Office of Privacy and Civil Liberties - Overview of The Privacy Act - 2020 Edition

3/1/24, 4:53 PM Office of Privacy and Civil Liberties | Overview of the Privacy Act: 2020 Edition
Overview of the Privacy Act: 2020

Edition
Civil Remedies
The Privacy Act provides for four separate and distinct civil causes of action. See 5 U.S.C. §
552a(g). Two civil causes of action provide for injunctive relief – amendment lawsuits under (g)
(1)(A) and access lawsuits under (g)(1)(B). The remaining two causes of action provide for
compensatory relief in the form of monetary damages – damages lawsuits under (g)(1)(C) and (g)
(1)(D).
A. 5 U.S.C. § 552a(g)(1)(A) - Amendment Lawsuits

“Whenever any agency . . . makes a determination under subsection (d)(3) . . . not to amend an
individual’s record in accordance with his request, or fails to make such review in conformity
with that subsection . . . the individual may bring a civil action against the agency.” 5 U.S.C. §
552a(g)(1)(A).
Comment:
When an agency does not amend an individual’s record as requested or does not otherwise
comply with the requirements of subsection (d)(3) -- which also establishes, e.g., time limits and
notification requirements -- the Privacy Act specifically authorizes individuals to seek redress in
federal court. This section discusses the requirements for such amendment lawsuits.
1. Exhaustion of Administrative Remedies

Individuals must exhaust their administrative remedies prior to bringing amendment suits against
an agency.
https://www.justice.gov/opcl/overview-privacy-act-1974-2020-edition/remedies 1/108
In order to pursue a civil action for amendment of a record, an individual must exhaust
administrative remedies by making an amendment request to the agency and requesting
administrative review. See 5 U.S.C. § 552a(d)(2)-(3). The requirement to make an amendment
request to the agency and to seek administrative review before filing an action in civil court is
jurisdictional in nature because it is imposed by the Act itself. As explained in greater detail
below under “5 U.S.C. § 552a(g)(1)(B) - Access Lawsuits,” it is important to note that the
requirement to exhaust administrative remedies in Privacy Act access lawsuits is only
jurisprudential in nature, as it is not imposed by the Act itself.
The exhaustion principle is well established in the Privacy Act case law in the amendment
context. Courts have consistently required the individual to file a request for amendment of his
or her records, in conformity with the agency’s regulations, before commencing a subsection (g)
(1)(A) lawsuit. See, e.g., Quinn v. Stone, 978 F.2d 126, 137-38 (3d Cir. 1992); (per curiam); Nagel
v. HEW, 725 F.2d 1438, 1441 (D.C. Cir. 1984); Hill v. Air Force, 795 F.2d 1067, 1069 (D.C. Cir. 1986);
McKoy v. Spencer, No. 1:16-CV-01313, 2019 WL 400615, at *5-6 (D.D.C. Jan. 31, 2019); Otero v.
DOJ, 292 F. Supp. 3d 245, 251-52 (D.D.C. 2018); Dick v. Holder, 67 F. Supp. 3d 167, 188-89 (D.D.C.
2014); Lowe v. Colvin, No. SA-13-CV-145, 2014 WL 690644, at *4-5 (W.D. Tex. Feb. 21, 2014);
Olsen v. SSA, No. 10-CV-0474, 2013 WL 3190346, at *3 (E.D.N.Y. June 18, 2013); Hutton v. VA, No.
1:12CV190, 2013 WL 1331191, at *1-2 (M.D.N.C. Mar. 29, 2013); Jones v. Office of Worker’s Comp.
Programs, No. 2:11-CV-2799, 2012 WL 5213148, at *3 (E.D. Cal. Oct. 22, 2012) (magistrate’s
recommendation); Middlebrooks v. Mabus, No. 1:11cv46, 2011 WL 4478686, at *5 n.10 (E.D. Va.
