Overview of the Privacy Act of 1974

1. 5 U.S.C. § 552a(b)(1) ("need to know" within agency)

“to those officers and employees of the agency which maintains the record who have a need for the record in the performance of their duties.”

Comment:

This “need to know” exception authorizes the intra-agency disclosure of a record for necessary, official purposes.  See OMB Guidelines, 40 Fed. Reg. 28,948, 28,950-01, 28,954 (July 9, 1975), available at http://www.whitehouse.gov/sites/default/files/omb/assets/omb/inforeg/implementation_guidelines.pdf.  The Privacy Act’s legislative history indicates an intent that the term “agency” be given “its broadest statutory meaning,” and it recognizes the propriety of “need to know” disclosures between various components of large agencies.  See 120 Cong. Rec. 36,967 (1974), reprinted in Source Book at 958, available at http://www.loc.gov/rr/frd/Military_Law/pdf/LH_privacy_act-1974.pdf (recognizing propriety of “need to know” disclosures between Justice Department components); see also Sussman v. Marshals Serv., 808 F. Supp. 2d 192, 196-204 (D.D.C. 2011) (extensively analyzing disclosure between USMS and FBI under subsection (b)(1); recognizing that “[a]lthough the USMS and FBI may themselves be considered agencies, they are also components of DOJ, which is itself an agency,” and that disclosures “qualif[ied] as intra-agency disclosures” and were permitted under (b)(1)); Lora v. DOJ, No. 00-3072, slip op. at 14-15 (D.D.C. Apr. 9, 2004) (citing subsection (b)(1) and legislative history, and finding plaintiff’s argument that Privacy Act violation occurred when INS, then component of DOJ, released documents to prosecutor to be without merit); Walker v. Ashcroft, No. 99-2385, slip op. at 18-20 & n.6 (D.D.C. Apr. 30, 2001) (alternative holding) (finding that disclosures from FBI field office to FBI Headquarters and then to DOJ prosecutors were “proper under the ‘need to know’ exception”; “FBI employees and federal prosecutors are considered employees of the same agency, namely the Department of Justice.”), summary affirmance granted, No. 01-5222, 2002 U.S. App. LEXIS 2485, at *2 (D.C. Cir. Jan. 25, 2002); cf. Sutera v. TSA, 708 F. Supp. 2d 304, 318 (E.D.N.Y. 2010) (where agency sent plaintiff’s urine sample to private lab, stating that “[f]or testing purposes a private laboratory is necessarily treated as part of the agency”); Freeman v. EPA, No. 02-0387, 2004 WL 2451409, at *4-5 (D.D.C. Oct. 25, 2004) (finding that disclosure of plaintiffs’ drug testing schedules and results by EPA OIG to an EPA-hired DOD investigator did not violate Act because “according to the OMB Guidelines, an agency that hires a member of another agency to serve in a temporary task force or similar, cross-designated function can share otherwise protected information with that hired person and still satisfy exception (b)(1)”).

Intra-agency disclosures for improper purposes will not be condoned.  See, e.g., Parks v. IRS, 618 F.2d 677, 680-81 & n.1 (10th Cir. 1980) (publication of names of employees who did not purchase savings bonds, “for solicitation purposes,” held improper); Carlson v. GSA, No. 04-C-7937, 2006 WL 3409150, at *3-4 (N.D. Ill. Nov. 21, 2006) (explaining that a supervisor’s e-mail to employees that explained the reasons for plaintiff’s termination does not fall within need to know exception because supervisor “encouraged [employees] to share [the e-mail] without restriction” and because supervisor “express[ed] his personal satisfaction with [employee’s] termination” in e-mail); MacDonald v. VA, No. 87-544-CIV-T-15A, slip op. at 8-9 (M.D. Fla. July 28, 1989) (holding disclosure of counseling memorandum in “callous attempt to discredit and injure” employee is improper); Koch v. United States, No. 78-273T, slip op. at 1-2 (W.D. Wash. Dec. 30, 1982) (holding the letter of termination posted in agency’s entrance hallway is improper); Smigelsky v. USPS, No. 79-110-RE, slip op. at 3-4 (D. Or. Oct. 1, 1982) (holding that publication of employees’ reasons for taking sick leave is improper); Fitzpatrick v. IRS, 1 Gov’t Disclosure Serv. (P-H) ¶ 80,232, at 80,580 (N.D. Ga. Aug. 22, 1980) (holding disclosure of fact that employee’s absence was due to “mental problems” is improper; “quelling rumors and gossip [and] satisfying curiosity is not to be equated with a need to know”), aff’d in part, vacated & remanded in part, on other grounds, 665 F.2d 327 (11th Cir. 1982); see also Walia v. Napolitano, 986 F. Supp. 2d 169, 187 (E.D.N.Y. 2013) (denying government’s motion to dismiss by finding that plaintiff “adequately allege[d] that the disclosure regarding his EEO complaint was not on a ‘need to know’ basis for the employees to perform their duties”); Bigelow v. DOD, 217 F.3d 875, 879 (D.C. Cir. 2000) (Tatel, J., dissenting) (interpreting DOD regulations to find that supervisor did not have official need to review personnel security file of individual he supervised); Boyd v. Snow, 335 F. Supp. 2d 28, 38-39 (D.D.C. 2004) (explaining that where there are “serious questions” as to whether plaintiff’s rebuttal statement to her performance evaluation was disclosed to certain personnel in plaintiff’s office pursuant to a “need to know,” agency will not prevail on summary judgment); Vargas v. Reno, No. 99-2725, slip op. at 3, 12-13 (W.D. Tenn. Mar. 31, 2000) (denying summary judgment where no evidence was submitted to show that information about plaintiff that was disclosed to Inspector General agent in course of investigating another employee was disclosed based on agent’s “need to know”); cf. Berry v. Henderson, No. 99-283-P-C, 2000 WL 761896, at *1, 3 (D. Me. May 8, 2000) (finding that agency’s examination of personnel and medical records within its possession in connection with its defense in Title VII case did not satisfy subsection (b)(1) and constituted violation of Privacy Act, despite fact that agency did not contend that disclosure was proper under subsection (b)(1)).

The cases are replete with examples of proper intra-agency “need to know” disclosures.  See, e.g., Coburn v. Potter, 329 F. App’x 644, 645 (7th Cir. 2009) (“It is enough that the persons to whom disclosure is made are employees of the agency that maintains the records and that those employees have a need for access; disclosure under this subsection is not limited to the employees responsible for maintaining the records.”); Marquez v. Johnson, No. 11-cv-545, 2012 WL 6618238, at *11 (D. Colo. Dec. 19, 2012) (finding that disclosure by plaintiff’s supervisor to staff that plaintiff was out on leave due to a “cancer scare” was based on their need for the information in the performance of their duties), aff’d, 545 Fed. App’x 735 (10th Cir. 2013) (“[Plaintiff] did not allege [that leave information] was revealed to the entire staff . . . . Nor does [plaintiff] dispute [agency’s] position that the disclosure was necessary to an investigator regarding [plaintiff’s] claim for medical and therapy expenses.”); Bigelow v. DOD, 217 F.3d 875, 876-78 (D.C. Cir. 2000) (describing the review of plaintiff’s personnel file by immediate supervisor in connection with supervisor’s “continuing duty to make sure that [plaintiff] was worthy of trust” because of “a need to examine the file in view of the doubts that had been raised in his mind about [plaintiff] and [plaintiff’s] access to the country’s top secrets”); Lennon v. Rubin, 166 F.3d 6, 10 (1st Cir. 1999) (citing subsection (b)(1) and finding that district court correctly granted summary judgment to defendant where, despite memorandum indicating intent to distribute information to task force that included individuals from outside agency, agency employee testified that she actually gave information only to member who was agency employee and recipient employee declared that she had never given information to other task force members); Hudson v. Reno, 130 F.3d 1193, 1206-07 (6th Cir. 1997) (discussing disclosure of plaintiff’s performance evaluation to individual who typed it originally, for retyping); Pippinger v. Rubin, 129 F.3d 519, 529-31 (10th Cir. 1997) (discussing disclosure of identity of investigation’s subject by supervisor investigating allegations of employee misconduct to staff members to assist in investigation, and disclosure to agency attorney charged with defending agency’s actions in related MSPB proceeding against another individual); Mount v. USPS, 79 F.3d 531, 533-34 (6th Cir. 1996) (discussing disclosure of information in plaintiff’s medical records to other employees “with responsibilities for making employment and/or disciplinary decisions regarding plaintiff”; “In light of the questions surrounding plaintiff’s mental stability, each had at least an arguable need to access the information in plaintiff’s medical records.”); Britt v. Naval Investigative Serv., 886 F.2d 544, 549 n.2 (3d Cir. 1989) (discussing disclosure of investigative report to commanding officer approved “since the Reserves might need to reevaluate Britt’s access to sensitive information or the level of responsibility he was accorded”); Covert v. Harrington, 876 F.2d 751, 753-54 (9th Cir. 1989) (discussing disclosure of security questionnaires to Inspector General for purpose of detecting fraud); Daly-Murphy v. Winston, 837 F.2d 348, 354-55 (9th Cir. 1988) (discussing disclosure of letter suspending doctor’s clinical privileges to participants in peer-review proceeding); Lukos v. IRS, No. 86-1100, 1987 WL 36354, at *1-2 (6th Cir. Feb. 12, 1987) (discussing disclosure of employee’s arrest record to supervisor for purpose of evaluating his conduct and to effect discipline); Howard v. Marsh, 785 F.2d 645, 647-49 (8th Cir. 1986) (discussing disclosure of employee’s personnel records to agency attorney and personnel specialist for purpose of preparing response to discrimination complaint); Hernandez v. Alexander, 671 F.2d 402, 410 (10th Cir. 1982) (discussing disclosure of employee’s EEO files to personnel advisors for purpose of determining whether personnel action should be taken against employee); Grogan v. IRS, 3 Gov’t Disclosure Serv. (P-H) ¶ 82,385, at 82,977-78 (4th Cir. Mar. 22, 1982) (discussing disclosure of questionable income tax returns prepared by professional tax preparer while he was IRS employee to IRS examiners for purpose of alerting them to possible irregularities); Beller v. Middendorf, 632 F.2d 788, 798 n.6 (9th Cir. 1980) (discussing disclosure of record revealing serviceman’s homosexuality by Naval Investigative Service to commanding officer for purpose of reporting “a ground for discharging someone under his command”); Middlebrooks v. Mabus, No. 1:11cv46, 2011 WL 4478686, at *6-7 (E.D. Va. Sept. 23, 2011) (discussing disclosure to “small group of senior employees” who were “required ‘to perform their job of legal oversight for the agency’” and “determine proper compliance with disclosure regulations”); Drennon-Gala v. Holder, No. 1:08-CV-321G, 2011 WL 1225784, at *5 (N.D. Ga. Mar. 30, 2011) (discussing disclosure of plaintiff’s workers compensation file to agency officials investigating allegations “directly related to misconduct involving [plaintiff’s] worker’s compensation claim”); Sutera, 708 F. Supp. 2d at 318 (referring to plaintiff’s assertion that agency’s “statement that he had failed a drug test violated the Privacy Act” (although he had failed to specify to whom the statement was made), recognizing that “[TSA Disciplinary Review Board] officials, the Medical Review Officer, and the deciding official are all agency employees responsible for making employment decisions regarding plaintiff” and “[t]heir communications are within the Privacy Act’s ‘need-to-know’ exception”); Doe v. DOJ, 660 F. Supp. 2d 31, 45-46 (D.D.C. 2009) (discussing disclosure of plaintiff AUSA’s mental state to DOJ security personnel, who “needed . . . to assess his trustworthiness and make related personnel decisions about his eligibility for security clearance,” to acting U.S. Attorney and division chief, who “[a]s plaintiff’s supervisors . . . were responsible for ensuring that the [office] was operating safely,” and to an EOUSA attorney, who was “entitled to access the records because he represented DOJ in various pending disciplinary matters against plaintiff at the time” (internal quotation marks omitted)); Gamble v. Army, 567 F. Supp. 2d 150, 156 (D.D.C. 2008) (discussing disclosure to plaintiff’s commanding officer of past allegations of sexual misconduct by plaintiff in the context of investigation of new allegations of same); Shayesteh v. Raty, No. 02:05-CV-85TC, 2007 WL 2317435, at *4-5 (D. Utah Aug. 7, 2007) (discussing disclosure for purpose of “pursu[ing] forfeiture of funds . . . [is] a task clearly within [employees’] duties as federal law enforcement officers”); Thompson v. State, 400 F. Supp. 2d 1, 20 (D.D.C. 2005) (discussing disclosure of investigative report to agency’s Office of Civil Rights to determine “whether plaintiff’s supervisor was promoting plaintiff’s career to the detriment of the office and other employees because of a romantic relationship” was “relevant to the agency’s compliance with EEO regulations”); Roberts v. DOJ, 366 F. Supp. 2d 13, 26-28 (D.D.C. 2005) (discussing disclosure of results of investigation by OPR to FBI was “entirely appropriate” because FBI referred matter to OPR for investigation and because FBI had duty to respond to plaintiff, who had requested that FBI look into matter; dismissing claim because “OPR was entitled to share information regarding the results of its investigation” with agency that was the subject of its investigation); Lucas v. SBA, No. 03-2617, 2005 WL 613574, at *1 (D.D.C. Mar. 16, 2005) (discussing disclosure of plaintiff’s personnel file to employee outside plaintiff’s chain of command “in the course of an internal investigation of a third party’s complaint” was appropriate under “need to know” exception); Buckles v. Indian Health Serv., 305 F. Supp. 2d 1108, 1111 (D.N.D. 2004) (discussing disclosure of employees’ medical records by employer’s health facility to risk management team – due to concerns that employees were illegally receiving prescription drugs – was proper because it conformed with facility’s protocol to discuss issues of potential wrongdoing with upper management); McCready v. Principi, 297 F. Supp. 2d 178, 197 n.11 (D.D.C. 2003) (finding that “limited distribution of [a memorandum concerning plaintiff] to those [within the agency] with a legitimate need to know did not violate [plaintiff’s] rights under the Privacy Act”), aff’d in part, rev’d in part, & remanded in part, all on other grounds sub nom. McCready v. Nicholson, 465 F.3d 1 (D.C. Cir. 2006); Schmidt v. VA, 218 F.R.D. 619, 631 (E.D. Wis. 2003) (“VA personnel need to have access to the entire [social security number] of persons accessible through the [Computerized Patient Records System] to avoid misidentification.”); Hanna v. Herman, 121 F. Supp. 2d 113, 123-24 (D.D.C. 2000) (discussing disclosure of information by agency official about plaintiff’s demotion to another supervisor was covered by “need to know” exception even though that supervisor was not within same office), summary affirmance granted sub nom. Hanna v. Chao, No. 00-5433 (D.C. Cir. Apr. 11, 2001); Khalfani v. VA, No. 94-CV-5720, 1999 WL 138247, at *7-8 (E.D.N.Y. Mar. 10, 1999) (discussing disclosure of plaintiff’s medical records within VA so that his supervisor could document his request for medical leave and determine level of work he could perform), appeal dismissed for appellant’s failure to comply with scheduling order, No. 99-6157 (2d Cir. Oct. 10, 2000); Blazy v. Tenet, 979 F. Supp. 10, 26 (D.D.C. 1997) (discussing disclosure of status of plaintiff’s security investigation to his supervisor and disclosure of records needed by members of Employee Review Panel responsible for assessing plaintiff’s employment performance and prospects), summary affirmance granted, No. 97-5330, 1998 WL 315583 (D.C. Cir. May 12, 1998); Porter v. USPS, No. CV595-30, slip op. at 23-24 (S.D. Ga. July 24, 1997) (discussing disclosure of employee’s medical records to supervisory personnel in order to “figure out exactly what level of duty [employee] was fit and able to perform”), aff’d, 166 F.3d 352 (11th Cir. 1998) (unpublished table decision); Jones v. Air Force, 947 F. Supp. 1507, 1515-16 (D. Colo. 1996) (discussing Air Force investigator’s review of plaintiff’s medical and mental health records and publication of statements about the records in report of investigation compiled in preparation for plaintiff’s court-martial, which was distributed to certain Air Force personnel); Viotti v. Air Force, 902 F. Supp. 1331, 1337 (D. Colo. 1995) (discussing disclosure by general to academic department staff that he was removing acting head of department because he had lost confidence in his leadership and subsequent disclosure by new head of department to department staff of same information regarding removal of prior department head), aff’d, 153 F.3d 730 (10th Cir. 1998) (unpublished table decision); Abernethy v. IRS, 909 F. Supp. 1562, 1570-71 (N.D. Ga. 1995) (“[Investigatory] panel’s review of Plaintiff’s performance appraisals was not a violation of the Privacy Act because the members had a need to know the contents of the appraisals[.]”; finding that member of the panel that recommended that plaintiff be removed from management in response to an EEO informal class complaint “had a need to know the contents of the [EEO] complaint file”), aff’d per curiam, No. 95-9489 (11th Cir. Feb. 13, 1997); Magee v. USPS, 903 F. Supp. 1022, 1029 (W.D. La. 1995) (discussing disclosure of employee’s medical report following fitness-for-duty examination to Postmaster of Post Office where employee worked to determine whether employee could perform essential functions of job and to Postmaster’s supervisor who was to review Postmaster’s decision), aff’d, 79 F.3d 1145 (5th Cir. 1996) (unpublished table decision); McNeill v. IRS, No. 93-2204, 1995 U.S. Dist. LEXIS 2372, at *8 (D.D.C. Feb. 7, 1995) (discussing disclosures made to Treasury Department’s Equal Employment Opportunity (EEO) personnel in course of their investigation of EEO allegations initiated by plaintiff); Harry v. USPS, 867 F. Supp. 1199, 1206 (M.D. Pa. 1994) (discussing disclosure from one internal subdivision of Postal Service to another – the Inspection Service (Inspector General) – which was conducting an investigation), aff’d sub nom. Harry v. USPS, 60 F.3d 815 (3d Cir. 1995) (unpublished table decision); Hass v. Air Force, 848 F. Supp. 926, 932 (D. Kan. 1994) (discussing disclosure of mental health evaluation to officers who ultimately made decision to revoke plaintiff’s security clearance and discharge her); Lachenmyer v. Frank, No. 88-2414, slip op. at 3-4 (C.D. Ill. July 16, 1990) (discussing disclosure of investigative report, referencing employee’s admission that he had been treated for alcohol abuse, to supervisor); Williams v. Reilly, 743 F. Supp. 168, 175 (S.D.N.Y. 1990) (discussing admission of drug use disclosed by the Naval Investigative Service to plaintiff’s employer, the Defense Logistics Agency); Bengle v. Reilly, No. 88-587, 1990 U.S. Dist. LEXIS 2006, at *21 (D.D.C. Feb. 28, 1990) (discussing disclosure to personnel consulted by employee’s supervisors in order to address employee’s complaints); Glass v. Energy, No. 87-2205, 1988 WL 118408, at *1 (D.D.C. Oct. 29, 1988) (discussing disclosure to “officials or counsel for the agency for use in the exercise of their responsibility for management of the agency or for defense of litigation initiated by plaintiff”); Krowitz v. USDA, 641 F. Supp. 1536, 1545-46 (W.D. Mich. 1986) (discussing details of employee’s performance status disclosed to other personnel who were assigned to assist plaintiff), aff’d, 826 F.2d 1063 (6th Cir. 1987) (unpublished table decision); Marcotte v. Sec’y of Def., 618 F. Supp. 756, 763 (D. Kan. 1985) (discussing disclosure of “talking paper” chronicling officer’s attempts to correct effectiveness ratings to Inspector General for purpose of responding to officer’s challenge to “staff advisories”); Nutter v. VA, No. 84-2392, slip op. at 8-9 (D.D.C. July 9, 1985) (discussing disclosure of record reflecting employee’s impending indictment to personnel responsible for responding to public and press inquiries); Brooks v. Grinstead, 3 Gov’t Disclosure Serv. (P-H) ¶ 83,054, at 83,551-53 (E.D. Pa. Dec. 12, 1982) (discussing disclosure of employee’s security file to supervisor for purpose of ascertaining employee’s trustworthiness); Carin v. United States, 1 Gov’t Disclosure Serv. (P-H) ¶ 80,193, at 80,492 & n.1 (D.D.C. Aug. 5, 1980) (discussing disclosure of employee’s EEO complaint to other employees during grievance process); Lydia R. v. Army, No. 78-069, slip op. at 3-6 (D.S.C. Feb. 28, 1979) (discussing disclosure of derogatory information from employee’s file to officer for purpose of determining appropriateness of assigning employee to particular position); cf. Cacho v. Chertoff, No. 06-00292, 2006 WL 3422548, *4-7 (D.D.C. Nov. 28, 2006) (finding plaintiff’s argument alleging improper access of information irrelevant to (b)(1) analysis; “What matters then is the ‘need to know’ of the agency official who received the disclosure, not the authority of the agency official who made the disclosure.”); Gill v. DOD, 92 M.S.P.R. 23, 31-32 (2002) (finding that agency failed to establish that appellant’s disclosure to EEO counselor of other employees’ records was unauthorized, as disclosure appeared to fall within (b)(1) exception, where appellant provided records at request of EEO counselor in support of appellant’s claim that she was disparately treated).

