Attachment_0023_R21_-_Privacy_Act_1974.pdf

UNITED STATES DEPARTMENT OF JUSTICE

OVERVIEW OF THE PRIVACY ACT OF 1974

2015 Edition

Preface

The “Overview of the Privacy Act of 1974,” prepared by the Department of Justice’s Office of Privacy and Civil Liberties (OPCL), is a discussion of the Privacy Act’s disclosure prohibition, its access and amendment provisions, and its agency recordkeeping requirements.

Tracking the provisions of the Act itself, the Overview provides reference to and legal analysis of court decisions interpreting the Act’s provisions. The Overview is not intended to provide policy guidance, as that role statutorily rests with the Office of Management and Budget (OMB), 5 U.S.C. § 552a(v).

However, where OMB has issued policy guidance on particular provisions of the Act, citation to such guidance is provided in the Overview. The 2015 edition of the Overview was issued electronically and sent for publication in July 2015 and includes cases through May 2014.

OPCL is very pleased to provide this updated revision of the Overview, and could not have done so without the commitment of OPCL’s dedicated staff. OPCL would particularly like to recognize: the written and editorial contributions of OPCL Senior Counsel Alex Wood, who carefully shepherded the publication of this edition from beginning to end; the written and editorial assistance of its volunteer interns Yasmin Emrani, Meryl Kanofsky, Kaiya Lyons, Craig Wesoly, Hannah Mayer, Danielle Prongay, and Kelly Singleton; the management of the publication process by its program specialist Pamela A. Moye; and last, but certainly not least, the invaluable written and editorial contributions of its former Director, Joo Y. Chung, who led this edition to completion before her departure from the Department of Justice. This 2015 edition of the Overview is specifically dedicated to her.

Without the valuable assistance of these individuals, the completion of this endeavor would not have been possible.

Kristi Lane Scott Acting Director Office of Privacy and Civil Liberties

U.S. Department of Justice

OVERVIEW OF THE PRIVACY ACT OF 1974

(2015 Edition)

TABLE OF CONTENTS

INTRODUCTION

LEGISLATIVE HISTORY

ROLE OF THE PRIVACY PROTECTION STUDY COMMISSION

ROLE OF THE OFFICE OF MANAGEMENT AND BUDGET

COMPUTER MATCHING

POLICY OBJECTIVES

DEFINITIONS

A. Agency B. Individual C. Maintain D. Record E. System of Records

1. Disclosure: Subsection (b)

2. Access and Amendment: Subsections (d)(1) and (d)(2)

3. Other Aspects

CONDITIONS OF DISCLOSURE TO THIRD PARTIES

A. The "No Disclosure Without Consent" Rule B. Twelve Exceptions to the "No Disclosure Without Consent" Rule

1. 5 U.S.C. § 552a(b)(1) ("need to know" within agency)

2. 5 U.S.C. § 552a(b)(2) (required FOIA disclosures)

3. 5 U.S.C. § 552a(b)(3) (routine uses)

4. 5 U.S.C. § 552a(b)(4) (Bureau of the Census)

5. 5 U.S.C. § 552a(b)(5) (statistical research)

6. 5 U.S.C. § 552a(b)(6) (National Archives)

7. 5 U.S.C. § 552a(b)(7) (law enforcement request)

8. 5 U.S.C. § 552a(b)(8) (health or safety of an individual)

9. 5 U.S.C. § 552a(b)(9) (Congress)

10. 5 U.S.C. § 552a(b)(10) (Government Accountability Office)

11. 5 U.S.C. § 552a(b)(11) (court order)

12. 5 U.S.C. § 552a(b)(12) (Debt Collection Act)

ACCOUNTING OF CERTAIN DISCLOSURES

INDIVIDUAL'S RIGHT OF ACCESS

INDIVIDUAL'S RIGHT OF AMENDMENT

AGENCY REQUIREMENTS

A. 5 U.S.C. § 552a(e)(1) B. 5 U.S.C. § 552a(e)(2) C. 5 U.S.C. § 552a(e)(3) D. 5 U.S.C. § 552a(e)(4) E. 5 U.S.C. § 552a(e)(5) F. 5 U.S.C. § 552a(e)(6) G. 5 U.S.C. § 552a(e)(7) H. 5 U.S.C. § 552a(e)(8) I. 5 U.S.C. § 552a(e)(9) J. 5 U.S.C. § 552a(e)(10) K. 5 U.S.C. § 552a(e)(11)

AGENCY RULES

A. 5 U.S.C. § 552a(f)(1) B. 5 U.S.C. § 552a(f)(2) C. 5 U.S.C. § 552a(f)(3) D. 5 U.S.C. § 552a(f)(4) E. 5 U.S.C. § 552a(f)(5)

CIVIL REMEDIES

A. Amendment Lawsuits under 5 U.S.C. § 552a(g)(1)(A)

1. Exhaustion of Administrative Remedies

2. Court Review

B. Access Lawsuits under 5 U.S.C. § 552a(g)(1)(B) C. Damages Lawsuits under 5 U.S.C. § 552a(g)(1)(C) D. Damages Lawsuits under 5 U.S.C. § 552a(g)(1)(D) E. Principles Applicable to Damages Lawsuits

1. Intentional/Willful Standard

2. Actual Damages

F. Principles Applicable to All Privacy Act Civil Actions

1. Attorney Fees and Costs

2. Jurisdiction and Venue

3. Statute of Limitations

4. Jury Trial

CRIMINAL PENALTIES

TEN EXEMPTIONS

A. One Special Exemption — 5 U.S.C. § 552a(d)(5)

B. Two General Exemptions — 5 U.S.C. § 552a(j)(1) and (j)(2) C. Seven Specific Exemptions — 5 U.S.C. § 552a(k)

1. 5 U.S.C. § 552a(k)(1)

2. 5 U.S.C. § 552a(k)(2)

3. 5 U.S.C. § 552a(k)(3)

4. 5 U.S.C. § 552a(k)(4)

5. 5 U.S.C. § 552a(k)(5)

6. 5 U.S.C. § 552a(k)(6)

7. 5 U.S.C. § 552a(k)(7)

SOCIAL SECURITY NUMBER USAGE

GOVERNMENT CONTRACTORS

MAILING LISTS

MISCELLANEOUS PROVISIONS

TEXT OF THE PRIVACY ACT OF 1974

OVERVIEW OF THE PRIVACY ACT

[1]

Office of Privacy and Civil Liberties

INTRODUCTION

The Privacy Act of 1974, 5 U.S.C. § 552a (2012), which has been in effect since September 27, 1975, can generally be characterized as an omnibus “code of fair information practices” that attempts to regulate the collection, maintenance, use, and dissemination of personal information by federal executive branch agencies. However, the Act’s imprecise language, limited legislative history, and somewhat outdated regulatory guidelines have rendered it a difficult statute to decipher and apply. Moreover, even after more than forty years of administrative and judicial analysis, numerous Privacy Act issues remain unresolved or unexplored. Adding to these interpretational difficulties is the fact that many earlier Privacy Act cases are unpublished district court decisions. A particular effort is made in this “Overview” to clarify the existing state of Privacy Act law while at the same time highlighting those controversial, unsettled areas where further litigation and case law development can be expected.

LEGISLATIVE HISTORY

The entire legislative history of the Privacy Act is contained in a convenient, one-volume compilation. See House Comm. on Gov’t Operations and Senate Comm. on Gov’t Operations, 94th Cong., 2d Sess., Legislative History of the Privacy Act of 1974 – S. 3418 (Pub. L. No. 93-579) Source Book on Privacy (1976) [hereinafter Source Book], available at http://www.loc.gov/rr/frd/Military_Law/pdf/LH_privacy_act-1974.pdf. The Act was passed in great haste during the final week of the Ninety-Third Congress. No conference committee was convened to reconcile differences in the bills passed by the House and Senate. Instead, staffs of the respective committees – led by Senators Ervin and Percy, and Representatives` Moorhead and Erlenborn – prepared a final version of the bill that was ultimately enacted.