Sept. 23, 2011); Kvech v. Holder, No. 10-cv-545, 2011 WL 4369452, at *4 n.10 (D.D.C. Sept. 19,
2011); Washington v. Donley, 802 F. Supp. 2d 539, 553-54 (D. Del. 2011); Reitz v. USDA, No. 08-
4131, 2010 WL 786586, at *10 (D. Kan. Mar. 4, 2010); Pototsky v. DHS, No. CV 07-144, 2009 WL
10695555, at *3 (D. Ariz. Jan. 15, 2009), aff’d, 368 F. App’x 832 (9th Cir. 2010); Watson v. Mineta,
No. 4:05-CV-007, 2007 WL 3102196, at *2 (M.D. Ga. Oct. 23, 2007) (dicta); Brown v. DOJ, No. 02-
2662, slip op. at 24-26 (D. Ala. June 21, 2005); Pontecorvo v. FBI, No. 00-1511, slip op. at 21-22
(D.D.C. Sept. 30, 2001); Murphy v. United States, 121 F. Supp. 2d 21, 28 (D.D.C. 2000), aff’d per
curiam, 64 F. App’x 250 (D.C. Cir. 2003); M.K. v. Tenet, 99 F. Supp. 2d 12, 20 (D.D.C. 2000); Blazy v.
Tenet, 979 F. Supp. 10, 18-19 (D.D.C. 1997), summary affirmance granted, No. 97-5330, 1998 WL
315583 (D.C. Cir. May 12, 1998); Olivares v. NASA, 882 F. Supp. 1545, 1552 (D. Md. 1995), aff’d,
103 F.3d 119 (4th Cir. 1996) (unpublished table decision); Gergick v. Austin, No. 89-0838-CV-W-2,
1992 U.S. Dist. LEXIS 7338, at *13-16 (W.D. Mo. Apr. 29, 1992), aff’d, No. 92-3210 (8th Cir. July 9,
1993); Simon v. DOJ, 752 F. Supp. 14, 23 n.6 (D.D.C. 1990), aff’d, 980 F.2d 782 (D.C. Cir. 1992);
Campbell v. USPS, No. 86-3609, 1990 WL 36132, at *4 (E.D. La. Mar. 28, 1990); Green v. USPS,
No. 88-0539, 1989 U.S. Dist. LEXIS 6846, at *6-7 (S.D.N.Y. June 19, 1989); and Ross v. USPS, 556
F. Supp. 729, 735 (N.D. Ala. 1983); cf. New-Howard v. Shinseki, No. 09-5350, 2012 WL 2362546,
at *6 (E.D. Pa. June 21, 2012) (finding plaintiff’s amendment request “flawed [] as she asserts her
claim against an entity that no longer has control of the documents” because at time plaintiff
filed amendment request, she had filed Merit Systems Protection Board (MSPB) action, and
thus, records that would “ordinarily be under the control of” OPM were “covered by the
appropriate MSPB or [EEOC] system of records”).
It also has been held that a plaintiff cannot “boot-strap” an access claim under (g)(1)(B) into a (g)
(1)(A) amendment violation, even though the plaintiff argued that by denying her request for
access the agency had prevented her from exercising her right to request amendment. See
Smith v. Cont’l Assurance Co., No. 91 C 0963, 1991 WL 164348, at *2 (N.D. Ill. Aug. 22, 1991);
accord Mumme v. Labor, 150 F. Supp. 2d 162, 173 (D. Me. 2001), aff’d, No. 01-2256 (1st Cir. June
12, 2002); see also M.K., 99 F. Supp. 2d at 20 n.15 (holding that plaintiffs must exhaust
administrative remedies by requesting amendment of records even though plaintiffs had
argued that “they cannot ask the CIA[] to amend that which the CIA refuses to admit exists”).
In amendment suits, exhaustion of administrative processes generally includes exhaustion of

administrative appeals.