Although subsection (b)(1) permits disclosure only to “those officers and employees of the agency which maintains the record,” some courts have upheld disclosures to contractors who serve the function of agency employees.  See Mount v. USPS, 79 F.3d 531, 532-34 (6th Cir. 1996) (concluding disclosure of plaintiff’s medical files to “a physician under contract with the USPS” who had “responsibilities for making employment and/or disciplinary decisions regarding plaintiff” had some basis in the need to know exception); Gard v. Dep’t of Educ., 789 F. Supp. 2d 96, 110 (D.D.C. 2011) (finding a permissible intra-agency disclosure where information was disclosed to an “‘occupational medicine consultant’ under contract with” the Department of Education for purposes of evaluating employee’s risk to coworkers); Ciralsky v. CIA, 689 F. Supp. 2d 141, 155 (D.D.C. 2010) (holding that disclosures to private contractors hired to investigate certain allegations, including plaintiff’s, were permissible intra-agency disclosures); Sutera, 708 F. Supp. 2d at 318 (finding an intra-agency disclosure where a medical sample was sent to an outside laboratory because “[f]or testing purposes a private laboratory is necessarily treated as part of the agency”); Coakley v. DOT, No. 93-1420, 1994 U.S. Dist. LEXIS 21402, at *3-4 (D.D.C. Apr. 7, 1994) (holding that an EEO investigator who was an independent contractor “must be considered an employee of DOT for Privacy Act purposes” and that the disclosure of information by a former DOT employee to that contractor, “[g]iven that the disclosure in question occurred in connection with an official agency investigation . . . must be considered an intra-agency communication under the Act”); Hulett v. Navy, No. TH 85-310-C, slip op. at 3-4 (S.D. Ind. Oct. 26, 1987) (discussing disclosure of medical and personnel records to contractor/psychiatrist for purpose of assisting him in performing “fitness for duty” examination), aff’d, 866 F.2d 432 (7th Cir. 1988) (unpublished table decision); cf. Gill v. DOD, 92 M.S.P.R. at 32 n.7 (finding that, in a case before the MSPB, where the agency was in the unusual position of having to establish a violation of the Privacy Act in order to defend its disciplinary action against plaintiff for wrongful disclosure, the record indicated that the EEO counselor to whom the disclosure was made “was employed by a contractor, rather than directly by the agency . . . the EEO counselor was performing an administrative function for which the agency was responsible, and the agency ha[d] not argued nor established that the EEO counselor was not an officer or employee of the agency for the purposes of 5 U.S.C. § 552a(b)(1),” and stating further that “[i]t is clear that, for particular purposes, the Privacy Act provides that any government contractor and any employee of such contractor shall be considered an employee of an agency” (citing 5 U.S.C. § 552a(m))).  Another court, however, has held to the contrary on facts nearly identical to those in Hulett.  Taylor v. Orr, No. 83-0389, 1983 U.S. Dist. LEXIS 20334, at *7-10 (D.D.C. Dec. 5, 1983); cf. Appendix I to OMB Circular No. A-130 – Federal Agency Responsibilities for Maintaining Records About Individuals, 61 Fed. Reg. 6428, 6439 (Feb. 20, 1996), as amended, 65 Fed. Reg. 77,677 (Dec. 12, 2000), available at http://www.whitehouse.gov/omb
/circulars_a130_a130appendix_i (directing agencies that provide by contract for the operation of a system of records to “review the [system] notice to ensure that it contains a routine use . . . permitting disclosure to the contractor and his or her personnel”).  See generally OMB Guidelines, 40 Fed. Reg. at 28,954, available at http://www.whitehouse.gov/sites/default/files/omb/assets/omb/inforeg/implementation_guidelines.pdf (noting that “movement of records between personnel of different agencies may in some instances be viewed as intra-agency disclosures if that movement is in connection with an inter-agency support agreement”).

2. 5 U.S.C. § 552a(b)(2) (required FOIA disclosure)

“required under section 552 of this title.”

Comment:

The point of this exception is that the Privacy Act never prohibits a disclosure that the Freedom of Information Act actually requires.  See News-Press v. DHS, 489 F.3d 1173, 1189 (11th Cir. 2007) (“The net effect of the interaction between the two statutes is that where the FOIA requires disclosure, the Privacy Act will not stand in its way, but where the FOIA would permit withholding under an exemption, the Privacy Act makes such withholding mandatory upon the agency.”); Greentree v. U.S. Customs Serv., 674 F.2d 74, 79 (D.C. Cir. 1982) (stating subsection (b)(2) “represents a Congressional mandate that the Privacy Act not be used as a barrier to FOIA access”).  See also Sikes v. United States, 987 F. Supp. 2d 1355, 1372 n. 14 (S.D. Ga. 2013) (finding that because the FOIA required disclosure of list of names of individuals invited to a ceremony at which a Navy officer was sworn in as Chief of Naval Operations, the Privacy Act did not bar disclosure); Woods v. DOJ, 968 F. Supp. 2d 115, 120-21 (D.D.C. 2013) (reviewing subsection (b)(2) and finding that “defendant properly considered plaintiff’s request in light of the FOIA, [and thus] any issue arising under the Privacy Act is essentially moot”); Plunkett v.  DOJ, 924 F. Supp. 2d 289, 306-07 (D.D.C. 2013) (“[T]he Privacy Act does not bar disclosure of documents that are otherwise required to be disclosed under the FOIA . . . and defendant properly reviewed and released responsive records under the FOIA”).

Thus, if an agency is in receipt of a FOIA request for information about an individual that is contained in a system of records and that is not properly withholdable under any FOIA exemption, then it follows that the agency is “required under Section 552 of this title” to disclose the information to the FOIA requester.  This would be a required subsection (b)(2) disclosure.  However, if a FOIA exemption – typically, Exemption 6 or Exemption 7(C) – applies to a Privacy Act-protected record, the Privacy Act prohibits an agency from making a “discretionary” FOIA release because that disclosure would not be “required” by the FOIA within the meaning of subsection (b)(2).  See, e.g., DOD v. FLRA, 510 U.S. 487, 502 (1994); Big Ridge, Inc. v. Fed. Mine Safety and Health Review Comm’n, 715 F.3d 631, 651 (7th Cir. 2013); Navy v. FLRA, 975 F.2d 348, 354-56 (7th Cir. 1992); DOD v. FLRA, 964 F.2d 26, 30 n.6 (D.C. Cir. 1992); Andrews v. VA, 838 F.2d 418, 422-24 & n.8 (10th Cir. 1988); Akmal v. United States, No. C12-1499, 2014 WL 906231, at *3 (W.D. Wash. Mar. 7, 2014); Citizens for Responsibility and Ethics in Washington v. Nat’l Indian Gaming Comm’n, 467 F. Supp. 2d 40, 54-55 (D.D.C. 2006); Robbins v. HHS, No. 1:95-cv-3258, slip op. at 2-9 (N.D. Ga. Aug. 13, 1996), aff’d, No. 96-9000 (11th Cir. July 8, 1997); Kassel v. VA, 709 F. Supp. 1194, 1199-1200 (D.N.H. 1989); Howard v. Marsh, 654 F. Supp. 853, 855-56 (E.D. Mo. 1986); Fla. Med. Ass’n v. HEW, 479 F. Supp. 1291, 1305-07 (M.D. Fla. 1979); Providence Journal Co. v. FBI, 460 F. Supp. 762, 767 (D.R.I. 1978), rev’d on other grounds, 602 F.2d 1010 (1st Cir. 1979); Phila. Newspapers, Inc. v. DOJ, 405 F. Supp. 8, 10 (E.D. Pa. 1975); see also OMB Guidelines, 40 Fed. Reg. 28,948, 28,954 (July 9, 1975), available at http://www.whitehouse.gov/sites/default/files/omb/assets/omb/inforeg/implementation_guidelines.pdf.

In DOJ v. Reporters Comm. for Freedom of the Press, 489 U.S. 749, 762-75 (1989), the Supreme Court significantly expanded the breadths of FOIA Exemptions 6 and 7(C).  The Court ruled that a privacy interest may exist in publicly available information – such as the criminal history records (rap sheets) there at issue – where the information is “practically obscure.”  Id. at 764-71.  Even more significantly, the Court held that the identity of the FOIA requester, and any socially useful purpose for which the request was made, are not to be considered in evaluating whether the “public interest” would be served by disclosure.  Id. at 771-75.  The Court determined that the magnitude of the public interest side of the balancing process can be assessed only by reference to whether disclosure of the requested records directly advances the “core purpose” of the FOIA – to shed light on the operations and activities of the government.  Id. at 774-75.

