(1). Cf. Weatherspoon v. Provincetowne Master Owners Ass’n, No. 08-cv-02754, 2010 WL 936109, at *3 (D. Colo. Mar. 15, 2010) (finding that even though records were maintained by Veterans Administration (“VA”), where plaintiff had been ordered in discovery to produce her mental health records in her emotional distress suit, there would be no improper disclosure to an ‘unauthorized party’ because “the VA will disclose Plaintiff’s mental health records to her, so that she can transmit copies of them to defense counsel”). However, as is discussed below under “Individual’s Right of Access,” the courts have split as to whether a disclosure occurs when the record is disclosed to the individual who is the subject of the record where the record is also about another individual and is “dually retrieved.” Subsection (b) also explicitly authorizes disclosures made with the prior written consent of the individual. See, e.g., Taylor v. Potter, No. 02-1552, 2004 WL 422664, at *1-2 (D. Del. Mar. 4, 2004) (finding it to be “clear from the documents attached to Plaintiff’s complaint that she provided prior written consent . . . for her medical records to be disclosed”); Scherer v. Hill, No. 02-2043, 2002 U.S. Dist. LEXIS 17872, at *6-8 (D. Kan. Sept. 17, 2002) (finding plaintiff’s argument that agency violated his privacy by sending photographs of his skin condition to United States Attorney rather than directly to him to be “frivolous,” as “[h]e specifically asked the ‘US Attorney and the Veterans Administration’ to produce the photographs” in his motion to compel, and “Privacy Act does not prohibit the consensual disclosure of photographs or documents by an agency”); cf. Stokes v. SSA, 292 F. Supp. 2d 178, 181 (D. Me. 2003);(finding that statement directed at subject of record “did not become the kind of ‘disclosure’ for which the Privacy Act requires written consent merely because [a third party] overheard it,” especially given that individual consented to interview in third party’s presence and thereby, in accordance with the agency regulation, “affirmatively authorized [third party’s] presence during this discussion”; “The Privacy Act does not prevent an agency employee from discussing the contents of a protected record with the person to whom the record pertains.”). Agencies cannot be held liable for disclosures that individuals make themselves. Additionally, although it may seem self-evident, the fact pattern in one case caused a court to explicitly hold that an agency cannot be sued for disclosures that an individual makes himself. Abernethy v. IRS, 909 F. Supp. 1562, 1571 (N.D. Ga. 1995) (describing that plaintiff had informed employees that he was being removed from his position as their supervisor and disclosed reason for his removal). While “written consent” under the Privacy Act is not defined, courts have held that “implied consent” is not sufficient. The Act does not define the “written consent” needed to permit disclosure under the Privacy Act. Implied consent, however, is insufficient. See Taylor v. Orr, No. 83-0389, 1983 U.S. Dist. LEXIS 20334, at *6 n.6 (D.D.C. Dec. 5, 1983) (addressing alternative argument, stating that: “Implied consent is never enough” as the Act’s protections “would be seriously eroded if plaintiff’s written submission of [someone’s] name were construed as a voluntary written consent to the disclosure of her [medical] records to him”); cf. Milton v. DOJ, 783 F. Supp. 2d 55, 59 (D.D.C. 2011) (rejecting, in context of Freedom of Information Act claim, plaintiff’s argument that his privacy waiver to permit BOP to monitor his telephone calls impliedly extended to any party who accepted his calls; “[A] protected privacy interest can be waived only by the person whose interest is affected, . . . and [plaintiff] has not produced Privacy Act waivers from the individuals with whom he spoke on the telephone.”); Baitey v. VA, No. 8:CV89-706, slip op. at 5 (D. Neb. June 21, 1995) (concluding that “at a minimum, the phrase ‘written consent’ necessarily requires either (1) a medical authorization signed by [plaintiff] or (2) conduct which, coupled with the unsigned authorization, supplied the necessary written consent for the disclosure”). But cf. Pellerin v. VA, 790 F.2d 1553, 1556 (11th Cir. 1986) (applying doctrine of “equitable estoppel” to bar individual from complaining of disclosure of his