In addition, many courts have required an individual to administratively appeal the agency’s
denial of his or her amendment request before commencing a subsection (g)(1)(A) lawsuit. See
Jernigan v. Air Force, No. 97-35930, 1998 WL 658662, at *2 (9th Cir. Sept. 17, 1998); Dickson v.
OPM, 828 F.2d 32, 40 (D.C. Cir 1987); Hewitt v. Grabicki, 794 F.2d 1373, 1377-78 (9th Cir. 1986);
Clutter v. Perdue, No. H-18-310, 2019 WL 1589942, at *7 (S.D. Tex. Jan. 28, 2019); Conley v.
United States, No. 2:10-cv-444, 2011 WL 1256611, at *7 (S.D. Ohio Mar. 31, 2011); Pearson v. DHS,
No. 3:08-CV-1885-B, 2009 WL 4016414, at *8 (N.D. Tex. Nov. 17, 2009); Leighton v. CIA., 412 F.
Supp. 2d 30, 34-35 (D.D.C. 2006); Finnerty v. USPS, No. 03-558, 2006 WL 54345, at *6-8 (D.N.J.
Jan. 9, 2006); Hass v. Air Force, 848 F. Supp. 926, 930 (D. Kan. 1994); Freude v. McSteen, No. 4-
85-882, slip op. at 4-5 (D. Minn. Oct. 23, 1985), aff’d, 786 F.2d 1171 (8th Cir. 1986) (unpublished
table decision); and Beaver v. VA, No. 1-82-477, slip op. at 2 (E.D. Tenn. Apr. 6, 1983). Cf. Williams
v. Bezy, 97 F. App’x 573, 574 (6th Cir. 2004) (affirming district court’s dismissal of plaintiff’s
subsection (e)(5) claim for failure to exhaust administrative remedies without specifically
discussing whether claim was brought under subsection (g)(1)(A) or subsection (g)(1)(C)); Doe v.
Goss, No. 04-2122, 2007 WL 106523, at *8 n.14 (D.D.C. Jan. 12, 2007) (“Plaintiff cannot
circumvent the exhaustion requirement by styling his ‘equitable right’ as a constitutional claim
where, as here, Congress has provided administrative machinery for the resolution of the
statutory claim.”). But cf. Duke v. United States, 305 F. Supp. 2d 478, 488 (E.D. Pa. 2004)
(finding that “although plaintiff [had] not exhausted administrative remedies” court had “subject
matter jurisdiction over this claim” because “this exhaustion requirement is not a jurisdictional
requirement” but a “practical” one).
An agency’s failure to meet its own deadlines does not exempt an individual from the exhaustion
requirement; court jurisdiction exists, however, as soon as an agency fails to comply with the
amendment provision’s administrative appeal time requirement.
Although subsection (d)(2)(A) requires an agency to “acknowledge in writing such receipt” of an

amendment request within ten working days, subsection (d)(2)(B) merely requires an agency to
“promptly” make the requested correction or inform the individual of its refusal to amend. In
construing this language, the Court of Appeals for the District of Columbia Circuit has held that
“[t]he statute provides no exemption from administrative review when an agency fails, even by
several months, to abide by a deadline, and none is reasonably implied.” Dickson v. OPM, 828
F.2d 32, 40-41 (D.C. Cir. 1987) (requiring exhaustion of subsection (d)(3) administrative appeal
remedy even when agency did not respond to initial amendment request for 90 days (citing
Nagel, 725 F.2d at 1440-41)). But see Schaeuble v. Reno, 87 F. Supp. 2d 383, 389-90 (D.N.J.
2000) (holding further exhaustion of administrative remedies is not required where plaintiff had
requested amendment and agency had not responded for six months; stating that “[a] six month
delay is not a ‘prompt’ response,” and that “[m]oreover, not only has the [agency] not indicated
that it will make a final determination . . . by any certain date, the Privacy Act does not bind the
[agency] to any definite timeframe for administrative action, which weighs in favor of waiving
the exhaustion requirement”).