In light of Reporters Comm., personal information of the sort protected by the Privacy Act is less likely to be “required” to be disclosed under the FOIA, within the meaning of subsection (b)(2).  Specifically, where an agency determines that the only “public interest” that would be furthered by a disclosure is a nonqualifying one under Reporters Comm. (even where it believes that disclosure would be in furtherance of good public policy generally), it may not balance in favor of disclosure under the FOIA and therefore disclosure will be prohibited under the Privacy Act – unless authorized by another Privacy Act exception or by written consent.  See, e.g., DOD v. FLRA, 510 U.S. at 497-502 (declining to “import the policy considerations that are made explicit in the Labor Statute into the FOIA Exemption 6 balancing analysis” and, following the principles of Reporters Comm., holding that home addresses of bargaining unit employees are covered by FOIA Exemption 6 and thus that Privacy Act “prohibits their release to the unions”); Schwarz v. INTERPOL, No. 94-4111, 1995 U.S. App. LEXIS 3987, at *4-7 & n.2 (10th Cir. Feb. 28, 1995) (balancing under Reporters Comm. and holding that individual clearly has protected privacy interest in avoiding disclosure of his whereabouts to third parties; disclosure of this information would not “contribute anything to the public’s understanding of the operations or activities of the government”; and thus any information was exempt from disclosure under FOIA Exemption 7(C) and does not fall within Privacy Act exception (b)(2)); FLRA v. Commerce, 962 F.2d 1055, 1059 (D.C. Cir. 1992) (asserting that the Privacy Act prohibits disclosure of identities of individuals who received outstanding or commendable personnel evaluations, as such information falls within FOIA Exemption 6); Doe v. Veneman, 230 F. Supp. 2d 739, 748-52 (W.D. Tex. 2002) (finding that in a reverse FOIA lawsuit where information regarding government program for protection of livestock using livestock-protection collars already had been released, no personally identifying information about particular ranchers and farmers participating in program “could shed any further light on workings of the [program],” that information thus was protected by FOIA Exemption 6, and disclosure was prohibited by the Privacy Act), aff’d in part, rev’d in part, on other grounds, 380 F.3d 807 (5th Cir. 2004); Fort Hall Landowners Alliance, Inc. v. BIA, No. CV-99-00052-E-BLW, slip op. at 7-14 (D. Idaho Mar. 17, 2000) (finding that document that “contains only names and addresses . . . does not provide information shedding light on how the BIA is performing its duties,” and that “[h]aving determined that disclosure of the information is not required by FOIA . . . the Privacy Act prohibits disclosure of the information”); Burke v. DOJ, No. 96-1739, 1999 WL 1032814, at *3-5 (D.D.C. Sept. 30, 1999) (stating that the “Privacy Act prohibits the FBI from disclosing information about a living third party without a written privacy waiver, unless FOIA requires disclosure,” and upholding the FBI’s refusal to confirm or deny the existence of investigative records related to third parties in response to a FOIA request); see also FOIA Update, Vol. X, No. 2, at 6, available at http://www.justice.gov/oip/foia_updates/Vol_X_2/ page3.html (“Privacy Protection Under the Supreme Court’s Reporters Committee Decision”).  As a result of Reporters Comm., agencies depend more on the subsection (b)(3) routine use exception to make compatible disclosures of records that are no longer required by the FOIA to be disclosed.  See, e.g., USDA v. FLRA, 876 F.2d 50, 51 (8th Cir. 1989); see also FLRA v. Treasury, 884 F.2d 1446, 1450 & n.2 (D.C. Cir. 1989).

It should be noted that President Barack Obama’s FOIA policy on openness in government, see Memorandum for the Heads of Executive Departments and Agencies, Subject:  Freedom of Information Act (Jan. 21, 2009), available at http://whitehouse.gov/the_press_office/Freedom_of_Information_Act, as implemented by Attorney General Eric Holder’s Memorandum for the Heads of Executive Departments and Agencies, Subject:  The Freedom of Information Act (FOIA) (Mar. 19, 2009), available at http://www.justice.gov/ag/foia-memo-march2009.pdf, is inapplicable to information covered by the Privacy Act that also falls under one or more of the FOIA exemptions.  See Department of Justice Office of Information Policy Guidance, President Obama’s FOIA Memorandum and Attorney General Holder’s FOIA Guidelines Creating a “New Era of Open Government,” posted April 17, 2009, available at http://www.justice.gov/oip/foiapost/2009foiapost8.htm (“For information falling within Exemptions 6 and 7(C), if the information is also protected by the Privacy Act of 1974, it is not possible to make a discretionary release, as the Privacy Act contains a prohibition on disclosure of information not ‘required’ to be released under the FOIA.”).

The Court of Appeals for the District of Columbia Circuit significantly limited the utility of subsection (b)(2) in Bartel v. FAA, 725 F.2d 1403 (D.C. Cir. 1984).  In Bartel, the D.C. Circuit held that subsection (b)(2) cannot be invoked unless an agency actually has a FOIA request in hand.  725 F.2d at 1411-13; see also Chang v. Navy, 314 F. Supp. 2d 35, 41-42 (D.D.C. 2004) (citing Bartel, and noting that defendant agency conceded that it “had no FOIA request in hand”).  In one case prior to Bartel, it similarly had been held that subsection (b)(2) was not available as a defense for the disclosure of information in the absence of a FOIA request.  Zeller v. United States, 467 F. Supp. 487, 503 (E.D.N.Y. 1979) (finding subsection (b)(2) inapplicable to the “voluntary re-release” of a prior press release (that had been made prior to the effective date of the Privacy Act) as “nothing in the FOIA appears to require such information to be released in the absence of a request therefor”). 

Other courts have not taken the approach articulated by the D.C. Circuit in Bartel.  See Cochran v. United States, 770 F.2d 949, 957-58 & n.14 (11th Cir. 1985) (applying subsection (b)(2) – in absence of written FOIA request – because requested records would not be withholdable under any FOIA exemption); Jafari v. Navy, 728 F.2d 247, 249-50 (4th Cir. 1984) (same); Russo v. United States, 576 F. Supp. 2d 662, 671-72 (D.N.J. 2008) (alternative holding) (expressing reluctance to follow Bartel because subsection (b)’s conditional language of “would be” rather than “is” casts “serious doubt upon Plaintiff’s argument that the exception only applies where the agency is faced with a written FOIA request”); Mudd v. Army, No. 2:05-cv-137, 2007 WL 4358262, at *6 (M.D. Fla. Dec. 10, 2002) (agreeing with agency that “under the circumstances of this case, the balance of plaintiff’s privacy against the public’s right to disclosure weighs in favor of public disclosure, and that the FOIA exception was applicable even without a formal FOIA request”); see also Fla. Med. Ass’n, 479 F. Supp. at 1301, 1305-07.  However, because the D.C. Circuit is the jurisdiction of “universal venue” under the Privacy Act (which means that any Privacy Act lawsuit for wrongful disclosure could be filed within that judicial circuit), see 5 U.S.C. § 552a(g)(5), its holding in Bartel is of paramount importance.  See FOIA Update, Vol. V, No. 3, at 2, available at http://www.justice.gov/oip/foia_updates/Vol_V_3/page2.htm (“FOIA Counselor Q & A”) (discussing Bartel).

Note also, though, that the Bartel decision left open the possibility that certain types of information “traditionally released by an agency to the public” might properly be disclosed even in the absence of an actual FOIA request.  725 F.2d at 1413 (dictum).  Reacting to Bartel, OMB issued guidance indicating that records that have “traditionally” been considered to be in the public domain, and those that are required to be disclosed to the public – such as final opinions of agencies and press releases – can be released without waiting for an actual FOIA request.  OMB Guidelines, 52 Fed. Reg. 12,990, 12,992-93 (Apr. 20, 1987), available at http://www.whitehouse.gov/sites/default/files/omb/assets/omb/inforeg/guidance_privacy_act.pdf (discussing Bartel, in context of guidance on “call detail” programs, and referring to OMB Memorandum For The Senior Agency Officials For Information Resources Management (May 24, 1985) at 4-6 (unpublished)).  The District Court for the District of Columbia twice has applied this aspect of Bartel.  In Tripp v. DOD, 193 F. Supp. 2d 229, 236 (D.D.C. 2002), the D.C. District Court held that “the names, titles, salaries, and salary-levels of public employees are information generally in the public domain” and thus that they are not prohibited from disclosure under subsection (b)(2).  In Chang v. Navy, 314 F. Supp. 2d 42, the District Court found that the Privacy Act was not violated where the Navy disclosed information to the media about plaintiff’s nonjudicial punishment, because the information was “releasable” under the FOIA, and the Navy had asserted that it “traditionally releases information that would be releasable under the FOIA to the press without a formal FOIA request,” and was able to point to a Navy regulation to that effect.  Id; see also Russo, 576 F. Supp. 2d at 670-73 (D.N.J. 2008) (alternative holding) (declining to expressly adopt D.C. Circuit’s holding in Bartel, concluding that “GS-level and salaries of public officials are ‘information . . . traditionally released by an agency to the public without a FOIA request,’” and thus that agency may properly disclose plaintiff’s active duty military status under the Privacy Act (quoting Bartel, 725 F.2d at 1413)).  At least one pre-Bartel case also appears to support this idea.  Owens v. MSPB, No. 3-83-0449-R, slip op. at 3 (N.D. Tex. Sept. 14, 1983) (finding that inadvertent disclosure to plaintiff’s former attorney of initial decision rendered by MSPB did not violate Privacy Act, because “the Board’s proper treatment of its initial decisions as final decisions for purposes of FOIA makes these decisions part of the public domain – and the release of public information simply cannot be an unlawful disclosure under the Privacy Act”).  But see Zeller v. United States, 467 F. Supp. 487, 503 (E.D.N.Y. 1979) (finding subsection (b)(2) inapplicable to the “voluntary re-release” of a press release that had been made four years earlier, as “nothing in the FOIA appears to require such information to be released in the absence of a request therefor”).

3. 5 U.S.C. § 552a(b)(3) (routine uses)

“for a routine use as defined in subsection (a)(7) of this section and described under subsection (e)(4)(D).”

Cross-references:

Subsection (e)(4)(D) requires Federal Register publication of “each routine use of the records contained in the system, including the categories of users and the purpose of such use.”

Subsection (a)(7) defines the term “routine use” to mean “with respect to the disclosure of a record, the use of such record for a purpose which is compatible with the purpose for which it was collected.”

Comment:

The routine use exception, because of its potential breadth, is one of the most controversial provisions in the Act.  See Privacy Commission Report at 517-18, available at http://epic.org/privacy/ppsc1977report.  The trend in recent cases is toward a narrower construction of the exception.  The White House directed the Office of Management and Budget to issue additional guidance regarding the routine use exception in an executive memorandum on privacy sent to the heads of executive departments and agencies in 1998.  Memorandum on Privacy and Personal Information in Federal Records, 34 Weekly Comp. Pres. Doc. 870 (May 14, 1998), available at http://www.whitehouse.gov/omb/memoranda/m99-05-a.html.  See also FOIA Update, Vol. XIX, No. 2, at 1, available at http://www.whitehouse.gov/omb/memoranda_m99-05-a (“President Issues Privacy Act-Related Memorandum to All Federal Agencies”) (providing summary of executive memorandum).

It should be noted that the routine use exception “was developed to permit other than intra-agency disclosures” and that therefore “[i]t is not necessary . . . to include intra-agency transfers in the portion of the system notice covering routine uses.”  OMB Guidelines, 40 Fed. Reg. 56,741, 56,742 (Dec. 4, 1975), available at http://www. whitehouse.gov/sites/default/files/omb/assets/omb/inforeg/implementation1974.pdf.  But see O’Donnell v. DOD, No. 04-00101, 2006 WL 166531, at *8 n.8 (E.D. Pa. Jan. 20, 2006) (disagreeing with plaintiff that “routine use” should be defined as “the disclosure of a record outside of [DOD]” and explaining that “the ‘routine use’ exception specifically states that disclosure is allowed ‘for a routine use as defined in subsection (a)(7) of [the Act]’”); cf. Shayesteh v. Raty, No. 02:05-CV-85TC, 2007 WL 2317435, at *5 (D. Utah Aug. 7, 2007) (concluding that disclosures were proper under subsection (b)(1), explaining that purpose of disclosures was compatible with purpose of collection under subsection (b)(3)).

By its terms, this exception sets forth two requirements for a proper routine use disclosure:  (1) Federal Register publication, thereby providing constructive notice; and (2) compatibility.  See, e.g., Britt v. Naval Investigative Serv., 886 F.2d 544, 547-50 (3d Cir. 1989); Brunotte v. Johnson, 892 F. Supp. 2d 199, 207 (D.D.C. 2012); Shannon v. Gen. Elec. Co., 812 F. Supp. 308, 316 (N.D.N.Y. 1993).

However, the Court of Appeals for the Ninth Circuit has engrafted a third requirement onto this exception:  Actual notice of the routine use under subsection (e)(3)(C) (i.e., at the time of information collection from the individual).  Covert v. Harrington, 876 F.2d 751, 754-56 (9th Cir. 1989) (discussed below); accord Puerta v. HHS, No. 99-55497, 2000 WL 863974, at *1-2 (9th Cir. June 28, 2000), aff’g No. EDCV 94-0148, slip op. at 7 (C.D. Cal. Jan. 5, 1999); cf. Stafford v. SSA, 437 F. Supp. 2d 1113, 1119-20 (N.D. Cal. 2006) (adhering to Covert and finding that SSA notified plaintiff of potential uses “on three occasions when collecting her information”; explaining that notice need not “anticipate and list every single potential permutation of a routine use in order to invoke this exception”; “The Court is not persuaded that Congress intended to place such an impractical burden on federal agencies, which would in effect severely curtail the very exception that Congress sought to carve out in the interest of practicality.”).  Subsequently, the Court of Appeals for the District of Columbia Circuit cited this aspect of Covert with approval and remanded a case for determination as to whether (e)(3)(C) notice was provided, stating that “[a]lthough the statute itself does not provide, in so many terms, that an agency’s failure to provide employees with actual notice of its routine uses would prevent a disclosure from qualifying as a ‘routine use,’ that conclusion seems implicit in the structure and purpose of the Act.”  USPS v. Nat’l Ass’n of Letter Carriers, 9 F.3d 138, 146 (D.C. Cir. 1993).  See also Minshew v. Donley, 911 F. Supp. 2d 1043, 1073 (D. Nev. 2012) (“While a report to a non-federal employer falls within a routine use, Air Force has failed to respond to [plaintiff’s] argument that OPM did not inform [plaintiff] on the form which OPM used to collect the information, or on a separate form provided to [plaintiff], that [plaintiff’s] federal employer may make unsolicited disclosures to private employers regarding the circumstances surrounding [plaintiff’s] separation from federal employment.”).  But cf. Thompson v. State, 400 F. Supp. 2d 1, 16-17 (D.D.C. 2005) (discussed below under “5 U.S.C. § 552a(e)(3)”).

Federal Register Constructive Notice

The routine use exception’s notice requirement “is intended to serve as a caution to agencies to think out in advance what uses [they] will make of information.”  120 Cong. Rec. 40,881 (1974), reprinted in Source Book at 987, available at http://www.loc.gov/rr/frd/Military_Law/pdf/LH_privacy_act-1974.pdf.  Indeed, it is possible for a routine use to be deemed facially invalid if it fails to satisfy subsection (e)(4)(D) – i.e., if it does not specify “the categories of users and the purpose of such use.”  See Britt, 886 F.2d at 547-48 (dictum) (suggesting that routine use (50 Fed. Reg. 22,802-03 (May 29, 1985)) permitting disclosure to “federal regulatory agencies with investigative units” is overbroad as it “does not provide adequate notice to individuals as to what information concerning them will be released and the purposes of such release”); cf. Krohn v. DOJ, No. 78-1536, slip op. at 4-7 (D.D.C. Mar. 19, 1984) (“[T]o qualify as a ‘routine use,’ the agency must . . . publish in the Federal Register . . . ‘each routine use of the records contained in the system, including the categories of users and the purpose of such use.’”), reconsideration granted & vacated in nonpertinent part, (D.D.C. Nov. 29, 1984) (discussed below).