The original reports are thus of limited utility in interpreting the final statute; the more reliable legislative history consists of a brief analysis of the compromise amendments – entitled “Analysis of House and Senate Compromise Amendments to the Federal Privacy Act” – prepared by the staffs of the counterpart Senate and House committees and submitted in both the House and Senate in lieu of a conference report. See 120 Cong. Rec. 40,405-09, 40,881- 83 (1974), reprinted in Source Book at 858-68, 987-94, available at http://www.loc.gov/ rr/frd/Military_Law/pdf/LH_privacy_act-1974.pdf.

ROLE OF THE PRIVACY PROTECTION STUDY COMMISSION

Section 5 of the original Privacy Act established the “U.S. Privacy Protection Study Commission” to evaluate the statute and to issue a report containing recommendations for its improvement. The Commission issued its final report and ceased operation in 1977. See U.S.

Privacy Protection Study Commission, Personal Privacy in an Information Society (1977) [hereinafter Privacy Commission Report], available at http://epic.org/privacy/ppsc1977report.

See generally Doe v. Chao, 540 U.S. 615, 622-23 (2004) (looking to mandate and recommendation of Privacy Protection Study Commission in connection with legislative history to interpret Privacy Act damages provision).

[2]

Office of Privacy and Civil Liberties

ROLE OF THE OFFICE OF MANAGEMENT AND BUDGET

Subsection (v) of the Privacy Act requires the Office of Management and Budget (OMB) to:

(1) “develop and, after notice and opportunity for public comment, prescribe guidelines and regulations for the use of agencies in implementing” the Act; and (2) “provide continuing assistance to and oversight of the implementation” of the Act by agencies. 5 U.S.C.

§ 552a(v).

The vast majority of OMB’s Privacy Act Guidelines [hereinafter OMB Guidelines] are published at 40 Fed. Reg. 28,948-78 (July 9, 1975), available at http://www.whitehouse.gov/ sites/default/files/omb/assets/omb/inforeg/implementation_guidelines.pdf. However, these original guidelines have been supplemented in particular subject areas over the years. See 40 Fed. Reg. 56,741-43 (Nov. 21, 1975), available at http://www.whitehouse.gov/sites/ default/files/omb/assets/omb/inforeg/implementation1974.pdf (“system of records” definition, routine use and intra-agency disclosures, consent and Congressional inquiries, accounting of disclosures, amendment appeals, rights of parents and legal guardians, relationship to Freedom of Information Act (FOIA)); 48 Fed. Reg. 15,556-60 (Apr. 11, 1983), available at http://www.whitehouse.gov/sites/default/files/omb/assets/omb/inforeg/guidance1983.pdf (relationship to Debt Collection Act); 52 Fed. Reg. 12,990-93 (Apr. 20, 1987), available at http://www.whitehouse.gov/sites/default/files/omb/assets/omb/inforeg/guidance_privacy_act.

pdf (“call detail” programs); 54 Fed. Reg. 25,818-29 (June 19, 1989), available at http://www.whitehouse.gov/sites/default/files/omb/inforeg/final_guidance_pl100-503.pdf (computer matching); 56 Fed. Reg. 18,599-601 (proposed Apr. 23, 1991), available at http://www.whitehouse.gov/sites/default/files/omb/assets/omb/inforeg/computer_amendments 1991.pdf (computer matching); 61 Fed. Reg. 6,428, 6,435-39 (Feb. 20, 1996) (“Federal Agency Responsibilities for Maintaining Records About Individuals”), available at http://www.whitehouse.gov/omb/circulars_a130_a130appendix_i. See also, e.g., OMB Circular No. A-130 – Memorandum for Heads of Executive Departments and Agencies, Subject: Management of Federal Information Resources, 61 Fed. Reg. 6428 (Feb. 20, 1996), as amended, 65 Fed. Reg. 77,677 (Dec. 12, 2000), available at http://www.gpo.gov/fdsys/pkg/FR-2000-12-12/pdf/00-31507.pdf.

As a general rule, the OMB Guidelines are entitled to the deference usually accorded the interpretations of the agency that has been charged with the administration of a statute. See Sussman v. Marshals Serv., 494 F.3d 1106, 1120 (D.C. Cir. 2007). In Sussman, the Court of Appeals for the District of Columbia Circuit discussed this standard: “Congress explicitly tasked the OMB with promulgating guidelines for implementing the Privacy Act, and we therefore give the OMB Guidelines ‘the deference usually accorded interpretation of a statute by the agency charged with its administration.’” Id. (citing Albright v. United States, 631 F.2d 915, 920 n.5 (D.C. Cir. 1980)) (citation omitted). With regard to the 1975 guidelines, the court stated: “The OMB apparently invited no public comment prior to publishing its guidelines, and after we decided Albright, Congress pointedly replaced its original grant of authority to the OMB with one that expressly required the OMB to respect such procedural niceties before its guidelines could be binding. But Congress made clear the change was not

[3]

Office of Privacy and Civil Liberties meant to disturb existing guidelines. Hence, the old OMB Guidelines still deserve the same level of deference they enjoyed prior to the 1998 amendment.” Sussman, 494 F.3d at 1120 n.8 (citations omitted). Numerous cases have applied this standard of deference. See, e.g., Maydak v. United States, 363 F.3d 512, 518 (D.C. Cir. 2004); Henke v. Commerce, 83 F.3d 1453, 1460 n.12 (D.C. Cir. 1996); Quinn v. Stone, 978 F.2d 126, 133 (3d Cir. 1992); Baker v.

Navy, 814 F.2d 1381, 1383 (9th Cir. 1987); Perry v. FBI, 759 F.2d 1271, 1276 n.7 (7th Cir.

1985), rev’d en banc on other grounds, 781 F.2d 1294 (7th Cir. 1986); Bartel v. FAA, 725 F.2d 1403, 1408 n.9 (D.C. Cir. 1984); Smiertka v. Treasury, 604 F.2d 698, 703 n.12 (D.C. Cir.

1979); Whitaker v. CIA, 31 F. Supp. 3d 23, 47-48 (D.D.C. 2014); Rogers v. Labor, 607 F.

Supp. 697, 700 n.2 (N.D. Cal. 1985); Sanchez v. United States, 3 Gov’t Disclosure Serv. (P- H) ¶ 83,116, at 83,709 (S.D. Tex. Sept. 10, 1982); Golliher v. USPS, 3 Gov’t Disclosure Serv.

(P-H) ¶ 83,114, at 83,703 (N.D. Ohio June 10, 1982); Greene v. VA, No. C-76-461-S, slip op.

at 6-7 (M.D.N.C. July 3, 1978); Daniels v. FCC, No. 77-5011, slip op. at 8-9 (D.S.D. Mar. 15, 1978); see also Martin v. Office of Special Counsel, 819 F.2d 1181, 1188 (D.C. Cir. 1987) (OMB interpretation is “worthy of our attention and solicitude”).

However, a few courts have rejected particular aspects of the OMB Guidelines as inconsistent with the statute. See Doe v. Chao, 540 U.S. at 620 n.11 (disagreeing with dissent’s reliance on OMB interpretation of damages provision and stating that Court does “not find its unelaborated conclusion persuasive”); Scarborough v. Harvey, 493 F. Supp. 2d 1, 13-14 n.28 (D.D.C. 2007) (personal/entrepreneurial distinction); Henke v. Commerce, No. 94-0189, 1996 WL 692020, at *2-3 (D.D.C. Aug. 19, 1994) (same), aff’d on other grounds, 83 F.3d 1445 (D.C. Cir. 1996); Kassel v. VA, No. 87-217-S, slip op. at 24-25 (D.N.H. Mar. 30, 1992) (subsection (e)(3)); Saunders v. Schweiker, 508 F. Supp. 305, 309 (W.D.N.Y. 1981) (same);

Metadure Corp. v. United States, 490 F. Supp. 1368, 1373-74 (S.D.N.Y. 1980) (subsection (a)(2)); Fla. Med. Ass’n v. HEW, 479 F. Supp. 1291, 1307-11 (M.D. Fla. 1979) (same); Zeller

v. United States, 467 F. Supp. 487, 497-99 (E.D.N.Y. 1979) (same).