record to congressmen “when he requested their assistance in gathering such information”) (distinguished in Swenson v. USPS, 890 F.2d 1075, 1077-78 (9th Cir. 1989)); Del Fuoco v. O’Neill, No. 8:09-CV-1262, 2011 WL 601645, at *10 (M.D. Fla. Feb. 11, 2011) (Where regulation mandated that DOJ furnish plaintiff’s termination letter to MSPB, noting that it was plaintiff’s appeal to MSPB that triggered the disclosure, “which did not require Plaintiff’s consent, which is implied by virtue of his appeal.”); Jones v. Army Air Force Exchange Serv. (AAFES), No. 3:00-CV-0535, 2002 WL 32359949, at *5 (N.D. Tex. Oct. 17, 2002) (referring to plaintiff’s claim that AAFES disclosed protected information to congressional offices in violation of Privacy Act, and finding plaintiff to be “estopped from asserting such a claim because AAFES released the information pursuant to congressional office inquiries that were initiated at Plaintiff’s request”). OMB guidelines suggest, and courts have generally approved of, written consent that states the general purposes for, or types of recipients to, which disclosures may be made; the scope of an agency’s permitted disclosures is then defined by the terms on which the individual provided written consent. The OMB 1975 Guidelines caution that “the consent provision was not intended to permit a blanket or open-ended consent clause, i.e., one which would permit the agency to disclose a record without limit,” and that, “[a]t a minimum, the consent clause should state the general purposes for, or types of recipients [to,] which disclosure may be made.” 40 Fed. Reg. at 28,954,. See also Perry v. FBI, 759 F.2d 1271, 1276 (7th Cir. 1985) (upholding disclosure because release was “not so vague or general that it is questionable whether [plaintiff] knew what he was authorizing or whether the [agency] knew what documents it could lawfully release”), rev’d en banc on other grounds, 781 F.2d 1294 (7th Cir. 1986). Courts generally have approved disclosures made with consent where the consent was broad enough to cover the disclosure. See Elnashar v. DOJ, 446 F.3d 792, 795 (8th Cir. 2006) (observing that plaintiff’s signed release “authoriz[ing] representatives of [human rights organization] to obtain and examine copies of all documents and records contained by the [FBI] . . . pertaining to [plaintiff]” constituted consent for FBI to disclose “that it had records which were responsive to the request for records and that records were contained in the ‘PENTBOMB’ investigation”); United States v. Rogers, No. 10-00088, 2010 WL 5441935, at *1 (S.D. Ala. Dec. 28, 2010) (concluding that “if defendant is willing to make a written request to the BOP for his own records and give written consent for their release to his defense counsel, the Court sees no reason why a[] [court] order is necessary”); Roberts v. DOT, No. 02-CV-4414, 2006 WL 842401, at *8, *2 (E.D.N.Y. Mar. 28, 2006) (maintaining that plaintiff’s signed SF 171, which “explicitly stated that [plaintiff] ‘consent[ed] to the release of information about [his] ability and fitness for Federal employment,’” authorized disclosure of plaintiff’s medical records by agency who previously employed him to employing agency to assist in “assist determining whether the employee is capable of performing the duties of the new position”); Thomas v. VA, 467 F. Supp. 458, 460 n.4 (D. Conn. 1979) (holding consent was adequate because it was both agency- and record-specific); cf. Tarullo v. Def. Contract Audit Agency, 600 F. Supp. 2d 352, 360-61 (D. Conn. 2009) (concluding that “the forms themselves put the Plaintiff on notice that they (and hence their contents) would be disclosed . . . . Yet, the Plaintiff supplied his SSN. As a result, he voluntarily disclosed his SSN.”); Wiley v. VA, 176 F. Supp. 2d 747, 751-56 (E.D. Mich. 2001) (concluding that plaintiff’s written release for employment application that broadly authorized employer to corroborate and obtain information about plaintiff’s background constituted valid consent under Privacy Act to authorize disclosure of all 466 pages of plaintiff’s VA claims file in connection with union grievance proceeding, even though release was signed eight years prior to disclosure”). On the other hand, courts have found consent clauses with narrower terms than the eventual disclosure to be inadequate to authorize that disclosure. See