It is well settled that the “scope of [a] routine use is confined to the published definition.”  Doe v. Naval Air Station, Pensacola, Fla., 768 F.2d 1229, 1231 (11th Cir. 1985); see also Parks v. IRS, 618 F.2d 677, 681-82 (10th Cir. 1980); Quilico v. Navy, No. 80-C-3568, 1983 U.S. Dist. LEXIS 14090, at *9-12 (N.D. Ill. Sept. 2, 1983); Local 2047, AFGE v. Def. Gen. Supply Ctr., 423 F. Supp. 481, 484-86 (E.D. Va. 1976), aff’d, 573 F.2d 184 (4th Cir. 1978).  In other words, a particular disclosure is unauthorized if it does not fall within the clear terms of the routine use.  See, e.g., Swenson v. USPS, 890 F.2d 1075, 1078 (9th Cir. 1989) (citing Notices, 47 Fed. Reg. 1199-01, 1203 (Jan. 11, 1982) stating that “[D]isclosure may be made to a congressional office from the record of an individual in response to an inquiry from the congressional office made at the request of that individual”); Tijerina v. Walters, 821 F.2d 789, 798 (D.C. Cir. 1987) (citing Categories of Records in the System, 47 Fed. Reg. 24,012 (June 2, 1982), holding inapplicable to VA’s unsolicited letter notifying state board of bar examiners of possible fraud committed by bar applicant because no violation of state law was “reasonably imminent,” and letter was not in response to “official request”); Doe v. DiGenova, 779 F.2d 74, 86 (D.C. Cir. 1985) (citing Notice of Incorporation by Reference, 43 Fed. Reg. 44,739, 44,743 (Sept. 28, 1978) holding inapplicable to VA psychiatric report because disclosed record itself did not “indicate[] a potential violation of law”); Shearson v. DHS, No. 1:06 CV 1478, 2012 WL 398444, at *3 (N.D. Ohio Feb. 6, 2012) (finding where published routine use required agency to first be “aware of an indication of a violation or potential violation of” law and individual alleged that she had no criminal record, plaintiff “fairly alleges that defendants did not meet the ‘routine use’ exception because the disclosing agency could not have been aware of any wrongful behavior”); Cooper v. FAA, No. 3:07-cv-01383, slip op. at 14-15 (N.D. Cal. Aug. 22, 2008) (concluding that “when DOT-OIG sent the name, social security number, date of birth and gender of approximately 45,000 pilots to SSA-OIG, it was not because those records indicated a violation or potential violation of the law,” as required by language of DOT routine use), rev’d on other grounds, 596 F.3d 538 (9th Cir. 2010), rev’d on other grounds, 131 S. Ct. 3025 (2012); Bechhoefer v. DOJ, 179 F. Supp. 2d 93, 101-02 (W.D.N.Y. 2001) (finding that where a letter was collected by the agency due to its initial interest in investigating plaintiff’s allegations of illegal drug activity by a local law enforcement agency, and was disclosed to that agency’s investigator whose interest was in investigating possible unlawful, non-drug-related activity by plaintiff himself, such disclosure was not proper pursuant to a routine use providing for the disclosure to state and local law enforcement and regulatory agencies for law enforcement and regulatory purposes and stating that “it is difficult to see how [the] disclosure could be said to have been compatible with the purpose for which the letter was collected”), aff’d on other grounds, 312 F.3d 563 (2002), cert. denied sub nom. Bechhoefer v. DEA, 539 U.S. 514 (2003); Kvech v. Holder, No. 10-cv-545, 2011 WL 4369452, at *3-4 (D.D.C. Sept. 19, 2011) (ruling that dismissal was not yet warranted where “the record does not contain any evidence regarding precisely what information was disclosed . . . and the extent to which the disclosures fell inside or outside the confines of” the routine use); Pontecorvo v. FBI, No. 00-1511, slip op. at 13-15 (D.D.C. Sept. 30, 2001) (denying agency summary judgment and ordering discovery to determine whether the agency “overstepped [the] explicit restrictions” contained in its routine use); Vargas v. Reno, No. 99-2725, slip op. at 3, 12-13 (W.D. Tenn. Mar. 31, 2000) (stating that routine uses permitting disclosure to appropriate agency when record indicates potential violation of law and to investigating agency in response to its request when information is relevant and necessary to investigation did not apply to disclosure of plaintiff’s record, which was “‘owned’ by the Office of Personnel Management,” to Department of Justice Inspector General agent conducting investigation of another employee; “The mere existence of an investigation at a facility is not sufficient to allow an investigating agent access to the records of every employee who is employed at that facility.”); Greene v. VA, No. C-76-461-S, slip op. at 3-6 (M.D.N.C. July 3, 1978) (holding inapplicable to VA’s disclosure of medical evaluation to state licensing bureau because routine use permitted disclosure only to facilitate VA decision); see also Covert, 667 F. Supp. at 736-39.

Note that an agency’s construction of its routine use should be entitled to deference.  See Makowski v. United States, 27 F. Supp. 3d 901-912 (N.D. Ill. 2014) (“As [Enhanced Border Security Act] is ambiguous as to what it required the FBI to do upon receiving [plaintiff’s] fingerprints, the court defers to the FBI[‘s] and DHS’s interpretation and application of the statute, which was reasonable”, and thus finding the publication requirement of FBI’s routine use exception as met); Air Force v. FLRA, 104 F.3d 1396, 1402 (D.C. Cir. 1997); FLRA v. Treasury, 884 F.2d 1446, 1455-56 (D.C. Cir. 1989); Radack v. DOJ, 402 F. Supp. 2d 99, 106 n.7 (D.D.C. 2005).  Cf. Stafford, 437 F. Supp. 2d at 1119 (relying on SSA regulations for proposition that “SSA generally would consider a use to be compatible if it relates to determining eligibility for needs-based income maintenance . . . or related medical benefits for low-income people” and concluding that SSA’s disclosure of child abuse suspect’s “precise medical diagnosis to [California Child Protective Services] . . . was not compatible with the purpose for which the information was collected”).  But see NLRB v. USPS, 790 F. Supp. 31, 33 (D.D.C. 1992) (rejecting Postal Service’s interpretation of its own routine use).

Compatibility               

The precise meaning of the term “compatible” is quite uncertain and must be assessed on a case-by-case basis.  According to OMB, the “compatibility” concept encompasses (1) functionally equivalent uses, and (2) other uses that are necessary and proper.  OMB Guidelines, 52 Fed. Reg. 12,990, 12,993 (Apr. 20, 1987), available at http://www.whitehouse.gov/sites/default/files/omb/assets/omb/inforeg/guidance_privacy_act.pdf.

An early leading case on “compatibility” is Britt v. Naval Investigative Serv., 886 F.2d at 547-50, in which the Court of Appeals for the Third Circuit in 1989 ruled that the Naval Investigative Service’s gratuitous disclosure of records, describing a then-pending criminal investigation of a Marine Corps reservist, to that individual’s civilian employer (the Immigration and Naturalization Service), was not “compatible” with the “case-specific purpose for collecting” such records.  Id.  In holding that the employment/suitability purpose for disclosure was incompatible with the criminal law enforcement purpose for collection, the Third Circuit deemed it significant that “the [Immigration and Naturalization Service] was not conducting its own criminal investigation of the same activity or any other activity” by the subject, and that the records at issue concerned “merely a preliminary investigation with no inculpatory findings.”  Id. at 549-50.  Employing especially broad language, the Third Circuit pointedly condemned the agency’s equating of “compatibility” with mere “relevance” to the recipient entity, observing that “[t]here must be a more concrete relationship or similarity, some meaningful degree of convergence, between the disclosing agency’s purpose in gathering the information and in its disclosure.”  Id. (citing Covert, 876 F.2d at 755 (dictum)); Mazaleski v. Truesdale, 562 F.2d 701, 713 n.31 (D.C. Cir. 1977) (dictum)); accord Swenson, 890 F.2d at 1078; cf. Quinn v. Stone, 978 F.2d 126, 139 (3d Cir. 1992) (Nygaard, J., dissenting) (concluding that disclosure was authorized by routine use because disclosure was compatible with one of the purposes for collection, even if not with main purpose for collection).  

The D.C. Circuit has also interpreted the term “compatibility” in considering a routine use providing for disclosure to labor organizations as part of the collective bargaining process.  The court stated that application of the “common usage” of the word would require simply that “a proposed disclosure would not actually frustrate the purposes for which the information was gathered.”  USPS v. Nat’l Ass’n of Letter Carriers, 9 F.3d 138, 144 (D.C. Cir. 1993).  The D.C. Circuit recognized the “far tighter nexus” that was required by the Third and Ninth Circuits in Britt and Swenson, and that is consistent with the legislative history, but stated:

Whatever the merit of the decisions of prior courts that have held . . . that a finding of a substantial similarity of purpose might be appropriate in the non-labor law context in order to effectuate congressional intent, the compatibility requirement imposed by section 552a(a)(7) cannot be understood to prevent an agency from disclosing to a union information as part of the collective bargaining process. Id. at 145.  In a concurring opinion, Judge Williams agreed with the disposition of the case, but noted that he did not share the “belief that the meaning of ‘compatible’ . . . may depend on the identity of the entity to which the information is being disclosed.”  Id. at 147 n.1 (Williams, J., concurring).  Rather, seeing “no conflict between the purposes for which the information was collected and those for which it will be disclosed,” he found the disclosure to be compatible without further inquiry.  Id. at 146-47.  But cf. Pontecorvo v. FBI, No. 00-1511, slip op. at 10-11 (D.D.C. Sept. 30, 2001) (recognizing the D.C. Circuit’s holding in USPS case, but finding “the test articulated by the Third and Ninth circuits to be controlling” in the non-labor law context).

There are two examples of “compatible” routine uses that frequently occur in the law enforcement context.  First, in the context of investigations/prosecutions, law enforcement agencies may routinely share law enforcement records with one another.  See OMB Guidelines, 40 Fed. Reg. at 28,955, available at http://www.whitehouse.gov/sites/default/files/omb/assets/omb/inforeg/implementation_guidelines.pdf (proper routine use is “transfer by a law enforcement agency of protective intelligence information to the Secret Service”); see also, e.g., 28 U.S.C. § 534 (2006) (authorizing Attorney General to exchange criminal records with “authorized officials of the Federal Government, the States, cities, and penal and other institutions”).  Second, agencies may routinely disclose any records indicating a possible violation of law (regardless of the purpose for collection) to law enforcement agencies for purposes of investigation/prosecution.  See OMB Guidelines, 40 Fed. Reg. at 28,953, 28,955; 120 Cong. Rec. 36,967, 40,884 (1974), reprinted in Source Book at 957-58, 995, available at http://www.loc.gov/rr/frd/Military_Law/pdf/LH_privacy_act-1974.pdf (remarks of Congressman Moorhead); see also, e.g., 28 U.S.C. § 535(b) (2006) (requiring agencies of the executive branch to expeditiously report “[a]ny information, allegation, or complaint” relating to crimes involving government officers and employees to United States Attorney General).  These kinds of routine uses have been criticized on the ground that they circumvent the more restrictive requirements of subsection (b)(7).  See Privacy Commission Report at 517-18, available at http://epic.org/privacy/ppsc1977report; see also Britt, 886 F.2d at 548 n.1 (dictum); Covert, 667 F. Supp. at 739, 742 (dictum).  Yet, they have never been successfully challenged on that basis.  Indeed, courts have routinely upheld disclosures made pursuant to such routine uses.  See, e.g., Bansal v. Pavlock, 352 F. App’x 611, 613-14 (3d Cir. 2009) (upholding disclosure of detainee’s recorded telephone conversations by Marshals Service to government case agent, who disclosed recording to interpreter, who disclosed recording to second interpreter); Weinberger v. Grimes, No. 07-6461, 2009 WL 331632, at *8 (6th Cir. Feb. 10, 2009) (stating that BOP routine use “includes disclosure to federal law enforcement agencies for ‘court-related purposes’ including ‘civil court actions’”); Shearson v. Holder, 865 F. Supp. 2d 850, 870 (N.D. Ohio 2011) (ruling that FBI “dissemination of watchlist information to CBP officers to facilitate their border security responsibilities” fell within published routine use to agencies “engaged in terrorist screening”); Ray v. DHS, No. H-07-2967, 2008 WL 3263550, at *12-13 (S.D. Tex. Aug. 7, 2008) (discussing disclosure by OIG of results of investigation concerning plaintiff’s SF 85P to U.S. Attorney’s Office was proper because it was covered by published routine use); Freeman v. EPA, No. 02-0387, 2004 WL 2451409, at *6-7 (D.D.C. Oct. 25, 2004) (concluding that “disclosure [by a DOD investigator hired by EPA] of the plaintiff’s records concerning drug testing schedules and test results to AUSA . . . for the purposes of [AUSA’s] investigation of potentially criminal activity is a disclosure that is ‘compatible with the purpose for which [those records were] collected’”); Nwangoro v. Army, 952 F. Supp. 394, 398 (N.D. Tex. 1996) (finding the disclosure by Military Police of financial records obtained in an ongoing criminal investigation to foreign customs officials likewise involved in an investigation of possible infractions of foreign tax and customs laws was “permitted by the ‘routine use’ exception and d[id] not constitute a violation of the Privacy Act”); Little v. FBI, 793 F. Supp. 652, 655 (D. Md. 1992) (finding that disclosure did not violate the Privacy Act prohibition because it was made pursuant to routine use that allows disclosure of personnel matters to other government agencies when directly related to enforcement function of recipient agency), aff’d on other grounds, 1 F.3d 255 (4th Cir. 1993). 

In Covert v. Harrington, 667 F. Supp. at 736-39, however, the district court held that a routine use permitting the Department of Energy’s Inspector General to disclose to the Justice Department relevant records when “a record” indicates a potential violation of law, 47 Fed. Reg. 14,333 (Apr. 2, 1982), did not permit the disclosure of personnel security questionnaires submitted by the plaintiffs because such questionnaires did not on their face reveal potential violations of law.  The court rejected the agency’s argument that disclosure was proper because each questionnaire was disclosed as part of a prosecutive report that (when viewed as a whole) did reveal a potential violation of law.  Id. at 736-37.  Further, the court found that the Inspector General’s disclosure of the questionnaires to the Justice Department (for a criminal fraud prosecution) was not compatible with the purpose for which they were originally collected by the Department of Energy (for a security-clearance eligibility determination), notwithstanding the fact that the questionnaires were subsequently acquired by the Inspector General – on an intra-agency “need to know” basis pursuant to 5 U.S.C. § 552a(b)(1) – for the purpose of a fraud investigation.  Id. at 737-39.

On cross-appeals, a divided panel of the Court of Appeals for the Ninth Circuit affirmed the district court’s judgment on other grounds.  Covert, 876 F.2d at 754-56.  The panel majority held that the Department of Energy’s failure to provide actual notice of the routine use on the questionnaires at the time of original collection, under subsection (e)(3)(C), precluded the Department of Energy from later invoking that routine use under subsection (b)(3).  Id. at 755-56; see also Puerta v. HHS, No. 99-55497, 2000 WL 863974, at *1-2 (9th Cir. June 28, 2000) (following Covert, but finding that agency had provided notice of routine use on form used to collect information), aff’g No. EDCV 94-0148, slip op. at 7 (C.D. Cal. Jan. 5, 1999); USPS v. Nat’l Ass’n of Letter Carriers, 9 F.3d at 146 (citing Covert with approval and remanding case for factual determination as to whether subsection (e)(3)(C) notice was given); Stafford v. SSA, 437 F. Supp. 2d 1113, 1119-20 (N.D. Cal. 2006) (adhering to Covert and finding that SSA notified plaintiff of potential uses “on three occasions when collecting information from her,” even though these notifications were non-specific references to the Federal Register); Pontecorvo, No. 00-1511, slip op. at 12 (D.D.C. Sept. 30, 2001) (stating that agency must comply with subsection (e)(3)(C) “in order to substantiate an exception for ‘routine use’”).  Prior to Covert, no other court had ever so held.  See the additional discussion under subsection (e)(3), below.