COMPUTER MATCHING

The Computer Matching and Privacy Protection Act of 1988 (Pub. L. No. 100-503) amended the Privacy Act to add several new provisions. See 5 U.S.C. § 552a(a)(8)-(13), (e)(12), (o), (p), (q), (r), (u) (2006). These provisions add procedural requirements for agencies to follow when engaging in computer-matching activities, provide matching subjects with opportunities to receive notice and to refute adverse information before having a benefit denied or terminated, and require that agencies engaged in matching activities establish Data Protection Boards to oversee those activities. These provisions became effective on December 31, 1989.

OMB’s guidelines on computer matching should be consulted in this area. See 54 Fed. Reg.

25,818-29 (June 19, 1989).

Subsequently, Congress enacted the Computer Matching and Privacy Protection Amendments of 1990 (Pub. L. No. 101-508), which further clarified the due process provisions found in subsection (p). OMB’s proposed guidelines on these amendments appear at 56 Fed. Reg.

18,599-601 (proposed Apr. 23, 1991), available at http://www.whitehouse.gov/sites/default/

[4]

Office of Privacy and Civil Liberties files/omb/assets/omb/inforeg/computer_amendments1991.pdf.

The highly complex and specialized provisions of the Computer Matching and Privacy Protection Act of 1988 and the Computer Matching and Privacy Protection Amendments of 1990 are not further addressed herein. For guidance on these provisions, agencies should consult the OMB Guidelines, cited above.

POLICY OBJECTIVES

Broadly stated, the purpose of the Privacy Act is to balance the government’s need to maintain information about individuals with the rights of individuals to be protected against unwarranted invasions of their privacy stemming from federal agencies’ collection, maintenance, use, and disclosure of personal information about them. The historical context of the Act is important for understanding its remedial purposes. In 1974, Congress was concerned with curbing the illegal surveillance and investigation of individuals by federal agencies that had been exposed during the Watergate scandal. It was also concerned with potential abuses presented by the government’s increasing use of computers to store and retrieve personal data by means of a universal identifier – such as an individual’s social security number. The Act focuses on four basic policy objectives:

(1) To restrict disclosure of personally identifiable records maintained by agencies.

(2) To grant individuals increased rights of access to agency records maintained on themselves.

(3) To grant individuals the right to seek amendment of agency records maintained on themselves upon a showing that the records are not accurate, relevant, timely, or complete.

(4) To establish a code of “fair information practices” that requires agencies to comply with statutory norms for collection, maintenance, and dissemination of records.

DEFINITIONS

A. Agency

“any Executive department, military department, Government corporation, Government controlled corporation, or other establishment in the executive branch of the [federal] Government (including the Executive Office of the President), or any independent regulatory agency.” 5 U.S.C. § 552a(1) (incorporating 5 U.S.C. § 552(f) (2006), which in turn incorporates 5 U.S.C.

§ 551(1) (2006)).

[5]

Office of Privacy and Civil Liberties

Comment:

The Privacy Act – like the Freedom of Information Act (FOIA), 5 U.S.C. § 552 – applies only to a federal “agency.” See OMB Guidelines, 40 Fed.

Reg. 28,948, 28,950-51 (July 9, 1975), available at http://www.whitehouse.

gov/sites/default/files/omb/assets/omb/inforeg/implementation_guidelines.pd f; 120 Cong. Rec. 40,408 (1974), reprinted in Source Book at 866, available at http://www.loc.gov/rr/frd/Military_Law/pdf/LH_privacy_act-1974.pdf (indicating intent that the Act apply to the Postal Service, Postal Rate Commission, and government corporations or government-controlled corporations); 120 Cong. Rec. 36,967 (1974), reprinted in Source Book at 958, available at http://www.loc.gov/rr/frd/Military_Law/pdf/ LH_privacy_act-1974.pdf (indicating intent that term “agency” be given “its broadest statutory meaning,” and, giving example of Department of Justice as an “agency,” recognizing propriety of subsection (b)(1) “need to know” disclosures between its various components); see also, e.g., In re Sealed Case, 551 F.3d 1047, 1049-50 (D.C. Cir. 2009) (concluding that “the Privacy Act’s definition of agency includes federally recognized National Guard units at all times” and not solely when the unit is on active federal duty);

United States v. Jackson, 381 F.3d 984, 989-90 (10th Cir. 2004) (citing Ehm, infra, and holding that Amtrak is not an “agency”); NLRB v. USPS, 841 F.2d 141, 144 n.3 (6th Cir. 1988) (Postal Service is an “agency” because it is an “independent establishment of the executive branch”); Ehm v. Nat’l R.R.

Passenger Corp., 732 F.2d 1250, 1252-55 (5th Cir. 1984) (Amtrak held not to constitute a “Government-controlled corporation”); Iqbal v. FBI, No.

3:11-cv-369, 2012 WL 2366634, at *4 (M.D. Fla. June 21, 2012) (declining to dismiss “just because the Plaintiff brought his claims against the FBI instead of the Department of Justice”); Cloonan v. Holder, 768 F. Supp. 2d 154, 162 (D.D.C. 2011) (“[N]aming components as defendants under the Privacy Act is appropriate since the statute’s plain language is clear that ‘an agency need not be a cabinet-level agency such as the DOJ to be liable.’” (quoting Lair v. Treasury, No. 03 Civ. 827, 2005 WL 645228 (D.D.C. Mar.

21, 2005)); Thompson v. State, 400 F. Supp. 2d 1, 21-22 (D.D.C. 2005) (finding Foreign Service Grievance Board to be an “agency” because it “consists of members appointed exclusively by an executive department, administers federal statutes, promulgates regulations, and adjudicates the rights of individuals”); Mumme v. Labor, 150 F. Supp. 2d 162, 169 (D. Me.

2001) (“[A] claimant bringing a Privacy Act claim must bring suit against a particular agency, not the entire United States.”), aff’d, No. 01-2256 (1st Cir.

June 12, 2002). But cf. Shannon v. Gen. Elec. Co., 812 F. Supp. 308, 313, 315 n.5 (N.D.N.Y. 1993) (“no dispute” that GE falls within definition of “agency” subject to requirements of Privacy Act where, pursuant to contract, it operated Department of Energy-owned lab under supervision, control, and oversight of Department and where by terms of contract GE agreed to

[6]

Office of Privacy and Civil Liberties comply with Privacy Act).

With regard to the White House, all courts have held that those components of the Executive Office of the President whose sole function is to advise and assist the President are not “agencies” for purposes of the Privacy Act. See Alexander v. FBI, 456 F. App’x 1, 2 (D.C. Cir. 2011) (per curiam), aff’g 691 F. Supp. 2d 182 (D.D.C. 2010) (determining that prior interpretation to the contrary in an earlier holding in the case (971 F. Supp. 603, 606-07 (D.D.C.

1997)) was “no longer the correct one”); Dale v. Exec. Office of the President, 164 F. Supp. 2d 22, 25-26 (D.D.C. 2001); Trulock v. DOJ, No.

00-2234, slip op. at 7 (D.D.C. Sept. 18, 2001); Tripp v. Exec. Office of the President, 200 F.R.D. 140, 142-46 (D.D.C. 2001), appeal dismissed per curiam, No. 01-5189, 2001 WL 1488614 (D.C. Cir. Oct. 17, 2001);

Broaddrick v. Exec. Office of the President, 139 F. Supp. 2d 55, 60 (D.D.C.

2001), aff’d per curiam, No. 01-5178 (D.C. Cir. May 1, 2002); Flowers v.

Exec. Office of the President, 142 F. Supp. 2d 38, 41-43 (D.D.C. 2001);

Jones v. Exec. Office of the President, 167 F. Supp. 2d 10, 13-20 (D.D.C.