In contrast to subsection (d)(2)(B), subsection (d)(3) requires an agency to make a final

determination on administrative appeal from an initial denial of an amendment request within
30 working days (unless, for good cause shown, the head of the agency extends this 30-day
period). Thus, court jurisdiction exists as soon as an agency fails to comply with the time
requirements of subsection (d)(3); “[t]o require further exhaustion would not only contradict the
plain words of the statute but also would undercut [C]ongress’s clear intent to provide speedy
disposition of these claims.” Diederich v. Army, 878 F.2d 646, 648 (2d Cir. 1989).
Individuals who are not informed of their right to administratively appeal an agency decision are
treated as having “exhausted” administrative remedies.
After denying an amendment request, an agency must inform the complainant of the right to
administratively appeal that denial or the complainant is not penalized for failing to exhaust his
or her administrative remedies before filing a civil action. In Harper v. Kobelinski, 589 F.2d 721
(D.C. Cir. 1978) (per curiam), and Liguori v. Alexander, 495 F. Supp. 641 (S.D.N.Y. 1980), the
agencies denied amendment requests but failed to inform the plaintiffs of their rights to
administratively appeal those decisions. In light of the Act’s requirement that agencies inform
complainants whose amendment requests have been denied of the available administrative
remedies, 5 U.S.C. § 552a(d)(2)(B)(ii), the courts in Harper and Liguori refused to penalize the
plaintiffs for their failures to exhaust. Harper, 589 F.2d at 723; Liguori, 495 F. Supp. at 646-47;
see also Germane v. Heckler, 804 F.2d 366, 369 (7th Cir. 1986) (discussing Harper and Liguori
with approval); Mahar v. Nat’l Parks Serv., No. 86-0398, slip op. at 7-11 (D.D.C. Dec. 23, 1987)
(same); cf. Ertell v. Army, 626 F. Supp. 903, 909-10 (C.D. Ill. 1986) (rejecting agency’s exhaustion
defense where it first told employee, in response to his amendment request, that it had
destroyed the record but later used same record against him, ruling that employee was not
required to make new request or appeal initial action).
The D.C. Circuit has held that individuals must seek judicial review of adverse employment
decisions under the Administrative Procedures Act prior to filing civil Privacy Act suit.
D.C. courts have held that civil suits may not be filed until the individual has sought judicial
review under the Administrative Procedures Act (“APA”). For example, in White v. U.S. Civil Serv.
Comm’n, 589 F.2d 713, 715-16 (D.C. Cir. 1978) (per curiam), the D.C. Circuit held that,
notwithstanding any exhaustion of administrative remedies, an amendment action is
“inappropriate and premature” where the individual had not yet sought judicial review (under
the APA) of adverse employment decisions, because granting Privacy Act relief “would tend to
undermine the established and proven method by which individuals . . . have obtained review
from the courts.” Cf. Douglas v. Farmers Home Admin., No. 91-1969, 1992 U.S. Dist. LEXIS 9159,
at *4-5 (D.D.C. June 26, 1992) (dismissing damages action under Privacy Act where plaintiff had
not sought review under Administrative Procedure Act of allegedly inaccurate property
appraisal). But see Churchwell v. United States, 545 F.2d 59, 61 (8th Cir. 1976) (finding
probationary employee could proceed with due process claim for hearing even though Privacy
Act remedy was available to her because “the failure to pursue one particular remedy has [no]
bearing on the viability of the other form of relief”).
2. Standard and Scope of Review

“In any suit brought under the provisions of subsection (g)(1)(A) of this section, the court may
order the agency to amend the individual’s record in accordance with his request or in such
other way as the court may direct. In such a case the court shall determine the matter de novo.”