In Doe v. Stephens, 851 F.2d 1457, 1465-67 (D.C. Cir. 1988), the Court of Appeals for the District of Columbia Circuit held that a VA routine use – permitting disclosure of records “in order for the VA to respond to and comply with the issuance of a federal subpoena [47 Fed. Reg. 51,841 (Nov. 17, 1982)]” – was invalid under the Administrative Procedure Act because it was inconsistent with the Privacy Act as interpreted in Doe v. DiGenova, 779 F.2d at 78-84 – where the court had found that disclosures pursuant to subpoenas were not permitted by the subsection (b)(11) court order exception.  In light of Doe v. Stephens, the decision in Fields v. Leuver, No. 83-0967, slip op. at 5-7 (D.D.C. Sept. 22, 1983) (upholding routine use permitting disclosure of payroll records “in response to a court subpoena”), is unreliable.  But cf. Osborne v. USPS, No. 94-30353, slip op. at 6-9 (N.D. Fla. May 18, 1995) (holding on alternative ground that disclosure of plaintiff’s injury-compensation file to retired employee who had prepared file and who had been subpoenaed by plaintiff and was expecting to be deposed on matters documented in file was proper pursuant to routine use that “‘specifically contemplates that information may be released in response to relevant discovery and that any manner of response allowed by the rules of the forum may be employed’”).

The Act’s legislative history recognizes the “compatibility” of a routine use invoked to publicly file records in court.  See 120 Cong. Rec. 40,405, 40,884 (1974), reprinted in Source Book at 858, 995, available at http://www.loc.gov/rr/frd/Military_Law/pdf/LH_privacy_act-1974.pdf (routine use appropriate where Justice Department “presents evidence [(tax information from IRS)] against the individual” in court); see also Schuenemeyer v. United States, No. SA-85-773, slip op. at 1-2, 4 (W.D. Tex. Mar. 31, 1988) (finding no violation of Privacy Act for disclosure of litigant’s medical records to Justice Department and U.S. Claims Court, as the information was used “in preparing the position of the USAF before the [court],” and was authorized under agency routine use).

In Krohn v. DOJ, No. 78-1536, slip op. at 4-7 (D.D.C. Mar. 19, 1984), however, the court invalidated an FBI routine use allowing for “dissemination [of records] during appropriate legal proceedings,” finding that such a routine use was impermissibly “vague” and was “capable of being construed so broadly as to encompass all legal proceedings.”  In response to Krohn, OMB issued guidance to agencies in which it suggested a model routine use – employing a “relevant and necessary to the litigation” standard – to permit the public filing of protected records with a court.  OMB Memorandum for the Senior Agency Officials for Information Resources Management 2-4 (May 24, 1985), available at http://www.whitehouse.gov/sites/default/files/omb/assets/omb/inforeg/guidance1985.pdf.  Many agencies, including the Justice Department, have adopted “post-Krohn” routine uses designed to authorize the public filing of relevant records in court.  See, e.g., 66 Fed. Reg. 36,593, 36,594 (July 12, 2001), available at http://www.gpo.gov/fdsys/pkg/FR-2001-07-12/html/01-17475.htm (routine use [number 7] applicable to records in Justice Department’s “Civil Division Case File System”); 63 Fed. Reg. 8,666, 8,667-68 (Feb. 20, 1998), available at http://www.gpo.gov/fdsys/pkg/FR-1998-02-20/pdf/98-4206.pdf#page=8 (routine uses [letters “o” and “p”] applicable to records in U.S. Attorney’s Office’s “Civil Case Files”).

It should be noted that none of the “post-Krohn” routine uses – such as the ones cited above which employ an “arguably relevant to the litigation” standard – have been successfully challenged in the courts.  See Jackson v. FBI, No. 02-C-3957, 2007 WL 2492069, at *8 (N.D. Ill. Aug. 28, 2007) (allowing U.S. Attorney’s filing with court of plaintiff’s unsuccessful application for employment with FBI during pendency of plaintiff’s Title VII suit against FBI because application was “at the very heart of his civil suit”); Russell v. GSA, 935 F. Supp. 1142, 1145-46 (D. Colo. 1996) (finding disclosure in public pleadings of information regarding investigation of plaintiff was permissible under routine use providing for disclosure in proceeding before court where agency is party and records are determined “to be arguably relevant to the litigation”); Osborne v. USPS, No. 94-30353, slip op. at 6-9 (N.D. Fla. May 18, 1995) (holding on alternative ground that disclosure of plaintiff’s injury-compensation file to retired employee who had prepared file and who had been subpoenaed by plaintiff and was expecting to be deposed on matters documented in file was proper pursuant to routine use providing for disclosures “incident to litigation” and “in a proceeding before a court” because “deposition was a proceeding before [the] Court”); Sheptin v. DOJ, No. 91-2806, 1992 U.S. Dist. LEXIS 6221, at *6-7 (D.D.C. Apr. 30, 1992) (finding no wrongful disclosure where agency routine uses permit use of presentence report during course of habeas proceeding).  Such challenges could arise, either based upon an argument that the routine use does not satisfy the “compatibility” requirement of subsection (a)(7) of the Act, cf. Britt, 886 F.2d at 547-50 (holding mere “relevance” to recipient entity is an improper standard for a “compatible” routine use disclosure), or based upon an argument that the routine use effectively circumvents the more restrictive, privacy-protective requirements of subsection (b)(11), cf. Doe v. Stephens, 851 F.2d at 1465-67 (asserting that an agency cannot use routine use exception to disclose records in response to subpoena where court had earlier ruled that such disclosure was improper under subsection (b)(11)).

Numerous types of information sharing between agencies and with organizations or individuals have been upheld as valid routine uses.  See, e.g., Makowski v. United States, 27 F. Supp. 3d at 909, 912 (N.D. Ill. 2014) (determining that FBI’s disclosure of fingerprints of foreign-born U.S. citizen’s fingerprints upon arrest to DHS pursuant to the Enhanced Border Security and Visa Entry Reform Act of 2002 is “compatible with the published purposes for which the FBI collected [the fingerprint data]” as part of the FBI’s Fingerprint Identification Record System and its routine use that “permits disclosures ‘[t]o such recipients and under such circumstances and procedures as are mandated by Federal statute or treaty’”); Budik v. United States, 949 F.Supp.2d 14, 29 (D.D.C. Mar. 7, 2013) (holding that disclosure of Plaintiff’s military performance assessment form for medical personnel by the United States Army was compatible with the use for which it was collected, “namely to manage credentials and privileges of health care providers in the Military Health System”), aff’d, 2013 WL 6222903 (D.C. Cir. Nov. 19, 2013); Burnett v. DOJ, 213 F. App’x 526, 528 (9th Cir. 2006) (finding that plaintiff was not credible to criminal defendant against whom plaintiff was to testify as expert witness); Puerta v. HHS, No. 99-55497, 2000 WL 863974, at *1-2 (9th Cir. June 28, 2000) (discussing disclosure of grant proposal to qualified expert who was member of peer review group for evaluation of proposal), aff’g No. EDCV 94-0148, slip op. at 7 (C.D. Cal. Jan. 5, 1999); Pippinger v. Rubin, 129 F.3d 519, 531-32 (10th Cir. 1997) (discussing disclosure of plaintiff’s personnel information to MSPB in deposition testimony in another individual’s related MSPB proceeding, and to the other individual, his attorney, and court reporter in conjunction with MSPB proceeding); Taylor v. United States, 106 F.3d 833, 836-37 (8th Cir. 1997) (discussing disclosure of federal taxpayer information collected for purpose of federal tax administration to state tax officials for purpose of state tax administration), aff’g Taylor v. IRS, 186 B.R. 441, 446-47, 453-54 (N.D. Iowa 1995); Mount v. USPS, 79 F.3d 531, 534 (6th Cir. 1996) (discussing disclosure of plaintiff’s medical information to union official representing him in administrative action in which his mental health was central issue); Alphin v. FAA, No. 89-2405, 1990 WL 52830, at *1 (4th Cir. Apr. 13, 1990) (discussing disclosure of enforcement investigation final report to subject’s customers); Hastings v. Judicial Conference of the United States, 770 F.2d 1093, 1104 (D.C. Cir. 1985) (discussing disclosure of criminal investigative records to judicial committee investigating judge); United States v. Miller, 643 F.2d 713, 715 (10th Cir. 1981) (asserting that records submitted by individual to parole officer became part of Justice Department files and Department’s use in criminal investigation constitutes routine use); United States v. Collins, 596 F.2d 166, 168 (6th Cir. 1979) (discussing HEW’s disclosure of plaintiff’s Medicaid cost reports to Justice Department for use in criminal case against plaintiff); Reed v. Navy, 910 F.Supp.2d 32, 42-43 (D.D.C. 2012) (finding disclosures made in the process of investigating allegations against plaintiff and his truthfulness about those allegations for the purpose of assessing plaintiff’s fitness for duty as a police officer fell within defendant’s “requesting information” routine use, whereby records may be disclosed to federal, state, and local authorities if necessary to obtain information relevant to the hiring or retention of an employee in order to evaluate plaintiff’s fitness for duty); Middlebrooks v. Mabus, No. 1:11cv46, 2011 WL 4478686, at *7 (E.D. Va. Sept. 23, 2011) (finding disclosure of personnel records about plaintiff, a nurse, to state nursing board, HHS, and other healthcare reporting entities fell within routine use); Feldman v. CIA, 797 F. Supp. 2d 29, 38-39 (D.D.C. 2011) (finding disclosure to Congressional oversight committee complies with statutory reporting requirements); Alexander v. FBI, 691 F. Supp. 2d 182, 191 (D.D.C. 2010) (analyzing disclosure of individuals’ background reports to White House to determine trustworthiness for granting White House access), aff’d, 456 Fed. App’x 1 (D.C. Cir. 2011); Doe v. DOJ, 660 F. Supp. 2d 31, 47-48 (D.D.C. 2009) (discussing disclosure of information regarding employee’s mental state, collected for purpose of coordinating his reasonable accommodation request, to state unemployment commission and to contractor in order to help determine employee’s eligibility for benefits, where contractor appealed from plaintiff’s award of benefits on agency’s behalf); Lucido v. Mueller, No. 08-15269, 2009 WL 3190368, at *5-6 (E.D. Mich. Sept. 29, 2009) (discussing FBI’s disclosure of plaintiff’s arrest and indictment on white-collar crimes to financial self-regulatory body where disclosure was required by federal law), aff’d, 427 Fed App’x 497 (6th Cir. 2011); Benham v. Rice, No. 0301127, 2005 WL 691871, at *5-6 (D.D.C. Mar. 24, 2005) (discussing disclosure of agency employee’s transfer request to AUSA, who had represented agency in prior discrimination suit brought by employee against agency, so that AUSA would “be informed of [the employee’s] wishes to transfer offices” and so that AUSA “could attempt to settle the pending litigation with [the employee]”); Chang v. Navy, 314 F. Supp. 2d 35, 45-46 (D.D.C. 2004) (discussing disclosure to Members of Congress for purposes of responding to constituent inquiries where, if constituent is other than record subject, only information releasable under FOIA could be disclosed); Mandel v. OPM, 244 F. Supp. 2d 146, 152 (E.D.N.Y. 2003) (alternative holding) (discussing disclosure of information about plaintiff – including summary of charges, supporting information, and copy of OPM’s investigation – to his former supervisors in connection with their testimony at plaintiff’s MSPB hearing following determination that plaintiff was unsuitable for federal employment due to prior employment record and failure to disclose history), aff’d on other grounds, 79 F. App’x 479 (2d Cir. 2003); Fattahi v. ATF, 186 F. Supp. 2d 656, 661-64 (E.D. Va. 2002) (discussing disclosure of fact that plaintiff had applied for federal firearms license to condominium association’s counsel for purposes of determining whether firearms dealer could operate out of plaintiff’s specific residential unit), aff’d, 328 F.3d 176, 181 (4th Cir. 2003) (agreeing with the district court “that ATF’s routine use must be given ‘a practical reading’ such that disclosures are in accordance with the routine use when they are ‘reasonably necessary to verify pertinent information, [and] not just [when] verification cannot conceivably be obtained by any other means’”); Mumme v. Labor, 150 F. Supp. 2d 162, 174 (D. Me. 2001) (alleging disclosure to agency’s examining physician from investigation file detailing possible health care fraud by former government worker who was being examined regarding continuing eligibility for disability benefits), aff’d, No. 01-2256 (1st Cir. June 12, 2002); Contursi v. USPS, No. 98CV112, slip op. at 2-3 (S.D. Cal. July 6, 1999) (discussing disclosure to county agency in response to its request in connection with investigation of employee), aff’d, 238 F.3d 428 (9th Cir. 2000) (unpublished table decision); Jones v. Runyon, 32 F. Supp. 2d 873, 876 (N.D. W. Va. 1998) (discussing disclosure to credit reporting service of information about plaintiff when requesting employment reports in course of routine investigation of possible workers’ compensation fraud), aff’d, 173 F.3d 850 (4th Cir. 1999) (unpublished table decision); Blazy v. Tenet, 979 F. Supp. 10, 26 (D.D.C. 1997) (discussing CIA’s disclosure of information about employee to FBI while FBI was investigating employee’s application for FBI employment), summary affirmance granted, No. 97-5330, 1998 WL 315583 (D.C. Cir. May 12, 1998); Magee v. USPS, 903 F. Supp. 1022, 1029 (W.D. La. 1995) (discussing disclosure of employee’s medical records to clinical psychologist hired by agency to perform fitness-for-duty examination on employee), aff’d, 79 F.3d 1145 (5th Cir. 1996) (unpublished table decision); McNeill v. IRS, No. 93-2204, 1995 U.S. Dist. LEXIS 2372, at *6 (D.D.C. Feb. 7, 1995) (discussing disclosure of IRS personnel records to prospective federal agency employer); Harry v. USPS, 867 F. Supp. 1199, 1206-07 (M.D. Pa. 1994) (discussing disclosure of documents regarding individual’s employment history, including details of settlement agreement, in response to congressional inquiries “made at the prompting of that individual”), aff’d sub nom. Harry v. USPS, Marvin T. Runyon, 60 F.3d 815 (3d Cir. 1995) (unpublished table decision); Lachenmyer v. Frank, No. 88-2414, slip op. at 4 (C.D. Ill. July 16, 1990) (holding disclosure of investigative report to persons at arbitration hearing is proper under routine use permitting disclosure of “record relating to a case or matter” in a “hearing in accordance with the procedures governing such proceeding or hearing”); Choe v. Smith, No. C-87-1764R, slip op. at 10-11 (W.D. Wash. Apr. 20, 1989) (discussing INS’s disclosure to its informant during investigation “to elicit information required by the Service to carry out its functions and statutory mandates”), aff’d, 935 F.2d 274 (9th Cir. 1991) (unpublished table decision); Brown v. FBI, No. 87-C-9982, 1988 WL 79653, at *1 (N.D. Ill. July 25, 1988) (discussing disclosure of rap sheet to local police department); Ely v. DOJ, 610 F. Supp. 942, 945-46 (N.D. Ill. 1985) (discussing disclosure to plaintiff’s lawyer), aff’d, 792 F.2d 142 (7th Cir. 1986) (unpublished table decision); Kimberlin v. DOJ, 605 F. Supp. 79, 82-83 (N.D. Ill. 1985) (discussing BOP’s disclosure of prisoner’s commissary account record to probation officer), aff’d, 788 F.2d 434 (7th Cir. 1986); Burley v. DEA, 443 F. Supp. 619, 623-24 (M.D. Tenn. 1977) (analyzing transmittal of DEA records to state pharmacy board); Harper v. United States, 423 F. Supp. 192, 198-99 (D.S.C. 1976) (analyzing IRS’s disclosure of plaintiff’s identity to other targets of investigation); see also Gowan v. Air Force, 148 F.3d 1182, 1187, 1194 (10th Cir. 1998) (stating where a disclosure of information regarding individual to Members of Congress in response to inquiries made pursuant to individual’s letters requesting assistance is compatible and thus “would likely be protected under the routine use exception”).  But cf. Sussman v. Marshals Serv., 494 F.3d 1106, 1122-23 (D.C. Cir. 2007) (vacating grant of summary judgment to Marshals Service because plaintiff’s allegations that agents were “‘yelling and screaming [their allegations and theories in an effort to intimidate]’ suggests disclosures went beyond what was ‘necessary to obtain information or cooperation’” within terms of published routine use); Brunotte v. Johnson, 892 F. Supp. 2d 199, 207 (D.D.C. 2012) (finding “unclear on the current record” whether disclosure to prospective employer of plaintiff’s prior “alleged travel reimbursement infractions” to “see if [p]laintiff had perpetrated another fraud by submitting false employment application information” was “compatible with the purpose for which the information was collected”).