2001); Sculimbrene v. Reno, 158 F. Supp. 2d 26, 35-36 (D.D.C. 2001);

Schwarz v. Treasury, 131 F. Supp. 2d 142, 147-48 (D.D.C. 2000), summary affirmance granted, No. 00-5453 (D.C. Cir. May 10, 2001); Falwell v. Exec.

Office of the President, 113 F. Supp. 2d 967, 968-70 (W.D. Va. 2000); Barr

v. Exec. Office of the President, No. 99-CV-1695, 2000 WL 34024118, at *3 (D.D.C. Aug. 9, 2000). In fact, the Court of Appeals for the D.C. Circuit observed that “Congress did not inadvertently omit the Offices of the President and Vice President from the Privacy Act’s disclosure requirements.” Wilson v. Libby, 535 F.3d 697, 708 (D.C. Cir. 2008).

Note also that federal entities outside of the executive branch, such as a federal district court, see Hankerson v. U.S. Dep’t of Prob. & Parole, No.

5:13-CV-78, 2014 WL 533495, at *1 (M.D. Ga. Feb. 7, 2014); Goddard v.

Whitmer, No. 09-CV-404, 2010 WL 116744, at *2 (E.D. Ky. Jan. 6, 2010), Cobell v. Norton, 157 F. Supp. 2d 82, 86 & n.6 (D.D.C. 2001), a grand jury, see Standley v. DOJ, 835 F.2d 216, 218 (9th Cir. 1987); United States v.

Richardson, No. 3:2001-10, 2007 U.S. Dist. LEXIS 77, at *3 (W.D. Pa. Jan.

3, 2007), a probation office, see Kates v. King, 487 F. App’x 704, 706 (3d Cir. 2012) (per curiam); United States v. Bullard, 337 F. App’x 215, 216 n.1 (3d Cir. 2009) (per curiam); Fuller-Avent v. Prob. Office, 226 F. App’x 1, 2 (D.C. Cir. 2006); Schwartz v. DOJ, No. 95-6423, 1996 WL 335757, at *1 (2d Cir. June 6, 1996); Morris v. Prob. Servs., 723 F. Supp. 2d 225, 227 (D.D.C. 2010); Bowles v. BOP, No. 08 CV 9591, 2010 WL 23326, at *3 (S.D.N.Y. Jan. 5, 2010); Jackson v. DOJ, No. 09-0846, 2009 WL 5205421, at *4 (D. Minn. Dec. 23, 2009); Kyles v. Kaufman, No. 08-4169, 2008 WL 4906141, at *1 (D.S.D. Nov. 14, 2008); Harrell v. BOP, No. 99-1619, slip

op. at 6 (W.D. Okla. Mar. 5, 2001), aff’d on other grounds sub nom. Harrell

[7]

Office of Privacy and Civil Liberties

v. Fleming, 285 F.3d 1292 (10th Cir. 2002); Callwood v. Dep’t of Prob. of the V.I., 982 F. Supp. 341, 343 (D.V.I. 1997), a county court, Duffy v. Kent Cnty. Levy Court, No. CIV.A. 09-198, 2013 WL 2477083, at *2 (D. Del.

June 10, 2013), or a federal bankruptcy court, see In re Adair, 212 B.R. 171, 173 (Bankr. N.D. Ga. 1997), are not subject to the Act. Similarly, the Smithsonian Institution, although having many “links” with the federal government, “is not an agency for Privacy Act purposes.” Dong v.

Smithsonian Inst., 125 F.3d 877, 879-80 (D.C. Cir. 1997); see also Dodge v.

Trs. of Nat’l Gallery of Art, 326 F. Supp. 2d 1, 10-11 (D.D.C. 2004) (finding that “the National Gallery is a Smithsonian Museum” and explaining that “Smithsonian Museums . . . are not subjected to the limitations of the Privacy Act because they do not fall within the definition of an ‘agency’”).

State and local government agencies are not covered by the Privacy Act.

See, e.g., N’Jai v. Pittsburgh Bd. of Public Educ., 487 F. App’x 735, 737 (3d Cir. 2012) (per curiam); Spurlock v. Ashley Cnty., 281 F. App’x 628, 629 (8th Cir. 2008); Schmitt v. City of Detroit, 395 F.3d 327, 331 (6th Cir.

2005); Perez-Santos v. Malave, 23 F. App’x 11, 12 (1st Cir. 2001) (per curiam); Dittman v. California, 191 F.3d 1020, 1026, 1029 (9th Cir. 1999);

Ortez v. Washington Cnty., Or., 88 F.3d 804, 811 (9th Cir. 1996); Brown v.

Kelly, No. 93-5222, 1994 WL 36144, at *1 (D.C. Cir. Jan. 27, 1994) (per curiam); Monk v. Teeter, No. 89-16333, 1992 WL 1681, at *2 (9th Cir. Jan.

8, 1992); Davidson v. Georgia, 622 F.2d 895, 896 (5th Cir. 1980); Williams

v. City of New York, No. 12 Civ. 8518, 2014 WL 1383661, at *15 (S.D.N.Y. Mar. 26, 2014); Lear v. Seattle Hous. Auth., No. C13–0347, 2014 WL 1089273, at *12 (W.D. Wash. Mar. 17, 2014); O’Connor v. Kelley, No.

3:10cv360, 2014 WL 1133522, at *11 (N.D. Fla. Mar. 21, 2014); Younger v.

Wright, No. 13CV289, 2014 WL 909664, at *6 (D. Conn. Mar. 7, 2014);

Daw v. Cowan, No. 3:11cv96, 2013 WL 5838683, at *10 (N.D. Fla. Oct. 30, 2013); Williams v. New York City Dep’t of Educ. for the City Sch. Dist., 12 Civ. 8518, 2013 WL 5226564, at *15 (S.D.N.Y. Sept. 17, 2013); Linder v.

Friedman, No. 1:12-cv-3051, 2012 WL 6633905, at *1 (D.S.C. Dec. 20, 2012); Dean v. City of New Orleans, No. 11-2209, 2012 WL 2564954, at *14 (E.D. La. July 2, 2012); Warnock v. City of Canton, S.D., No. 11-4023, 2012 WL 2050734, at *7 (D.S.D. June 7, 2012); Oliver v. Garfield Cnty.

Det. Facility, No. CIV-10-1281, 2012 WL 668802, at *3 (W.D. Okla. Feb. 8, 2012); Goins v. Beard, No. 09-1223, 2011 U.S. Dist. LEXIS 104442, at *28 (W.D. Pa. Sept. 15, 2011); Ervin v. Cal. Dep’t of Corr. & Rehab., No. 1:10-cv-01859, 2011 WL 3503181, at *5 (E.D. Cal. Aug. 10, 2011); Omegbu v.

United States, No. 10-C-765, 2011 WL 2912703, at *5 (E.D. Wis. July 18, 2011); Roggio v. City of Gardner, No. 10-40076, 2011 WL 1303141, at *7 (D. Mass. Mar. 30, 2011); Terry v. Town of Morristown, No. 06-1788, 2010 WL 3906938, at *6 (D.N.J. Sept. 30, 2010); Manuel v. City of Philadelphia, No. 10-2690, 2010 WL 3566767, at *9 (E.D. Pa. Sept. 14, 2010); Prepetit v.

[8]

Office of Privacy and Civil Liberties

Gov’t of D.C., No. 09 2183, 2009 WL 4405756, at *1 (D.D.C. Nov. 19, 2009); Study v. United States, No. 3:08cv493, 2009 WL 2340649, at *2 (N.D. Fla. July 24, 2009); Rouse v. City of New York, No. 08CV7419, 2009 WL 1532054, at *13 (S.D.N.Y. June 2, 2009); Banda v. Camden Cnty. Bd.

of Chosen Freeholders, No. 08-5115, 2009 WL 1561442, at *2 (D.N.J. May 29, 2009); Willis v. DOJ, 581 F. Supp. 2d 57, 67-68 (D.D.C. 2008);

Barickman v. Bumgardner, No. 1:07CV134, 2008 WL 2872712, at *3 (N.D.