5 U.S.C. § 552a(g)(2)(A).
Comment:
After an individual exhausts his or her administrative remedies by making an amendment

request to the agency and requesting administrative review pursuant to subsections (d)(2) and
(d)(3), the individual may challenge the agency’s refusal to amend the individual’s record in
federal district court. In such amendment actions, brought under subsection (g)(1)(A), “the
court may order the agency to amend the individual’s record in accordance with his request or
in such other way as the court may direct,” and “may assess against the United States
reasonable attorney fees and other litigation costs reasonably incurred” in any case in which the
complainant has “substantially prevailed.” 5 U.S.C. § 552a(g)(2)(A), (B).
Amendment suits are reviewed in the federal courts de novo.
In a subsection (g)(1)(A) action, the court “shall determine the matter de novo.” 5 U.S.C.
§ 552a(g)(2)(A). “De novo review does not contemplate that the court will substitute its
judgment for the [agency’s], but rather that the court will undertake an independent
determination of whether the amendment request should be denied.” Nolan v. DOJ, No. 89-A-
2035, 1991 WL 134803, at *3 (D. Colo. July 17, 1991), appeal dismissed in pertinent part on
procedural grounds, 973 F.2d 843 (10th Cir. 1992); see also Doe v. United States, 821 F.2d 694,
697-98 (D.C. Cir. 1987) (holding that “[d]e novo means . . . a fresh, independent determination of
‘the matter’ at stake”). The applicable standards in amendment lawsuits are accuracy,
relevancy, timeliness, and completeness. 5 U.S.C. § 552a(d)(2)(B)(i). But see Doe v. United
States, 821 F.2d at 697 n.8, 699 (stating that “whether the nature of the relief sought is
injunctive or monetary, the standard against which the accuracy of the record is measured
remains constant” and “[t]hat standard is found in 5 U.S.C. § 552a(e)(5) and reiterated in 5 U.S.C.
§ 552a(g)(1)(C)”). The burden of proof is on the individual. See Mervin v. FTC, 591 F.2d 821, 827
(D.C. Cir. 1978) (per curiam); Thompson v. Coast Guard, 547 F. Supp. 274, 282 (S.D. Fla. 1982);
OMB 1975 Guidelines, 40 Fed. Reg. at 28,969, https://www.justice.gov/paoverview_omb-75.
Individuals may not bring civil suit for an agency’s failure to amend records that do not exist.
“[A]n individual’s request for amendment must relate to an existing record that is maintained
within one of the agency’s systems of records.” Crummey v. SSA, 794 F. Supp. 2d 46, 58 (D.D.C.
2011), aff’d per curiam, No. 11-5231, 2012 WL 556317 (D.C. Cir. Feb. 6, 2012). The plaintiff in
Crummey – who “believe[d] that the Social Security Administration created a trust . . . when it
assigned him a Social Security Number and a Social Security Card” – had “draft[ed] an
agreement designed to reflect the alleged creation of the Trust.” 794 F. Supp. 2d at 49. The
plaintiff brought a subsection (g)(1)(A) claim seeking a court order requiring the SSA “to amend
its records to add the Trust Agreement to the SSA’s Master Files, or to somehow incorporate its
contents therein.” Id. at 52. The court reviewed the categories of records listed in the
applicable system of records notice, see 75 Fed. Reg. 82,123 (Dec. 29, 2010), and determined
that “[n]one of the information set forth in the Trust Agreement falls within this universe.” 794 F.
Supp. 2d at 58. “In short,” the court concluded, “the Trust Agreement and the information
contained therein do not correspond to an ‘item, collection, or grouping’ of information in the
Master Files,” and granted summary judgment to the SSA. Id. at 59.
Once records have been amended, the amendment claim is moot.
Once a request for amendment is complied with and the identified records have been amended,
the amendment claim is moot. See, e.g., Conley, 2011 WL 1256611, at *7; Blanton v. Warden, No.