Four courts have required an agency to invoke its routine use to permit disclosure to unions of names of employees on the theory that refusal to so disclose was an unfair labor practice under the National Labor Relations Act.  See NLRB v. USPS, No. 92-2358, 1994 WL 47743, at *3-4 (4th Cir. Feb. 16, 1994); NLRB v. USPS, 888 F.2d 1568, 1572-73 (11th Cir. 1989); NLRB v. USPS, 841 F.2d 141, 144-45 & n.3 (6th Cir. 1988); NLRB v. USPS, 790 F. Supp. 31, 33 (D.D.C. 1992); see also USPS v. Nat’l Ass’n of Letter Carriers, 9 F.3d at 141-46 (holding that “if Postal Service could disclose the information under [its routine use] then it must disclose that information, because in the absence of a Privacy Act defense the arbitrator’s award must be enforced,” but remanding case for determination as to whether proper (e)(3)(C) notice was given before requiring invocation of routine use); FLRA v. Navy, 966 F.2d 747, 761-65 (3d Cir. 1992) (alternative holding) (en banc) (holding that the release to union of home addresses of bargaining unit employees pursuant to routine use was required under Federal Service Labor-Management Relations Act).  But cf. NLRB v. USPS, 660 F.3d 65, 70-72 (1st Cir. 2011) (ruling that USPS routine use for disclosure “[a]s required by applicable law . . . to a labor organization” did not require automatic disclosure of aptitude tests to union because National Labor Relations Act did not require that disclosure, but instead NLRB was required to balance “the interests of the union in the information against the privacy interests of the employees”).

In addition, the Court of Appeals for the District of Columbia Circuit, in Air Force v. FLRA, granted enforcement of a Federal Labor Relations Authority decision requiring the Air Force to disclose to a union a disciplinary letter that was issued to a bargaining unit employee’s supervisor.  104 F.3d 1396, 1399, 1401-02 (D.C. Cir. 1997).  The court held that the Federal Labor-Management Relations Statute required disclosure of the letter, and that because the “union’s request f[ell] within the Act’s ‘routine use’ exception, the Privacy Act d[id] not bar disclosure,” and that the union therefore was entitled to disclosure of the letter.  Id. at 1401-02.

Apart from the FOIA (see subsection (b)(2)) and the Debt Collection Act (see subsection (b)(12)), the Privacy Act makes no provision for any nonconsensual disclosures that are provided for by other statutes.  See, e.g., 42 U.S.C. § 653 (2006) (establishing “Parent Locator Service” and requiring agencies to comply with requests from Secretary of HHS for addresses and places of employment of absent parents “[n]otwithstanding any other provision of law”).  Recognizing this difficulty, the OMB Guidelines advise that “[s]uch disclosures, which are in effect congressionally mandated ‘routine uses,’ should still be established as ‘routine uses’ pursuant to subsections (e)(11) and (e)(4)(D).”  OMB Guidelines, 40 Fed. Reg. at 28,954, available at http://www.whitehouse.gov/sites/default/files/omb/assets/omb/inforeg/implementation_guidelines.pdf; cf. Zahedi v. DOJ, No. 10-694, 2011 WL 1872206, at *5-6 (D. Or. May 16, 2011) (holding that plaintiff’s “claim, for improper dissemination, fails both because the disclosure was authorized by [a foreign-intelligence sharing] statute and because the dissemination [falls] within the published routine uses” of the agencies).

4. 5 U.S.C. § 552a(b)(4) (Bureau of the Census)

“to the Bureau of the Census for purposes of planning or carrying out a census or survey or related activity pursuant to the provisions of Title 13.”

Comment:

For a discussion of this provision, see OMB Guidelines, 40 Fed. Reg. 28,948, 28,954 (July 9, 1975), available at http://www.whitehouse. gov/sites/default/files/omb/assets/omb/inforeg/implementation_guidelines.pdf.

5. 5 U.S.C. § 552a(b)(5) (statistical research)

“to a recipient who has provided the agency with advance adequate written assurance that the record will be used solely as a statistical research or reporting record, and the record is to be transferred in a form that is not individually identifiable.”

Comment:

The term “statistical record” is defined in the Act as a record that is not used in making individual determinations.  5 U.S.C. § 552a(a)(6).  One might question whether this exception to subsection (b) is anomalous:  The information it permits to be released is arguably not a “record,” see 5 U.S.C. § 552a(a)(4), or a “disclosure,” see 5 U.S.C. § 552a(b), in the first place as it is not identifiable to any individual.  However, the OMB Guidelines provide a plausible explanation for this unique provision:  “One may infer from the legislative history and other portions of the Act that an objective of this provision is to reduce the possibility of matching and analysis of statistical records with other records to reconstruct individually identifiable records.”  OMB Guidelines, 40 Fed. Reg. 28,948, 28,954 (July 9, 1975), available at http://www.whitehouse.gov/sites/default/files/ omb/assets/omb/inforeg/implementation_guidelines.pdf.

6. 5 U.S.C. § 552a(b)(6) (National Archives)

“to the National Archives and Records Administration as a record which has sufficient historical or other value to warrant its continued preservation by the United States Government, or for evaluation by the Archivist of the United States or the designee of the Archivist to determine whether the record has such value.”

Comment:

For a discussion of this provision, see OMB Guidelines, 40 Fed. Reg. 28,948, 28,955 (July 9, 1975), available at http://www.whitehouse. gov/sites/default/files/omb/assets/omb/inforeg/implementation_guidelines.pdf. 

7. 5 U.S.C. § 552a(b)(7) (law enforcement request)

“to another agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States for a civil or criminal law enforcement activity if the activity is authorized by law, and if the head of the agency or instrumentality has made a written request to the agency which maintains the record specifying the particular portion desired and the law enforcement activity for which the record is sought.”

Comment:

This provision, in addition to providing for disclosures to federal law enforcement agencies, also allows an agency, “upon receipt of a written request, [to] disclose a record to another agency or unit of State or local government for a civil or criminal law enforcement activity.”  OMB Guidelines, 40 Fed. Reg. 28,948, 28,955 (July 9, 1975), available at http://www.whitehouse.gov/sites/default/files/omb/assets/omb/inforeg/implementation_guidelines.pdf.

Note that the request must be submitted in writing and generally must be from the head of the agency or instrumentality.  See Doe v. DiGenova, 779 F.2d 74, 85 (D.C. Cir. 1985); Doe v. Naval Air Station, 768 F.2d 1229, 1232-33 (11th Cir. 1985); see also Reyes v. Supervisor of DEA, 834 F.2d 1093, 1095 (1st Cir. 1987); United States v. Collins, 596 F.2d 166, 168 (6th Cir. 1979); Stafford v. SSA, 437 F. Supp. 2d 1113, 1121 (N.D. Cal. 2006); SEC v. Dimensional Entm’t Corp., 518 F. Supp. 773, 775 (S.D.N.Y. 1981).

Record-requesting authority may be delegated down to lower-level agency officials when necessary, but not below the “section chief” level.  See OMB Guidelines, 40 Fed. Reg. at 28,955; see also 120 Cong. Rec. 36,967 (1974), reprinted in Source Book at 958, available at http://www.loc.gov/rr/frd/Military_Law/pdf/LH_privacy_act-1974.pdf.  The Department of Justice has delegated record-requesting authority to the “head of a component or a United States Attorney, or either’s designee.”  28 C.F.R. § 16.40(c) (2014); cf. Lora v. INS, No. 2:02cv756, 2002 WL 32488472, at *2 (E.D. Va. Oct. 8, 2002) (applying subsection (b)(7) to disclosure of information from INS file upon request of Assistant United States Attorney), aff’d per curiam, 61 F. App’x 80 (4th Cir. 2003).

8. 5 U.S.C. § 552a(b)(8) (health or safety of an individual)

“to a person pursuant to a showing of compelling circumstances affecting the health or safety of an individual if upon such disclosure notification is transmitted to the last known address of such individual.”

Comment:

For cases discussing this provision, see Schwarz v. INTERPOL, No. 94-4111, 1995 U.S. App. LEXIS 3987, at *6 n.2 (10th Cir. Feb. 28, 1995) (finding unsubstantiated allegations alone do not constitute “showing of compelling circumstances”); Stafford v. SSA, 437 F. Supp. 2d 1113, 1121 (N.D. Cal. 2006) (finding exception not satisfied because agency did not provide requisite notice to plaintiff after disclosing reason that plaintiff received disability benefits to state child protective services for purpose of investigating possible child abuse); Schwarz v. Treasury, 131 F. Supp. 2d 142, 146-47 (D.D.C. 2000) (citing and agreeing with Schwarz v. INTERPOL), summary affirmance granted, No. 00-5453 (D.C. Cir. May 10, 2001); and DePlanche v. Califano, 549 F. Supp. 685, 703-04 (W.D. Mich. 1982) (emphasizing emergency nature of exception). 

According to the OMB Guidelines, the individual about whom records are disclosed “need not necessarily be the individual whose health or safety is at peril; e.g., release of dental records on several individuals in order to identify an individual who was injured in an accident.”  OMB Guidelines, 40 Fed. Reg. 28,948, 28,955 (July 9, 1975), available at http://www.whitehouse.gov/sites/default/files/omb/assets/omb/inforeg/implementation_guidelines.pdf.  This construction, while certainly sensible as a policy matter, appears to conflict somewhat with the actual wording of subsection (b)(8).

9. 5 U.S.C. § 552a(b)(9) (Congress)

“to either House of Congress, or, to the extent of matter within its jurisdiction, any committee or subcommittee thereof, any joint committee of Congress or subcommittee of any such joint committee.”

Comment:

This exception does not authorize the disclosure of a Privacy Act-protected record to an individual Member of Congress acting on his or her own behalf or on behalf of a constituent.  See OMB Guidelines, 40 Fed. Reg. 28,948, 28,955 (July 9, 1975), available at http://www.whitehouse.gov/sites/default/files/omb/assets/omb/inforeg/implementation_guidelines.pdf; 40 Fed. Reg. 56,741, 56,742 (Nov. 21, 1975), available at http://www.whitehouse.gov/sites/default/

files/omb/assets/omb/inforeg/implementation1974.pdf; see also Swenson v. USPS, 890 F.2d 1075, 1077 (9th Cir. 1989); Lee v. Dearment, No. 91-2175,1992 WL 119855, at *2 (4th Cir. June 3, 1992); cf. Chang v. Navy, 314 F. Supp. 2d 35, 45-47 (D.D.C. 2004) (discussing subsection (b)(9), but ultimately finding disclosure to be proper pursuant to routine use permitting disclosure to Members of Congress making inquiries on behalf of constituents).  See generally FOIA Update, Vol. V, No. 1, at 3-4, available at http://www.justice.gov/oip/foia_updates/Vol_V_1/page3.htm (“Congressional Access Under FOIA”) (interpreting counterpart provision of FOIA).

The Court of Appeals for the Second Circuit in Devine v. United States, in holding that the unsolicited disclosure of an Inspector General letter to a congressional subcommittee chairman and member fell “squarely within the ambit of § 552a(b)(9),” rejected the appellant’s argument that subsection (b)(9) should not apply if the government agency knew or should have known that the information would eventually be released to the public.  202 F.3d 547, 551-53 (2d Cir. 2000).

10. 5 U.S.C. § 552a(b)(10) (General Accountability Office)

“to the Comptroller General, or any of his authorized representatives, in the course of the performance of the duties of the G[overnment] Account[ability] Office.”

11. 5 U.S.C. § 552a(b)(11) (court order)

“pursuant to the order of a court of competent jurisdiction.”

Comment:

This exception – like the subsection (b)(3) routine use exception – has generated a great deal of uncertainty.  Unfortunately, neither the Act’s legislative history, see 120 Cong. Rec. 36,959 (1974), reprinted in Source Book at 936, available at http://www.loc.gov/rr/frd/Military_Law/pdf/LH_privacy_act-1974.pdf, nor the OMB Guidelines, see 40 Fed. Reg. 28,948, 28,955 (July 9, 1975), available at http://www.whitehouse.gov/sites/default/files/omb/assets/omb/inforeg/implementation_guidelines.pdf, shed light in its meaning.

As a general proposition, it appears that the essential point of this exception is that the Privacy Act “cannot be used to block the normal course of court proceedings, including court-ordered discovery.”  Clavir v. United States, 84 F.R.D. 612, 614 (S.D.N.Y. 1979); see also, e.g., United States v. Revland, No. 5:05-2212, 2011 U.S. Dist. LEXIS 137756, at *3 (E.D.N.C. Nov. 30, 2011); Vinzant v. United States, No. 2:06-cv-10561, 2010 WL 2674609, at *7 (E.D. La. June 30, 2010) (stating that where the defendant agency objected to disclosing Privacy Act records requested in discovery, “the ‘court order exception’ to the Privacy Act will preclude any future liability for disclosure, thereby alleviating the government’s concern and nullifying its objection”); Rogers v. England, 246 F.R.D. 1, 3 n.6 (D.D.C. 2007); In re Katrina Canal Breaches Consol. Litig., No. 05-4182, 2007 WL 1959193, at *6 (E.D. La. June 27, 2007); Martin v. United States, 1 Cl. Ct. 775, 780-82 (Cl. Ct. 1983); Newman v. United States, No. 81-2480, slip op. at 3 (D.D.C. Sept. 13, 1982); B & H Towing, 2006 WL 1728044, at *5 (S.D. W. Va. June 23, 2006). 

5 U.S.C. § 552a(b)(11) permits disclosure of information by a court order.  See e.g., United States v. Burge, No. 08-CR-846, 2014 U.S. Dist. LEXIS 8856, at *5 (N.D. Ill. Jan. 24, 2014); Cazorla v. Koch Foods of Miss., No. 3:11-CV-391, 2014 U.S. Dist. LEXIS 11536, at *6 (S.D. Miss. Jan. 24, 2014); Sanders v. Lahood, No. C11-04391, 2013 U.S. Dist. LEXIS 75529, at *2 (N.D. Cal. May 29, 2013).   “However, [it] does not provide a basis for federal jurisdiction. Rather, it identifies an exception to the general rule under the Privacy Act” that no record may be disclosed except with the consent of the individual to whom the record pertains.  Sheetz v. Marti, No. 10-10844, 2010 WL 2034775, at *1 (D. Mass. May 19, 2010) (stating that “in the absence of federal question jurisdiction . . . , diversity jurisdiction . . . , or some other statutory grant of jurisdiction, this court lacks authority to issue a subpoena” against a federal agency for records the plaintiff sought in connection with his divorce proceedings); see also Haydon Bros. Contracting, Inc. v. SSA, No. 7:11-96, 2012 WL 38608, at *2-4 (E.D. Ky. Jan. 9, 2012) (stating that where plaintiff was seeking a (b)(11) order to require an agency to disclose a third party’s records, “the Privacy Act permits disclosure of an individual’s records pursuant to a court order, it does not provide expressly for a private right of action to obtain such an order,” and “implying a civil remedy . . . is not consistent with the legislative scheme of the Privacy Act.”).