W. Va. July 22, 2008); Gero v. Vt. Dep’t of Corr., No. 1:07-CV-145, 2008 WL 2439891, at *1 (D. Vt. June 16, 2008); Walsh v. Krantz, No. 1:07-CV- 0616, 2008 WL 2329130, at *5 (M.D. Pa. June 4, 2008); Dewille v. Ohio, No. 3:07cv3888, 2008 WL 440384, at *1 (N.D. Ohio Feb. 13, 2008);

Sturkey v. Ozmint, No. 8:07-1502, 2008 WL 373610, at *1 (D.S.C. Feb. 7, 2008); Allen v. Woodford, No. 05-1104, 2007 WL 309945, at *9 (E.D. Cal.

Jan. 30, 2007); Lawson v. Baxter, No. 4:06-CV-109, 2006 WL 3004069, at *3 (W.D. Mich. Oct. 20, 2006); Gabbard v. Hall Cnty., No. 7:06-CV-37, 2006 U.S. Dist. LEXIS 56662, at *4-5 (M.D. Ga. Aug. 14, 2006); Brandt v.

La Grange, No. 2:06 CV 1, 2006 WL 2120383, at *3 (E.D. Mo. July 27, 2006); Pitts v. Perkins Local Sch. Bd. of Educ., No. 1:05-CV-2226, 2006 WL 1050675, at *1 (N.D. Ohio Apr. 19, 2006); Fetzer v. Cambria Cnty.

Human Servs., 384 F. Supp. 2d 813, 816 (W.D. Pa. 2005); Cassidy v.

Rubitschun, No. 105-CV-350, 2005 WL 1335148, at *5 (W.D. Mich. June 2, 2005); Villa v. Vill. of Elmore, No. 3:02CV7357, 2002 WL 31728970, at *5 (N.D. Ohio Dec. 3, 2002), appeal dismissed sua sponte as untimely, No. 03- 3034 (6th Cir. Mar. 28, 2003); Daniel v. Safir, 175 F. Supp. 2d 474, 481 (E.D.N.Y. 2001) (although characterizing claims as under FOIA, dismissing Privacy Act claims against local agency), aff’d, 42 F. App’x 528 (2d Cir.

2002); Atamian v. Ellis, No. 00-797, 2001 WL 699016, at *3 (D. Del. June 19, 2001), aff’d, 35 F. App’x 356 (3d Cir. 2002) (unpublished table decision); Lampkin v. N.Y. City Dep’t of Prob., No. 00 Civ. 7165, 2001 WL 210362, at *2 (S.D.N.Y. Feb. 28, 2001); Markun v. Hillsborough Cnty.

Dep’t of Corr., No. 97-208, 1999 WL 813949, at *1 (D.N.H. Sept. 17, 1999);

McClain v. DOJ, No. 97 C 0385, 1999 WL 759505, at *2 (N.D. Ill. Sept. 1, 1999), aff’d, 17 F. App’x 471 (7th Cir. 2001); Ferguson v. Ala. Criminal Justice Info. Ctr., 962 F. Supp. 1446, 1446-47 (M.D. Ala. 1997); Williams v.

District of Columbia, No. 95CV0936, 1996 WL 422328, at *2-3 (D.D.C.

July 19, 1996); Martinson v. Violent Drug Traffickers Project, No. 95-2161, 1996 WL 411590, at *1-2 (D.D.C. July 11, 1996), summary affirmance granted, No. 96-5262 (D.C. Cir. Sept. 22, 1997); Mamarella v. Cnty. of Westchester, 898 F. Supp. 236, 237-38 (S.D.N.Y. 1995); Connolly v.

Beckett, 863 F. Supp. 1379, 1383-84 (D. Colo. 1994); MR by RR v.

Lincolnwood Bd. of Educ., Dist. 74, 843 F. Supp. 1236, 1239-40 (N.D. Ill.

1994), aff’d sub nom. Rheinstrom v. Lincolnwood Bd. of Educ., Dist. 74, No. 94-1357, 1995 U.S. App. LEXIS 10781 (7th Cir. May 10, 1995);

Malewich v. USPS, No. 91-4871, slip op. at 19 (D.N.J. Apr. 8, 1993), aff’d, [9]

Office of Privacy and Civil Liberties

27 F.3d 557 (3d Cir. 1994) (unpublished table decision); Shields v. Shetler, 682 F. Supp. 1172, 1176 (D. Colo. 1988); Ryans v. N.J. Comm’n, 542 F.

Supp. 841, 852 (D.N.J. 1982). But cf. Reno v. United States, No. 4- 94CIV243, 1995 U.S. Dist. LEXIS 12834, at *6 (W.D.N.C. Aug. 14, 1995) (holding national guard to be a state entity in case decided prior to In re Sealed Case, 551 F.3d 1047, 1049-50 (D.C. Cir. 2009), which held that all federally recognized national guard units, whether on active status or not, are “agencies”). Additionally, neither federal funding nor regulation converts such entities into covered agencies. See St. Michaels Convalescent Hosp. v.

California, 643 F.2d 1369, 1373 (9th Cir. 1981); Adelman v. Discover Card Servs., 915 F. Supp. 1163, 1166 (D. Utah 1996). The Act likewise does not apply to tribal entities. See Stevens v. Skenandore, No. 99-2611, 2000 WL 1069404, at *1 (7th Cir. Aug. 1, 2000) (no right of action against tribal officials under Privacy Act).

Similarly, private entities are not subject to the Act. See Probert v.

Kalamarides, 528 F. App’x 741, 742 (9th Cir. 2013); Johnson v. Mel Foster Co. Ins., 475 F. App’x 640, 640 (8th Cir. 2012) (per curiam); KGV Easy Leasing Corp. v. Leavitt, 413 F. App’x 966, 968 (9th Cir. 2011); Chimarev

v. TD Waterhouse Investor Servs., 99 F. App’x 259, 261-62 (2d Cir. 2004);

McLeod v. VA, 43 F. App’x 70, 71 (9th Cir. 2002); Sharwell v. Best Buy, No. 00-3206, 2000 WL 1478341, at *2 (6th Cir. Sept. 26, 2000); Sutton v.

Providence St. Joseph Med. Ctr., 192 F.3d 826, 844 (9th Cir. 1999); Mitchell

v. G.E. Am. Spacenet, No. 96-2624, 1997 WL 226369, at *1 (4th Cir. May 7, 1997); Gilbreath v. Guadalupe Hosp. Found., 5 F.3d 785, 791 (5th Cir.

1993); Rosado v. Herard, No. 12 Civ. 8943, 2014 WL 1303513, at *4 (S.D.N.Y. Mar. 25, 2014); Smith v. Citimortgage, Inc., No. 1:13-cv-2177, 2014 WL 279728, at *7 (N.D. Ga. Jan. 24, 2014); Curran v. Mark Zinnamosca & Assoc., No. 1:12-cv-750, 2014 WL 271634, at *10 (M.D. Pa.

Jan. 23, 2014); Todd v. Williamson, No. 2:13-cv-2359, 2014 U.S. Dist.

LEXIS 261, at *4-5 (E.D. Cal. Jan. 2, 2014); Metro. Life Ins. Co. v. Blyther, 964 F. Supp. 2d 61, 71 (D.D.C. 2013); Barnes v. Med. Dep’t, No. 13-cv- 00285, 2013 U.S. Dist. LEXIS 51298, at *3 (S.D. Ill. Apr. 10, 2013);

Repetto v. Magellan Health Servs., No. 12-4108, 2013 WL 1176470, at *5-6 (D. N.J. Mar. 19, 2013); Cardona v. Cmty. Access, Inc., No. 11–CV–4129, 2013 WL 304519, at *8 n. 12 (E.D.N.Y. Jan. 25, 2013); Sethunya v.

Monson, No. 2:12-CV-454, 2013 WL 65471, at *3 (D. Utah Jan. 4, 2013);

Abdelfattah v. DHS, 893 F. Supp. 2d 75, 81 n. 4 (D.D.C. 2012); Cintron- Garcia v. Supermercados Econo, Inc., 818 F. Supp. 2d 500, 510 (D.P.R.