7:10-cv-00552, 2011 WL 1226010, at *2-3 (W.D. Va. Mar. 30, 2011); Garza v. Pearson, No. 5:08-cv-
300, 2009 WL 2500116, at *1 (S.D. Miss. Aug. 13, 2009); Blazy v. Tenet, 979 F. Supp. 10, 19 (D.D.C.
1997), summary affirmance granted, No. 97-5330, 1998 WL 315583 (D.C. Cir. May 12, 1998).
There are several matters that are not subject to court review under the amendment provisions of
the Privacy Act, including tax liability determinations, judicial and quasi-judicial decisions, and
criminal convictions and sentences.
Tax liability determinations are not subject to court review under the Privacy Act. In the Internal
Revenue Code, Congress expressly removed the jurisdiction of the district courts under Privacy
Act subsection (g) to order the amendment of IRS records concerning tax liability. 26 U.S.C.
§ 7852(e) (providing that subsection (g), as well as subsections (d)(2), (3) and (4), “shall not
apply, directly or indirectly,” to any “determination of the existence or possible existence of
liability (or the amount thereof) of any person for any tax, penalty, interest, fine, forfeiture, or
other imposition or offense” to which title 26, United States Code, applies). See, e.g., Schlabach
v. IRS, 491 F. App’x 854, 854-55 (9th Cir. 2012); Gardner v. United States, 213 F.3d 735, 740-41 &
n.5 (D.C. Cir. 2000); England v. Comm’r, 798 F.2d 350, 351-52 (9th Cir. 1986); Meyer v. Comm’r,
No. 10-767, 2010 WL 4157173, at *8 (D. Minn. Sept. 27, 2010) (magistrate’s recommendation),
adopted, 2010 WL 4134958, at *8 (D. Minn. Oct. 19, 2010); Gulden v. United States, No. 8:06-CV-
2327-T-27MSS, 2007 WL 3202480, at *3 (M.D. Fla. Oct. 29, 2007); Singer v. IRS, No. 98-0024,
1998 U.S. Dist. LEXIS 13301, at *10-11 (E.D. Pa. Aug. 10, 1998); Chandler v. United States, No. 93-
C-812A, 1994 WL 315759, at *1 (D. Utah Mar. 8, 1994); Fuselier v. IRS, No. 90-0300, slip op. at 1
(W.D. La. Oct. 25, 1990); Mallas v. Kolak, 721 F. Supp. 748, 751 (M.D.N.C. 1989), aff’d in part,
vacated in nonpertinent part & remanded, on other grounds, Mallas v. United States, 993 F.2d
1111 (4th Cir. 1993); Schandl v. Heye, No. 86-6219, slip op. at 2 (S.D. Fla. Sept. 30, 1986); Dyrdra v.
Comm’r, No. 85-0-41, slip op. at 2 (D. Neb. Oct. 28, 1985); Conklin v. United States, No. 83-C-587,
slip op. at 2-3 (D. Colo. Feb. 26, 1985); Green v. IRS, 556 F. Supp. 79, 80 (N.D. Ill. 1982), aff’d, 734
F.2d 18 (7th Cir. 1984) (unpublished table decision); see also Gardner v. United States, No. 96-
1467, 1999 U.S. Dist. LEXIS 2195, at *18 (D.D.C. Jan. 29, 1999) (finding that by virtue of § 7852(e)
the IRS is “exempt” from amendment provisions of Privacy Act), summary affirmance granted on
other grounds, No. 99-5089, 1999 WL 728359 (D.C. Cir. Aug. 4, 1999) (per curiam).
In addition, consistent with the OMB 1975 Guidelines, courts have routinely expressed disfavor
toward litigants who attempt to invoke the subsection (g)(1)(A) amendment remedy as a basis
for collateral attacks on judicial or quasi-judicial determinations recorded in agency records.
See 40 Fed. Reg. at 28,969, https://www.justice.gov/paoverview_omb-75; see also Jackson v.