What Does “Court Order” Mean? 

In Doe v. DiGenova, 779 F.2d 74, 77-85 (D.C. Cir. 1985), the Court of Appeals for the District of Columbia Circuit decisively ruled that a subpoena routinely issued by a court clerk – such as a federal grand jury subpoena – is not a “court order” within the meaning of this exception because it is not “specifically approved” by a judge.  Cf. Ricoma v. Standard Fire Ins. Co., No. 5:12-CV-18, 2013 WL 1164499, at *1 n. 2 (E.D.N.C. Mar. 20, 2013) (finding proposed subpoena deficient on other grounds, discussing request for subpoena to be signed by a judge in accordance with subsection (b)(11)); Hoffman v. Astrue, No. 3:10-CV-00214, 2011 WL 195617, at *4 (W.D. Ky. Jan. 18, 2011) (ruling that agency need not comply with state court subpoena to disclose records because all 12 exceptions under Privacy Act are “inapposite”).  Prior to Doe v. DiGenova, a split of authority existed on this point.  Compare Bruce v. United States, 621 F.2d 914, 916 (8th Cir. 1980) (dictum) (finding subpoena is not court order), and Stiles v. Atlanta Gas Light Co., 453 F. Supp. 798, 800 (N.D. Ga. 1978) (same), with Adams v. United States Lines, No. 80-0952, slip op. at 2-3 (E.D. La. Mar. 16, 1981) (finding subpoena is court order).  Cf. Moore v. USPS, 609 F. Supp. 681, 682 (E.D.N.Y. 1985) (finding subpoena is court order where it is required to be approved by judge under state law).

Note that an agency cannot avoid the result in Doe v. DiGenova by relying on a routine use that seeks to authorize disclosure pursuant to a subpoena.  See Doe v. Stephens, 851 F.2d 1457, 1465-67 (D.C. Cir. 1988) (discussing above under routine use exception).

What is the Standard for Issuance of a Court Order?

Unlike similar provisions in other federal confidentiality statutes, see, e.g., 42 U.S.C. § 290dd-2 (2006) (listing “good cause” factors to be weighed by court in evaluating applications for orders permitting disclosure of records pertaining to substance abuse), subsection (b)(11) contains no standard governing the issuance of an order authorizing the disclosure of otherwise protected Privacy Act information.  However, several courts have addressed the issue with varying degrees of clarity.  It has been held, for example, that because the Privacy Act does not itself create a qualified discovery “privilege,” a showing of “need” is not a prerequisite to initiating discovery of protected records.  See Laxalt v. McClatchy, 809 F.2d 885, 888-90 (D.C. Cir. 1987); see also Weahkee v. Norton, 621 F.2d 1080, 1082 (10th Cir. 1980) (noting that objection to discovery of protected records “does not state a claim of privilege”); Ala. & Gulf Coast Ry., LLC v. United States, No. CA 10-0352, 2011 WL 1838882, at *3-5 (S.D. Ala. May 13, 2011) (citing Laxalt in determining relevance of personnel files); Bosaw v. NTEU, 887 F. Supp. 1199, 1215-17 (S.D. Ind. 1995) (citing Laxalt with approval, although ultimately determining that court did not have jurisdiction to rule on merits of case); Ford Motor Co. v. United States, 825 F. Supp. 1081, 1083 (Ct. Int’l Trade 1993) (“[T]he Privacy Act does not establish a qualified discovery privilege that requires a party seeking disclosure under 5 U.S.C. § 552a(b)(11) to prove that its need for the information outweighs the privacy interest of the individual to whom the information relates.”); Clavir v. United States, 84 F.R.D. at 614 (“[It] has never been suggested that the Privacy Act was intended to serve as a limiting amendment to . . . the Federal Rules of Civil Procedure.”); cf. Baldrige v. Shapiro, 455 U.S. 345, 360-62 (1981) (holding that Census Act constitutes statutorily created discovery “privilege” because it precludes all disclosure of raw census data despite need demonstrated by litigant).

Rather, the D.C. Circuit’s decision in Laxalt v. McClatchy establishes that the only test for discovery of Privacy Act-protected records is “relevance” under Rule 26(b)(1) of the Federal Rules of Civil Procedure.  809 F.2d at 888-90; see also, e.g., Riascos-Hurtado v. United States, No. 09-CV-0003, 2011 U.S. Dist. LEXIS 28008, at *1 (E.D.N.Y. Mar. 17, 2011) (citing Laxalt and granting plaintiff’s motion to compel production of background investigation of former agency employee, which was “relevant to the action and may be relied upon by Plaintiffs in opposing the Government’s motion” to dismiss); Buechel v. United States, No. 08-132, 2010 WL 3310243, at *1 (S.D. Ill. Aug. 19, 2010); R.T. Vanderbilt Co. v. United States, No. 95-283, 2010 WL 2706282, at *6 (Fed. Cl. July 8, 2010); SEC v. Gowrish, No. C 09-05883, 2010 WL 1929498, at *2 (N.D. Cal. May 12, 2010); Stiward v. United States, No. 05-1926, 2007 WL 2417382, at *1 (E.D. La. Aug. 24, 2007); Ezell v. Potter, No. 2:01 CV 637, 2006 WL 1094558, at *2 (N.D. Ind. Mar. 16, 2006); Hassan v. United States, No. C05-1066C, 2006 WL 681038, at *2 (W.D. Wash. Mar. 15, 2006); Snyder v. United States, No. 02-0976, 2003 WL 21088123, at *2-3 (E.D. La. May 12, 2003); Lynn v. Radford, No. 99-71007, 2001 WL 514360, at *3 (E.D. Mich. Mar. 16, 2001); Anderson v. Cornejo, No. 97 C 7556, 2001 WL 219639, at *3 (N.D. Ill. Mar. 6, 2001); Hernandez v. United States, No. 97-3367, 1998 WL 230200, at *2-3 (E.D. La. May 6, 1998); Forrest v. United States, No. 95-3889, 1996 WL 171539, at *2 (E.D. Pa. Apr. 11, 1996); Bosaw, 887 F. Supp. at 1216-17 (citing Laxalt with approval, although ultimately determining that court did not have jurisdiction to rule on merits of case); Ford Motor Co., 825 F. Supp. at 1083-84; Mary Imogene Bassett Hosp. v. Sullivan, 136 F.R.D. 42, 49 (N.D.N.Y. 1991); O’Neill v. Engels, 125 F.R.D. 518, 520 (S.D. Fla. 1989); Murray v. United States, No. 84-2364, slip op. at 1-3 (D. Kan. Feb. 21, 1988); Broderick v. Shad, 117 F.R.D. 306, 312 (D.D.C. 1987); Smith v. Regan, No. 81-1401, slip op. at 1-2 (D.D.C. Jan. 9, 1984); In re Grand Jury Subpoenas Issued to USPS, 535 F. Supp. 31, 33 (E.D. Tenn. 1981); Christy v. United States, 68 F.R.D. 375, 378 (N.D. Tex. 1975). 

Courts have also assessed whether orders should be granted by balancing the potential harm to the affected party from disclosure without restrictions and the need of the requesting party for the particular information.  See Perry v. State Farm Fire & Cas. Co., 734 F.2d 1441, 1447 (11th Cir. 1984) (asserting that requests for court orders “should be evaluated by balancing the need for the disclosure against the potential harm to the subject of the disclosure”); Verrill v. Battelle Energy Alliance, No. 4:12-cv-00628, 2013 WL 5816632, at *2 (D. Idaho Oct. 28, 2013) (finding that either the standard of “relevancy” or the standard “balancing the need for the disclosure against the potential harm to the subject of the disclosure” was met and that harm to third-parties is limited since the request is “narrowly circumscribed to involve only their performance reviews and documents pertaining to any investigation surrounding their termination” and that the protective order would ensure the confidentiality of the information); Hall v. Hous. Auth. of Cnty. of Marin, No. 12-04922, 2013 WL 5695813, at *3 (N.D. Cal. Oct. 18, 2013) (finding that “Plaintiffs’ need for the information [to support claim seeking relief under 42 U.S.C. § 1983 for alleged violations of the U.S. Housing Act] outweighs any privacy interests, especially in light of the Protective Order and other steps, such as redaction, that can be taken to reduce privacy concerns.”); Gutierrez v. Benavides, 292 F.R.D. 401, 404-06 (S.D. Tex. 2013) (finding that “in determining whether to grant a protective order, the court must balance the requesting party’s need for the information against the injury that might result if uncontrolled disclosure if compelled” and “[t]hrough this balancing process, courts should afford due weight to the affected party’s privacy interest”; determining that personnel records of federal employees not constituting “‘records indicating official misconduct, abuse of power, or constitutional violations’ are to be protected from public disclosure”); Am. Modern Select Ins. Co. v. Sutherland, No. CV-12-S-1681, 2013 WL 1767827, at *2-3 (N.D. Ala. Apr. 18, 2013) (granting limited order for production of  documents as plaintiff, an insurance company, “had a clear need for some of the documents in order to properly develop its arson defense”, which outweighed any potential harm to defendant, especially considering the limited scope of order); United States v. Meyer, No. 2:11-cr-43, 2011 U.S. Dist. LEXIS 94270, at *1 (M.D. Fla. Aug. 23, 2011) (granting an order after “balanc[ing] the need for disclosure against the potential harm from disclosure”); In re Becker v. Becker, No. 09-70173, 2010 WL 3119903, at *4 (Bnkr. W.D. Tex. Aug. 6, 2010) (ruling that although the court was “authorized to order discovery of confidential records, it must balance the public interest in avoiding harm from disclosure against the benefits of providing relevant evidence”); Newman, No. 81-2480, slip op. at 3 (D.D.C. Sept. 13, 1982) (evaluating “legitimacy” of discovery requests and “need” for records as factors governing issuance of court order); cf. Hounshel v. Battelle Energy Alliance, LLC, No. 4:11-CV-00635, 2013 WL 5375833, at *2 (D. Idaho Sept. 24, 2013) (finding that “[r]esolution of a privacy objection requires a balancing of the need for the information sought against the privacy right asserted” and granting a limited order allowing plaintiff access to third-party mental health records of employees of defendant); Ibrahim v. DHS, No. 06-00545, 2013 WL 1703367, at 6 (N.D. Cal. Apr. 19, 2013) (ordering disclosure under protective order and stating that the “government may redact documents only to remove information relating to third parties who are private individuals and who are unrelated to plaintiff and her claims (relating to her challenge of being placed on government watch lists)”).  But cf. FDK Am., Inc. v. United States, No. 11-00385, 2014 Ct. Int’l Trade LEXIS 37, at *7-16 (Ct. Int’l Trade Apr. 4, 2014) (finding that motion for a protective order be held in abeyance pending certification by plaintiff of third-party’s identity who has control or ownership of the documents the plaintiff seeks, and subsequent determination of whether the third-party provides consent, or is located outside the territorial jurisdiction of the court).

However, it is important to note that a protective order limiting discovery under Rule 26(c) of the Federal Rules of Civil Procedure (based, if appropriate, upon a court’s careful in camera inspection) is a proper procedural device for protecting particularly sensitive Privacy Act-protected records when subsection (b)(11) court orders are sought.  See Laxalt, 809 F.2d at 889-90; see also, e.g., Sanders v. Lahood, No. C11-04391, 2013 U.S. Dist. LEXIS 75529, at *2 (N.D. Cal. May 29, 2013) (“[T]he Protective Order in place in this case should adequately protect any confidential information produced in response to the narrowed requests.”); Minshew v. Donley, No. 2:10-CV-01593, 2013 U.S. Dist. LEXIS 37873, at *3 (D. Nev. Mar. 19, 2013) (permitting “redaction of exhibits containing [p]laintiff’s personal identification including her address and social security number”); SEC v. Kovzan, No. 11-2017, 2013 WL 647300, at *5 (D. Kan. Feb. 21, 2013) (noting that the Privacy Act was intended to limit the Federal Rules of Civil Procedure and stating “this court typically approves protective orders directing the release of information coming within the protections of the Privacy Act.”); Nguyen v. Winter, 756 F. Supp. 2d 128, 129 (D.D.C. 2010) (stating that “[p]ersonnel files cannot be produced without a Privacy Act protective order”); Buechel v. United States, 2010 WL 3310243, at *3-4 (issuing protective order to address defendant’s concern that “institutional safety militates against disclosure of information regarding exposure to MRSA within [Federal correctional institution]”); SEC v. Gowrish, 2010 WL 1929498, at *3 (ordering production of Privacy Act-protected documents, but fashioning protective order permitting redaction of information disclosure of which “may compromise any ongoing, unrelated criminal investigation,” while simultaneously requiring submission of unredacted copies for in camera review); United States v. Chromatex, Inc., No. 91-1501, 2010 WL 2696759, at *5 (M.D. Pa. July 6, 2010) (ordering disclosure in camera to “allow the court to determine whether a protected order pursuant to the Privacy Act may properly be issued”); Sala v.  Hawk, No. 1:008-cv-63, 2009 U.S. Dist. LEXIS 82176, at *1-7 (D.V.I. Sept. 4, 2009) (establishing rules to be followed in order to protect privacy of DEA employees and to facilitate discovery “[p]ursuant to 5 U.S.C. § 552a(b)(11) and Fed. R. Civ. P. 26(c)”); Sattar v. Gonzales, No. 07-cv-02698, 2009 WL 2207691, at *1-2 (D. Colo. July 20, 2009) (granting defendants’ motion for a protective order where plaintiff sought discovery of documents that defendants claimed were protected by the Act); Lopez v. Chula Vista Police Dep’t, No. 07 CV 01272, 2008 WL 8178681, at *1 (S.D. Cal. Oct. 21, 2008) (issuing a (b)(11) protective order to govern disclosure of Privacy Act records concerning ongoing investigations of certain immigration crimes and that may reveal confidential informant and investigatory techniques and methods); In re Katrina Canal Breaches Consol. Litig., No. 05-4182, 2007 WL 1959193, at *6 (E.D. La. June 27, 2007) (ordering that materials containing “sensitive personal information” protected by Privacy Act be treated as “‘CONFIDENTIAL INFORMATION’ pursuant to the Master Protective Order”); Boudreaux v. United States, No. 97-1592, 1999 WL 499911, at *1-2 (E.D. La. July 14, 1999) (recognizing relevancy of subsection (b)(11) to court’s resolution of dispute over motion to compel responses to production of documents subject to Privacy Act, but ordering in camera review of documents so that legitimacy of agency objections may be determined “in the considered and cautious manner contemplated by the Privacy Act”); Gary v. United States, No. 3:97-cv-658, 1998 U.S. Dist. LEXIS 16722, at *10-11 (E.D. Tenn. Sept. 4, 1998) (finding that while third party’s personnel file may contain relevant information, disclosure of that file must be made pursuant to protective order); Bustillo v. Hawk, No. 97-WM-445, 1998 WL 299980, at *4-6 (D. Colo. May 28, 1998) (ordering defendant to provide United States Marshals Service with addresses of individually named defendants for service of process on behalf of inmate and ordering that addresses be safeguarded by Marshals Service); Hernandez, No. 97-3367, 1998 WL 230200, at *2-3 (E.D. La. May 6, 1998) (granting motion to compel agency to produce individual’s personnel file “which is likely to contain information ‘relevant to the subject matter involved in the pending action,’” but accommodating “legitimate privacy and confidentiality concerns” with protective order); Wright v. United States, No. 95-0274, 1996 WL 525324 (D.D.C. Sept. 10, 1996) (establishing procedures to be followed by parties “[i]n order to permit the parties to use information relevant to th[e] case without undermining the legislative purposes underlying the Privacy Act” and Rule 26 of the Federal Rules of Civil Procedure); Bergman v. Shinseki, No. 11-2665, 2012 U.S. Dist. LEXIS 127883, at *1 (D. Kan. Sept. 10, 2012) (issuing protective order pursuant to Rule 26(c) and 5 U.S.C. §552(b)(11) in order to protect “the privacy of the Plaintiff, and the VA’s current and former employees; and other individuals about whom the Plaintiff, the Defendant, and other sources possess protected information, against unreasonable and unprotected disclosure of information pertaining to them, and in accordance with the provisions and objectives of the Privacy Act of 1974”); Bosaw, 887 F. Supp. at 1216-17 (citing Laxalt with approval, although ultimately determining that court did not have jurisdiction to rule on merits of case); PHE, Inc. v. DOJ, No. 90-0693, slip op. at 13 & accompanying order (D.D.C. Nov. 14, 1991); Mary Imogene Bassett Hosp. v. Sullivan, 136 F.R.D. at 49; Avirgan v. Hull, Misc. No. 88-0112, slip op. at 1-3 (Bankr. D.D.C. May 2, 1988); Baron & Assocs. v. Army, No. 84-2021, slip op. at 2-4 (D.D.C. Apr. 1, 1985); Granton v. HHS, No. 83-C-3538, 1984 U.S. Dist. LEXIS 19113, at *2-3 (N.D. Ill. Feb. 27, 1984); White House Vigil for the ERA Comm. v. Watt, No. 83-1243, slip op. at 1-3 (D.D.C. Oct. 14, 1983); LaBuguen v. Bolger, No. 82-C-6803, 1983 U.S. Dist. LEXIS 13559, at *1-3 (N.D. Ill. Sept. 21, 1983) (order); Clymer v. Grzegorek, 515 F. Supp. 938, 942 (E.D. Va. 1981); cf. Brown v. Narvais, No. CIV-06-228-F, 2009 WL 2230774, at *3 (W.D. Okla. July 22, 2009) (recommending that parties agree to a protective order to protect privacy interests of subject of information where plaintiff served subpoena on BOP seeking disclosure of Privacy Act-protected information); Forrest, 1996 WL 171539, at *2-3 (ordering parties to “explore the possibility of entering into a voluntary confidentiality agreement regarding protecting the privacy interests of those individuals affected by disclosure”); Loma Linda Cmty. Hosp. v. Shalala, 907 F. Supp. 1399, 1405 (C.D. Cal. 1995) (“Even if release of the data . . . had unexpectedly included information not already known to [the recipient], a confidentiality order could have been imposed to protect the privacy interests in issue.”); Williams v. McCausland, No. 90 Civ. 7563, 1992 WL 309826, at *3 (S.D.N.Y. Oct. 15, 1992) (directing parties to agree on and execute appropriate protective stipulation for information sought in discovery that, under Privacy Act’s subsection (b)(2) standard, would not be required to be disclosed under FOIA).  But cf. Jacobs v. Schiffer, 204 F.3d 259, 264-66 & n.5 (D.C. Cir. 2000) (recognizing superiority of First Amendment rights and “[o]bserving that there is a “critical distinction between disclosures in the attorney-client context and public disclosures,” and pointing to the attorney’s “willingness to enter into a protective order” as relevant to the balancing of “the employee’s interests in communication with the government’s interests in preventing communication” where the information that an employee wished to disclose to his private attorney was covered by the Privacy Act).