2011); Chapman v. Wright Transp., No. CA 11-0097, 2011 U.S. Dist.

LEXIS 96913, at *6 n.4 (S.D. Ala. Aug. 10, 2011); Ariatti-Mangum v. Korb, No. 1:11-CV-149, 2011 U.S. Dist. LEXIS 58834, at *2-3 (D. Idaho June 1, 2011); Brooks v. AAA Cooper Transp., 781 F. Supp. 2d 472, 487-88 (S.D.

Tex. 2011); Nouri v. TCF Bank, No. 10-12436, 2011 WL 836764, at *4

[10]

Office of Privacy and Civil Liberties

(E.D. Mich. Mar. 9, 2011); DeConcini Family Trust v. Home Fed. Bank, No.

2:10-CV-258, 2011 WL 635257, at *1 (D. Utah Feb. 11, 2011); Wilkerson v.

H & S Lee, Inc., No. CV609-033, 2010 WL 2942635, at *2 (S.D. Ga. June 22, 2010), aff’d per curiam, 438 F. App’x 769 (11th Cir. 2011); Surgick v.

Cirella, No. 09-cv-3807, 2010 WL 2539418, at *5 (D.N.J. June 15, 2010);

Fox v. Cal. Franchise Tax Bd., No. 08-cv-01047, 2010 WL 56094, at *6 (D.

Colo. Jan. 5, 2010); Tyree v. Hope Village, Inc., 677 F. Supp. 2d 109, 110 (D.D.C. 2009); Johnson v. Homeownership Pres. Found., No. 09-600, 2009 WL 6067018, at *8-9 (D. Minn. Dec. 18, 2009); Lucido v. Mueller, No. 08- 15269, 2009 WL 3190368, at *5-6 (E.D. Mich. Sept. 29, 2009); Lengerich v.

Columbia Coll., 633 F. Supp. 2d 599, 607-08 (N.D. Ill. 2009); Shi v. Cent.

Ariz. Coll., No. 08-80131, 2008 WL 4001795, at *1 (N.D. Cal. Aug. 27, 2008); Wilson v. Benedict Coll., No. 3:05-3614, 2006 WL 2433794, at *4-5 (D.S.C. Aug. 21, 2006); McCullough v. BOP, No. 05CV374, 2006 WL 667166, at *1 (D.D.C. Mar. 15, 2006); Piper v. R.J. Corman R.R. Group, No. 05-CV-104, 2005 WL 1523566, at *8 (E.D. Ky. June 28, 2005); Locke

v. MedLab/Gen. Chem., No. 99-2137, 2000 WL 127111 (E.D. Pa. Feb. 3, 2000); Payne v. EEOC, No. 99-270, slip op. at 2-3 (D.N.M. July 7, 1999), aff’d, No. 00-2021, 2000 WL 1862659, at *2 (10th Cir. Dec. 20, 2000);

Davis v. Boston Edison Co., No. 83-1114-2, 1985 U.S. Dist. LEXIS 23275 (D. Mass. Jan. 21, 1985); Friedlander v. USPS, No. 84-773, slip op. at 5-6 (D.D.C. Oct. 16, 1984); Marshall v. Park Place Hosp., 3 Gov’t Disclosure Serv. (P-H) ¶ 83,088, at 83,057 (D.D.C. Feb. 25, 1983); see also Bybee v.

Pirtle, No. 96-5077, 1996 WL 596458, at *1 (6th Cir. Oct. 16, 1996) (appellant did not state claim under Privacy Act because it does not apply to individuals who refused to hire him due to his failure to furnish his social security number or fill out W-4 forms for income tax purposes); Steadman v.

Rocky Mountain News, No. 95-1102, 1995 U.S. App. LEXIS 34986, at *4 (10th Cir. Dec. 11, 1995) (Privacy Act claims “cannot be brought against defendant because defendant is not a governmental entity”); United States v.

Mercado, No. 94-3976, 1995 U.S. App. LEXIS 2054, at *3-4 (6th Cir. Jan.

31, 1995) (appellant’s retained defense counsel is not an “agency”).

Additionally, neither federal funding nor regulation renders such private entities subject to the Act. See Burch v. Pioneer Credit Recovery, Inc., 551 F.3d 122, 125 (2d Cir. 2008); Unt v. Aerospace Corp., 765 F.2d 1440, 1448 (9th Cir. 1985); Huertas v. Dep’t of Educ., No. 08-3959, 2009 WL 3165442, at *5 (D.N.J. Sept. 28, 2009); United States v. Haynes, 620 F. Supp. 474, 478-79 (M.D. Tenn. 1985); Dennie v. Univ. of Pittsburgh Sch. of Med., 589 F. Supp. 348, 351-52 (D.V.I. 1984), aff’d, 770 F.2d 1068 (3d Cir. 1985) (unpublished table decision); see also United States v. Miller, 643 F.2d 713, 715 n.1 (10th Cir. 1981) (finding that definition of “agency” does not encompass national banks); Boggs v. Se. Tidewater Opportunity Project, No.

2:96cv196, 1996 U.S. Dist. LEXIS 6977, at *5-9 (E.D. Va. May 22, 1996) (rejecting plaintiff’s argument concerning entity’s acceptance of federal

[11]

Office of Privacy and Civil Liberties funds and stating that “[i]t is well settled that the Administrative Procedures [sic] Act, 5 U.S.C. § 551 . . . applies only to Federal agencies”).

An exception to this rule, however, is the social security number usage restrictions, contained in section 7 of the Privacy Act, which do apply to federal, state, and local government agencies. Section 7, part of Pub. L. No.

93-579, can be found at 5 U.S.C. § 552a note (Disclosure of Social Security Number). This special provision is discussed below under “Social Security Number Usage.”

A civil action under the Privacy Act is properly filed against an “agency” only, not against an individual, a government official, an employee, or the United States. See, e.g., Jacobs v. BOP, No. 12-5129, 2012 WL 6603085, at *1 (D.C. Cir. Dec. 17, 2012) (per curiam); Kates v. King, 487 F. App’x 704, 706 (3d Cir. 2012) (per curiam); Flores v. Fox, 394 F. App’x 170, 172 (5th Cir. 2010) (per curiam); Jones v. Luis, 372 F. App’x 967, 969 (11th Cir.

2010) (per curiam); Weinberger v. Grimes, No. 07-6461, 2009 WL 331632, at *8 (6th Cir. Feb. 10, 2009); Alexander v. Washington Gas Light Co., No.

06-7040, 2006 WL 3798858, at *1 (D.C. Cir. Aug. 24, 2006); Martinez v.

BOP, 444 F.3d 620, 624 (D.C. Cir. 2006); Pennyfeather v. Tessler, 431 F.3d 54, 55 (2d Cir. 2005); Connelly v. Comptroller of the Currency, 876 F.2d 1209, 1215 (5th Cir. 1989); Petrus v. Bowen, 833 F.2d 581, 582-83 (5th Cir.

1987); Schowengerdt v. Gen. Dynamics Corp., 823 F.2d 1328, 1340 (9th Cir. 1987); Hewitt v. Grabicki, 794 F.2d 1373, 1377 & n.2 (9th Cir. 1986);

Unt. v. Aerospace Corp., 765 F.2d at 1447; Brown-Bey v. United States, 720 F.2d 467, 469 (7th Cir. 1983); Windsor v. The Tennessean, 719 F.2d 155, 159-60 (6th Cir. 1983); Bruce v. United States, 621 F.2d 914, 916 n.2 (8th Cir. 1980); Parks v. IRS, 618 F.2d 677, 684 (10th Cir. 1980); Younger v.