Schmidt v. Air Force, No. 06-3069, 2007 WL 2812148, at *8 (C.D. Ill. Sept. 30, 2007) (issuance of press release and posting of complete text of plaintiff’s reprimand on agency website was outside scope of plaintiff’s signed waiver, which was limited to “a press release announcing the conclusion of the case”); Fattahi v. ATF, 186 F. Supp. 2d 656, 660 (E.D. Va. 2002) (consent providing that information on application “may be disclosed to members of the public in order to verify the information on the application when such disclosure is not prohibited by law” was “a mere tautology: plaintiff consented to no more than that ATF may disclose information except in cases where that disclosure is prohibited”); Doe v. Herman, No. 297CV00043, 1999 WL 1000212, at *9 (W.D. Va. Oct. 29, 1999) (magistrate’s recommendation) (rejecting argument that when plaintiffs provided their social security numbers for purpose of determining eligibility for and amount of benefits payable, they consented to use of those numbers as identifiers on multi-captioned hearing notices sent to numerous other individuals and companies as well as to publication of numbers in compilations of opinions), adopted in pertinent part & rev’d in other part, (W.D. Va. July 24, 2000), aff’d in part, rev’d in part & remanded, on other grounds sub nom. Doe v. Chao, 306 F.3d 170 (4th Cir. 2002), aff’d, 540 U.S. 614 (2004); AFGE v. U.S. R.R. Ret. Bd., 742 F. Supp. 450, 457 (N.D. Ill. 1990) (SF-86 “release form” held overbroad and contrary to subsection (b)); and Doe v. GSA, 544 F. Supp. 530, 539-41 (D. Md. 1982) (stating that authorization, which was neither record- nor entity-specific, was insufficient under GSA’s own internal interpretation of Privacy Act); cf. Taylor, No. 83-0389, 1983 U.S. Dist. LEXIS 20334, at *6 n.6 (D.D.C. Dec. 5, 1983) (addressing alternative argument, stating: “It is not unreasonable to require that a written consent to disclosure address the issue of such disclosure and refer specifically to the records permitted to be disclosed.”). One California district court has held that courts cannot create new disclosure exceptions based on state policy. One district court has declined to “recognize a new exception to [subsection (b) of the Privacy Act] based on California public policy to protect persons investigating acts of child abuse.” Stafford v. SSA, 437 F. Supp. 2d 1113, 1121 (N.D. Cal. 2006). In Stafford, a Social Security Administration (“SSA”) employee disclosed to California Child Protective Services “the precise diagnosis of mental illness on which the SSA had made its determination that [the suspected child abuser] was disabled and thus eligible for benefits.” Id. at 1116. The suspect brought a subsection (b)/(g)(1)(D) claim against the agency, and the agency argued that the court should recognize a new exception because “[t]he public interest in detecting and eradicating child abuse is so strong that under California state law, malicious acts or acts taken without probable cause by investigators such as [the Child Protective Services employee] are immunized.” Id. at 1121. The court explained that “Congress enacted the Privacy Act as a limitation on the sharing of private information among government agencies to further what it determined was an important public policy” and stated that “[t]he Court cannot create an exception to a federal statute based on state policy.” Id.
B. Twelve Exceptions to the “No Disclosure without Consent” RuleAs discussed in detail above, the general rule under the Privacy Act is that, without an individual’s written consent, records about that individual maintained in a system of records cannot be disclosed. There are, however, a number of exceptions to that general rule, or conditions under which information can be disclosed without consent. Of the twelve exceptions discussed in this section, the most significant and frequently litigated exceptions are the “need to know” exception, disclosures required under FOIA, and the “routine use” exception. The twelve exceptions are discussed here in turn. Other than disclosures under subsection (b)(2) of the Privacy Act (see “Conditions of Disclosure to Third Parties, 5 U.S.C. § 552a(b)(2) - Required FOIA Disclosure” discussion, below), disclosures under the following exceptions are permissive, not mandatory. See OMB 1975 Guidelines, 40 Fed. Reg. at 28,953,
|