In some instances, it even may be appropriate for a court to entirely deny discovery.  See, e.g., Farnsworth v. Proctor & Gamble Co., 758 F.2d 1545, 1546-48 (11th Cir. 1985); In re Becker, 2010 WL 3119903, at *4; Weems v. Corr. Corp. of Am., No. CIV-09-443, 2010 WL 2640114, at *2 (E.D. Okla. June 30, 2010); Oslund v. United States, 125 F.R.D. 110, 114-15 (D. Minn. 1989); cf. Padberg v. McGrath-McKenchnie, No. 00-3355, 2007 WL 2295402, at *2 (E.D.N.Y. Aug. 9, 2007) (declining to decide “whether a court may ever order a government agency to disclose social security numbers despite the provisions of [the Social Security Act],” and refusing to order disclosure of social security numbers of class members who have not submitted claim forms pursuant to settlement agreement); Barnett v. Dillon, 890 F. Supp. 83, 88 (N.D.N.Y. 1995) (declining to order disclosure of FBI investigative records protected by Privacy Act to arrestees despite their assertion that records were essential to proper prosecution and presentment of claims in their civil rights lawsuit).

In Redland Soccer Club, Inc. v. Army, No. 1:CV-90-1072, slip op. 1-3 & accompanying order (M.D. Pa. Jan. 14, 1991), aff’d, rev’d & remanded, on other grounds, 55 F.3d 827 (3d Cir. 1995), the district court, recognizing the “defendants’ initial reluctance to respond to plaintiffs’ [discovery] requests without a specific order of court [as] a reasonable precaution in light of the terms of the Privacy Act,” solved the dilemma by ordering the Army to respond to “all properly framed discovery requests in th[e] proceeding” and that such responses were to “be deemed made pursuant to an order of court.”  Id.  See also Long Island Sav. Bank v. United States, 63 Fed. Cl. 157, 159-160 (Fed. Cl. 2004) (concluding that “[t]he exception in the Privacy Act for actions taken under court order is satisfied here” because scheduling order “specifically incorporated [a provision of the local rules]” requiring parties to exchange “witness lists containing the addresses and telephone numbers of each witness”).

Must an Agency Obtain a Court Order to Publicly File Protected Records with the Court?

As noted above, the Act’s legislative history indicates that a court is not a “person” or “agency” within the meaning of subsection (b), and that the Act was “not designed to interfere with access to information by the courts.”  120 Cong. Rec. 36,967 (1974), reprinted in Source Book at 958-59, available at http://www.loc.gov/rr/frd/Military_Law/pdf/LH_privacy_act-1974.pdf.

However, the nonconsensual public filing of protected records with a court, during the course of litigation, does constitute a subsection (b) disclosure.  See Laningham v. Navy, No. 83-3238, slip op. at 2-3 (D.D.C. Sept. 25, 1984), summary judgment granted (D.D.C. Jan. 7, 1985), aff’d per curiam, 813 F.2d 1236 (D.C. Cir. 1987); Citizens Bureau of Investigation v. FBI, No. 78-60, slip op. at 3 (N.D. Ohio Dec. 14, 1979).  Thus, such public filing is proper only if it is undertaken pursuant to:  (1) the subsection (b)(3) routine use exception (previously discussed), or (2) the subsection (b)(11) court order exception.  See generally Krohn v. DOJ, No. 78-1536, slip op. at 3-11 (D.D.C. Mar. 19, 1984) (finding violation of Privacy Act where agency’s disclosure of records as attachments to affidavit in FOIA lawsuit “did not fall within any of the exceptions listed in Section 552a”), reconsideration granted & vacated in nonpertinent part, (D.D.C. Nov. 29, 1984).

Where the routine use exception is unavailable, an agency should obtain a subsection (b)(11) court order permitting such public filing.  Cf. Doe v. DiGenova, 779 F.2d at 85 n.20 (“This is not to say that a prosecutor, a defendant, or a civil litigant, cannot submit an in camera ex parte application for a [subsection (b)(11)] court order.”).  However, in light of Laningham, No. 83-3238, slip op. at 2-3 (D.D.C. Sept. 25, 1984), agencies should take care to apprise the court of the Privacy Act-related basis for seeking the order.  In Laningham, the district court ruled that the government’s nonconsensual disclosure of plaintiff’s “disability evaluation” records to the United States Claims Court was improper – even though such records were filed only after the agency’s motion for leave to file “out of time” was granted.  Id.  The court held that subsection (b)(11) applies only when “for compelling reasons, the court specifically orders that a document be disclosed,” and it rejected the agency’s argument that the exception applies whenever records happen to be filed with leave of court.  Id. at 4.

One unique solution to the problem of filing Privacy Act-protected records in court is illustrated by In re A Motion for a Standing Order, in which the Court of Veterans Appeals issued a “standing order” permitting the Secretary of Veterans Affairs to routinely file relevant records from veterans’ case files in all future proceedings with that court.  1 Vet. App. 555, 558-59 (Ct. Vet. App. 1990) (per curiam); cf. Perkins v. United States, No. 99-3031, 2001 WL 194928, at *3 (D.D.C. Feb. 21, 2001) (authorizing parties to seek admission into evidence at trial in that case of any materials subject to stipulated protective order pursuant to subsection (b)(11)).

What Does “Competent Jurisdiction” Mean?

One of the few Privacy Act decisions to even mention this oft-overlooked requirement is Laxalt v. McClatchy, 809 F.2d at 890-91.  In that case, the Court of Appeals for the District of Columbia Circuit appeared to equate the term “competent jurisdiction” with personal jurisdiction, noting that the requests for discovery of the nonparty agency’s records “were within the jurisdiction of the District Court for the District of Columbia” as “[n]either party contends that the District Court lacked personal jurisdiction over the FBI’s custodian of records.”  Id.

Of course, where an agency is a proper party in a federal case, the district court’s personal jurisdiction over the agency presumably exists and thus court-ordered discovery of the agency’s records is clearly proper under subsection (b)(11).

However, where a party seeks discovery of a nonparty agency’s records – pursuant to a subpoena duces tecum issued under Rule 45 of the Federal Rules of Civil Procedure – Laxalt suggests that the district court issuing the discovery order must have personal jurisdiction over the nonparty agency in order to be regarded as a court of “competent jurisdiction” within the meaning of subsection (b)(11).  See 809 F.2d at 890-91; cf. Mason v. S. Bend Cmty. Sch. Corp., 990 F. Supp. 1096, 1097-99 (N.D. Ind. 1997) (determining that SSA’s regulations “generally do not authorize the release of . . . records upon order of a court, even a federal court, in the absence of a special circumstance as defined by the statutes and regulations” and thus finding SSA not to be in contempt of court for failure to comply with prior order compelling SSA, a nonparty, to produce documents).  But cf. Lohrenz v. Donnelly, 187 F.R.D. 1, 8-9 (D.D.C. 1999) (finding that requisite showing of good cause had been made by nonparty agency, and providing for entry of protective order with no discussion of jurisdiction over nonparty agency).  The issue of whether personal jurisdiction exists in this kind of situation is not always a clear-cut one – particularly where the nonparty agency’s records are kept at a place beyond the territorial jurisdiction of the district court that issued the discovery order.  Indeed, this very issue was apparently raised but not decided in Laxalt, 809 F.2d at 890-91 (finding it unnecessary to decide whether federal district court in Nevada would have had jurisdiction to order discovery of FBI records located in District of Columbia). 

The existence of “competent jurisdiction” is likewise questionable whenever a state court orders the disclosure of a nonparty federal agency’s records – because ordinarily the doctrine of “sovereign immunity” will preclude state court jurisdiction over a federal agency or official.  See, e.g., Bosaw, 887 F. Supp. at 1210-17 (finding state court lacked jurisdiction to order federal officers to produce documents because government did not explicitly waive its sovereign immunity and, because federal court’s jurisdiction in this case was derivative of state court’s jurisdiction, federal court was likewise barred from ordering officers to produce documents); Boron Oil Co. v. Downie, 873 F.2d 67, 70-71 (4th Cir. 1989) (holding state court subpoena constitutes “action” against United States and thus sovereign immunity applied even though EPA was not party in suit); Sharon Lease Oil Co. v. FERC, 691 F. Supp. 381, 383-85 (D.D.C. 1988) (holding state court subpoena quashed as state court lacked jurisdiction to compel nonparty federal official to testify or produce documents absent waiver of sovereign immunity); see also Moore v. Armour Pharm. Co., 129 F.R.D. 551, 555 (N.D. Ga. 1990) (citing additional cases on point); cf. Louisiana v. Sparks, 978 F.2d 226, 235 n.15 (5th Cir. 1992) (noting that “[t]here is no indication that [subsection (b)(11)] evinces congressional intent to broadly waive the sovereign immunity of [federal] agencies . . . when ordered to comply with state court subpoenas”); Longtin v. DOJ, No. 06-1302, 2006 WL 2223999, at *2-3 (D.D.C. Aug. 3, 2006) (citing Sparks and rejecting plaintiff’s argument that subsection (b)(11) is a “sweeping waiver of sovereign immunity”; concluding that “neither the Superior Court of the District of Columbia nor the Circuit Court for Prince George’s County, Maryland constitute[s] a ‘court of competent jurisdiction’ . . . to issue an order compelling a federal official to comply with a state court subpoena”). 

Nevertheless, in Robinett v. State Farm Mut. Auto. Ins. Co., No. 02-0842, 2002 WL 31498992, at *3-4 (E.D. La. Nov. 7, 2002), aff’d per curiam, 83 F. App’x 638 (5th Cir. 2003), the district court looked to subsection (b)(11) and held that State Farm “properly obtained” an order from the state court for release of plaintiff’s medical records where “plaintiff’s medical condition was relevant to the litigation,” and that the Department of Veterans Affairs’ “determination that plaintiff’s records were subject to release based on the court order . . . was therefore correct.”  The district court’s holding in Robinett was affirmed per curiam by the Court of Appeals for the Fifth Circuit, which specifically stated that the medical records were “released pursuant to the exception for orders of a court of competent jurisdiction contained in 5 U.S.C. § 552a(b)(11).”  83 F. App’x at 639; see also Moore v. USPS, 609 F. Supp. 681, 682 (E.D.N.Y. 1985) (assuming without explanation that state court subpoena, required by state law to be approved by judge, constituted proper subsection (b)(11) court order; issue of “competent jurisdiction” was not addressed); cf. Henson v. Brown, No. 95-213, slip op. at 4-5 (D. Md. June 23, 1995) (stating that judge’s signature elevated subpoena to court order within meaning of subsection (b)(11) in context of determining whether defendant complied with order). 

In addition, at least one state court has ruled that it has “competent jurisdiction” to issue a subsection (b)(11) court order permitting the disclosure of a Privacy Act-protected record.  Tootle v. Seaboard Coast Line R.R., 468 So. 2d 237, 239 (Fla. Dist. Ct. App. 1984); cf. Saulter v. Mun. Court for the Oakland-Piedmont Judicial Dist., 142 Cal. App. 3d 266, 275 (Cal. Ct. App. 1977) (suggesting that state court can order state prosecutor to subpoena federal records for purpose of disclosing them to criminal defendant in discovery).

Agencies that construe state court orders as providing authority to disclose under subsection (b)(11) should be aware that compliance with such an order might be taken by a court as acquiescence to the court’s jurisdiction, notwithstanding applicable principles of sovereign immunity.

12. 5 U.S.C. § 552a(b)(12) (Debt Collection Act)

“to a consumer reporting agency in accordance with section 3711(e) of Title 31.”       

Comment:

This disclosure exception was added to the original eleven exceptions by the Debt Collection Act of 1982.  It authorizes agencies to disclose bad-debt information to credit bureaus.  Before doing so, however, agencies must complete a series of due process steps designed to validate the debt and to offer the individual an opportunity to repay it.  See OMB Guidelines, 48 Fed. Reg. 15,556-60 (Apr. 11, 1983), available at http://www.whitehouse.gov/sites/default/files/omb/assets/omb/inforeg/guidance1983.pdf.