Wright, No. 13CV289, 2014 WL 909664, at *6 (D. Conn. Mar. 7, 2014);

Osborne v. United States, No. 3:14-cv-25, 2014 WL 309468, at *7 (W.D.N.C. Jan. 28, 2014); Christensen v. United States, No. 5:11-321, 2013 WL 4521040, at *12 (E.D. Ky. Aug. 26, 2013); Young v. Tryon, No. 2–CV– 6251, 2013 WL 2471543, at *6-7 (W.D.N.Y. June 7, 2013); Echols v.

Morpho Detection, Inc., No. 12-1581, 2013 WL 1501523, at *6-7 (N.D. Cal.

April 11, 2013); Carlile v. Shinseki, No. 3:12-cv-00151, 2013 WL 1145440, at *2 (D. Nev. Mar. 11, 2013); Sethunya v. Monson, No. 2:12-CV-454, 2013 WL 65471, at *3 (D. Utah Jan. 4, 2013); Crompton v. Hanson, No. 12-cv- 757, 2012 WL 5903088, at *3 (W.D. Wis. Nov. 26, 2012); Rice v. Holder, 898 F.Supp.2d 291, 293 (D.D.C. 2012); Padilla-Ruiz v. United States, 893 F.

Supp. 2d 301, 309 (D.P.R. 2012); McFarlane v. Roberta, 891 F. Supp. 2d 275, 286 (D. Conn. 2012); Lange v. Taylor, 5:10-CT-3097, 2012 WL 255333, at *3 (E.D.N.C. Jan. 27, 2012); Earle v. Holder, 815 F. Supp. 2d 176, 180 (D.D.C. 2011), aff’d per curiam, No. 11-5280, 2012 WL 1450574 (D.C. Cir. Apr. 20, 2012); Dillingham v. Schofield, No. 2:11-CV-07, 2011

[12]

Office of Privacy and Civil Liberties

WL 3664470, at *9 (E.D. Tenn. Aug. 19, 2011); Lim v. United States, No.

10-2574, 2011 WL 2650889, at *8 (D. Md. July 5, 2011); Bradley v. Mason, 833 F. Supp. 2d 763, 769 (N.D. Ohio 2011); Brown v. Prince George’s Hosp., No. 09cv295, 2011 WL 2413344, at *4 (D. Md. June 9, 2011);

Chandler v. James, 783 F. Supp. 2d 33, 41 (D.D.C. 2011); Blanton v.

Warden, No. 7:10-cv-00552, 2011 WL 1226010, at *3 (W.D. Va. Mar. 30, 2011); Bailey v. Fulwood, 780 F. Supp. 2d 20, 27 (D.D.C. 2011); Hackett v.

New Jersey, No. 10-2547, 2010 WL 4553526, at *2 (D.N.J. Nov. 3, 2010);

Off v. U.S. Gov’ts, 472 F. App’x 789, 790 (D. Nev. 2010), aff’d on other grounds sub nom. Off v. United States, No. 10-17389, 2012 WL 1436712 (9th Cir. Apr. 26, 2012); James v. Tejera, No. 5:10-cv-048, 2010 WL 3324833, at *1 (M.D. Fla. Aug. 23, 2010); Goodwin v. Johnson, No.

8:10CV40, 2010 WL 1500872, at *3 (D. Neb. Apr. 14, 2010); Hollins v.

Cross, No. 1:09cv75, 2010 WL 1439430, at *3 (N.D. W. Va. Mar. 17, 2010);

Hill v. United States, No. 5:09CV19, 2010 WL 391627, at *3 (N.D. W. Va.

Jan. 26, 2010); Truesdale v. DOJ, 657 F. Supp. 2d 219, 227 (D.D.C. 2009);

Jackson v. BOP, 657 F. Supp. 2d 176, 178-79 (D.D.C. 2009); Goodwin v.

Omaha Hous. Auth., No. 8:09CV205, 2009 WL 2581549, at *3 (D. Neb.

Aug. 17, 2009); Capobianco v. Geithner, No. 09-1656, 2009 WL 2370443, at *1 n.3 (E.D. Pa. July 28, 2009); Walker v. Gambrell, 647 F. Supp. 2d 529, 536 (D. Md. 2009); Flanory v. Bonn, No. 2:08-cv-108, 2009 WL 33472, at *2 (W.D. Mich. Jan. 5, 2009); Jennings v. BOP, No. 081475, 2008 WL 3983115, at *1 (D.D.C. Aug. 26, 2008); Arsendorf v. Everson, No. 07-2703, 2008 WL 2229745, at *4 (S.D. Tex. May 27, 2008); Rainge-El v. Brill, No.

05-01831, 2008 WL 511760, at *9 (D. Colo. Feb. 22, 2008); Lewis v.

Frazier, No. 07-0961, 2007 WL 2894255, at *1 (E.D. Cal. Oct. 3, 2007);

Banks v. Partyka, No. 07-0331, 2007 WL 2693180, at *3 (W.D. Okla. Sept.

11, 2007); Joseph v. Cole, No. 5:07-CV-225, 2007 WL 2480171, at *1 (M.D. Ga. Aug. 27, 2007); Al-Beshrawi v. Arney, No. 5:06CV2114, 2007 WL 1245845, at *4 (N.D. Ohio Apr. 27, 2007); Kemp v. Grippen, 06-C- 0076, 2007 WL 870123, at *6 (E.D. Wis. Mar. 20, 2007); Cummings v.

Malone, No. 06-5442, 2006 WL 3694592, at *3 (D.N.J. Dec. 12, 2006);

Thomas v. Ashcroft, No. 3:CV-05-0090, 2006 WL 860136, at *4 (M.D. Pa.

Mar. 30, 2006); Corey v. McNamara, 409 F. Supp. 2d 1225, 1229 (D. Nev.

2006), aff’d, 265 F. App’x 555 (9th Cir. 2008); Afshar v. Everitt, No. 04- 1104, 2005 WL 2898019, at *3 (W.D. Mo. Oct. 31, 2005); Swartz v. IRS, No. 05-72215, 2005 WL 3278026, at *4 (E.D. Mich. Oct. 26, 2005); Fetzer

v. Cambria Cnty. Human Servs., 384 F. Supp. 2d 813, 816 (W.D. Pa. 2005);

Benham v. Rice, No. 0301127, 2005 WL 691871, at *4 (D.D.C. Mar. 24, 2005); House v. Gutierrez, No. Civ.A. 04-1796, 2005 WL 405449, at *1 (D.D.C. Feb. 18, 2005); Burns v. Potter, 334 F. Supp. 2d 13, 20-21 (D.

Mass. 2004); Buckles v. Indian Health Serv., 268 F. Supp. 2d 1101, 1102 (D.N.D. 2003); Stokes v. Barnhart, 257 F. Supp. 2d 288, 299 (D. Me. 2003);

Mandel v. OPM, 244 F. Supp. 2d 146, 153 (E.D.N.Y. 2003), aff’d on other

[13]

Office of Privacy and Civil Liberties grounds 79 F. App’x 479 (2d Cir. 2003); Mumme v. Labor, 150 F. Supp. 2d 162, 169 (D. Me. 2001), aff’d, No. 01-2256 (1st Cir. June 12, 2002); Payne

v. EEOC, No. 99-270, slip op. at 2 (D.N.M. July 7, 1999), aff’d, No. 00- 2021, 2000 WL 1862659, at *2 (10th Cir. Dec. 20, 2000); Armstrong v.

BOP, 976 F. Supp. 17, 23 (D.D.C. 1997), summary affirmance granted, No.

97-5208, 1998 WL 65543 (D.C. Cir. Jan. 30, 1998); Claasen v. Brown, No.

94-1018, 1996 WL 79490, at *3-4 (D.D.C. Feb. 16, 1996); Lloyd v. Coady, No. 94-5842, 1995 U.S. Dist. LEXIS 2490, at *3-4 (E.D. Pa. Feb. 28, 1995), upon consideration of amended complaint, 1995 U.S. Dist. LEXIS 6258, at *3 n.2 (E.D. Pa. May 9, 1995); Hill v. Blevins, No. 3-CV-92-0859, slip op.

at 4-5 (M.D. Pa. Apr. 12, 1993), aff’d, 19 F.3d 643 (3d Cir. 1994) (unpublished table decision); Malewich, No. 91-4871, slip op. at 19; Sheptin

v. DOJ, No. 91-2806, 1992 U.S. Dist. LEXIS 6221, at *5-6 (D.D.C. Apr. 30, 1992); Williams v. McCausland, 791 F. Supp. 992, 1000 (S.D.N.Y. 1992);

Mittleman v. Treasury, 773 F. Supp. 442, 450 (D.D.C. 1991); Stephens v.

TVA, 754 F. Supp. 579, 580 n.1 (E.D. Tenn. 1990); B.J.R.L. v. Utah, 655 F.

Supp. 692, 696-97 (D. Utah 1987); Dennie, 589 F. Supp. at 351-53;

Gonzalez v. Leonard, 497 F. Supp. 1058, 1075-76 (D. Conn. 1980). See also Bavido v. Apfel, 215 F.3d 743, 747 (7th Cir. 2000) (finding that Social Security Administration Commissioner was not proper party defendant, but that SSA had waived any objection as to naming of proper party agency defendant); Gordon v. Gutierrez, No. 1:06cv861, 2006 WL 3760134, at *3 (E.D. Va. Dec. 14, 2006) (“[C]ourts have consistently declined to imply a Bivens-style right of action against individual officers for conduct that would be actionable under the Privacy Act.”); cf. Stewart v. FBI, No. 97- 1595, 1999 U.S. Dist. LEXIS 21335, at *15-22 (D. Or. Dec. 10, 1999) (magistrate’s recommendation) (discussing actions of two Air Force officers assigned to other agencies were not attributable to Air Force; neither were their actions attributable to State Department, because although they both physically worked at embassy and ambassador had responsibility over all executive branch agency employees, neither reported to State Department or ambassador), adopted, 2000 U.S. Dist. LEXIS 2954 (D. Or. Mar. 15, 2000).

One court also noted, though, that while of course a Privacy Act action “must be maintained against an agency,” it is “unaware of any authority which requires the Plaintiffs to specifically name, either as an individual defendant or within the body of a complaint, each and every agency employee who may have contributed to an alleged Privacy Act violation.”

Buckles v. Indian Health Serv., 305 F. Supp. 2d 1108, 1112 (D.N.D. 2004).

The District Court for the District of Columbia has explained that “[i]n order for an agency to be liable for a Privacy Act violation allegedly committed by one of its employees, the responsible agency employee must have been acting within the scope of his or her employment.” Convertino v. DOJ, 769 F. Supp. 2d 139, 147 (D.D.C. 2011) (“Therefore, even if [plaintiff] could

[14]

Office of Privacy and Civil Liberties prove that the leak must have come from a DOJ employee – which he cannot

– his claim would fail because no reasonable fact-finder could conclude that any such DOJ employee was acting within the scope of his or her employment at the time of the leak.”), rev’d and remanded on other grounds, 684 F.3d 93 (D.C. Cir. 2012) (reversing district court’s summary judgment and ruling that district court committed abuse of discretion in denying appellant’s motion to stay summary judgment to allow for further discovery).

Some courts have held that the head of an agency, if sued in his or her official capacity, can be a proper party defendant under the Privacy Act. See Hampton, No. 93-0816, slip op. at 8, 10-11 (D.D.C. June 30, 1995); Jarrell v.

Tisch, 656 F. Supp. 237, 238 (D.D.C. 1987); Diamond v. FBI, 532 F. Supp.

216, 219-20 (S.D.N.Y. 1981), aff’d, 707 F.2d 75 (2d Cir. 1983); Nemetz v.

Treasury, 446 F. Supp. 102, 106 (N.D. Ill. 1978); Rowe v. Tennessee, 431 F.

Supp. 1257, 1264 (M.D. Tenn. 1977), vacated on other grounds, 609 F.2d 259 (6th Cir. 1979); see also Walker v. Gambrell, 647 F. Supp. 2d at 536 (construing pro se plaintiff’s suit against Treasury secretary “as a suit against the Department of the Treasury” partly because “pleadings of pro se plaintiffs are to be construed liberally”); cf. Cloonan, 768 F. Supp. 2d at 162 (“find[ing] that plaintiff’s error in naming only individual defendants was harmless” because “[o]n its face, the Complaint makes clear that in naming former attorney general Michael Mukasey, plaintiff was naming the Department of Justice as a defendant” and because complaint named Attorney General only in his official capacity). Further, leave to amend a complaint to substitute a proper party defendant ordinarily is freely granted where the agency is on notice of the claim. See, e.g., Reyes v. Supervisor of DEA, 834 F.2d 1093, 1097 (1st Cir. 1987); Petrus v. Bowen, 833 F.2d at

583. But cf. Doe v. Rubin, No. 95-CV-75874, 1998 U.S. Dist. LEXIS 14755, at *9 (E.D. Mich. Aug. 10, 1998) (granting summary judgment for defendant where plaintiff had named Secretary of the Treasury as sole defendant and had filed no motion to amend).

Note that a prosecution enforcing the Privacy Act’s criminal penalties provision, 5 U.S.C. § 552a(i) (see “Criminal Penalties” discussion, below), would of course properly be filed against an individual. See Stone v. Def.

Investigative Serv., 816 F. Supp. 782, 785 (D.D.C. 1993) (“Under the Privacy Act, this Court has jurisdiction over individually named defendants only for unauthorized disclosure in violation of 5 U.S.C. § 552a(i).”); see also Hampton v. FBI, No. 93-0816, slip op. at 8, 10-11 (D.D.C. June 30, 1995) (citing Stone).

[15]

Office of Privacy and Civil Liberties

B. Individual

“a citizen of the United States or an alien lawfully admitted for permanent residence.” 5 U.S.C. § 552a(a)(2).

Comment:

Compare this definition with the FOIA’s much broader “any person” definition (5 U.S.C. § 552(a)(3) (2006)). See, e.g., Fares v. INS, No. 94- 1339, 1995 WL 115809, at *4 (4th Cir. 1995) (per curiam) (“[Privacy] Act only protects citizens of the United States or aliens lawfully admitted for permanent residence.”); Raven v. Panama Canal Co., 583 F.2d 169, 170-71 (5th Cir. 1978) (same as Fares, and comparing “use of the word ‘individual’ in the Privacy Act, as opposed to the word ‘person,’ as more broadly used in the FOIA”); Rojas-Vega v. U.S. Citizenship and Immigration Servs., No. 13- CV-172, 2013 WL 2417937, at *2 (S.D. Cal. May 31, 2013) (“Because [plaintiff] does not fit [as a citizen or lawfully admitted permanent resident], he cannot seek relief under the Privacy Act”); Rojas-Vega v. Cejka, No.

09CV2489, 2010 WL 1541369, at *3 (S.D. Cal. Apr. 15, 2010) (dismissing access claim brought by plaintiff whose “lawful U.S. resident alien status was revoked” because plaintiff “cannot state a claim for a benefit that he is clearly not entitled to under the Privacy Act”; “Congress purposely limited the Privacy Act in this manner, in contrast to FOIA.”); Cudzich v. INS, 886 F. Supp. 101, 105 (D.D.C. 1995) (A plaintiff whose permanent resident status had been revoked “is not an ‘individual’ for the purposes of the Privacy Act. . . . Plaintiff’s only potential access to the requested information is therefore under the Freedom of Information Act.”).

Deceased individuals do not have any Privacy Act rights, nor do executors or next-of-kin. See OMB Guidelines, 40 Fed. Reg. 28,948, 28,951 (July 9, 1975), available at http://www.whitehouse.gov/sites/default/files/omb/assets/ omb/inforeg/implementation_guidelines.pdf; see also Warren v. Colvin, 744 F.3d 841, 843-44 (2d Cir. 2014) (“[plaintiff] correctly asserts that deceased individuals generally do not enjoy rights under the Privacy Act”); Whitaker

v. CIA, 31 F. Supp. 3d 23, 48 (D.D.C.