GSA, 729 F. App’x. 206, 209 (3d Cir. 2018) (per curiam) (citing Reinbold, infra, and denying
expungement of “derogatory information,” where district court determined that records
supported IRS’s determination that employment offer was rescinded based on fingerprint
check); Sydnor v. OPM, 336 F. App’x 175, 180 (3d Cir. 2009) (concluding that “a collateral attack
upon that which has been or could have been the subject of a judicial, quasi-judicial or
administrative proceeding” lies “outside the scope of the Privacy Act”); Jones v. MSPB, 216 F.
App’x 608, 609 (8th Cir. 2007) (affirming dismissal of amendment claim because “the
statements accurately reflect administrative decisions”); Cooper v. Treasury, No. 05-0314, 2006
WL 637817, at *2-3 (11th Cir. Mar. 15, 2006) (finding law-of-the-case doctrine bars relitigation of
claim under Privacy Act that had been decided against plaintiff in district court and affirmed by
court of appeals); Reinbold v. Evers, 187 F.3d 348, 361 (4th Cir. 1999) (“[T]he Privacy Act does
not allow a court to alter records that accurately reflect an administrative decision, or the
opinions behind that administrative decision.”); Milhous v. EEOC, No. 97-5242, 1998 WL 152784,
at *1 (6th Cir. Mar. 24, 1998) (“The Privacy Act may not be used to challenge unfavorable agency
decisions[.] It is intended solely to be used to correct factual or historical errors.”); Douglas v.
Agric. Stabilization & Conservation Serv., 33 F.3d 784, 785 (7th Cir. 1994) (asserting that the
“Privacy Act does not authorize relitigation of the substance of agency decisions” and that “the
right response . . . is to correct the disposition under the Administrative Procedure Act”); Bailey
v. VA, No. 94-55092, 1994 WL 417423, at *1 (9th Cir. Aug. 10, 1994) (finding that plaintiff may not
use Privacy Act to collaterally attack grant or denial of benefits); Sugrue v. Derwinski, 26 F.3d 8,
11 (2d Cir. 1994) (finding that the Privacy Act may not be used “as a rhetorical cover to attack VA
benefits determinations”); Geurin v. Army, No. 90-16783, 1992 WL 2781, at *2 (9th Cir. Jan. 6,
1992) (finding doctrine of res judicata bars relitigation of claims under Privacy Act that had
been decided against plaintiff by United States Claims Court in prior action under 28 U.S.C. §
1491); Pellerin v. VA, 790 F.2d 1553, 1555 (11th Cir. 1986) (quoting Rogers v. Labor, 607 F. Supp.
697, 699 (N.D. Cal. 1985) that the Privacy Act “‘may not be employed as a skeleton key for
reopening consideration of unfavorable federal agency decisions,’” and dismissing amendment
lawsuit challenging VA disability benefits determination on the ground that veterans benefit
statute limits judicial review of VA’s determinations); Hutton v. VA, No. 1:12CV190, 2013 WL
1331191, at *2 (explaining that even if plaintiff’s Privacy Act claim were properly before the
court, “[p]laintiff seeks to alter records that, under the facts alleged, accurately reflect the
administrative decisions made years ago”); New-Howard v. Shinseki, No. 09-5350, 2012 WL
2362546, at *7 (E.D. Pa. June 21, 2012) (“Plaintiff’s placement in the position of Office
Automation Clerk and her placement in the FERS system may have been substantively
incorrect, to the extent that such placement occurred, the records in her file accurately reflect
what occurred in August 2005. As a result, the proper procedure for Plaintiff to employ in order
to correct the error is to pursue the matter before the MSPB.”); Hardy v. McHugh, 692 F. Supp.
2d 76, 80-81 (D.D.C. 2010) (rejecting claim to correct Army memorandum of reprimand that
included “implication that [plaintiff] intentionally misrepresented his educational credentials”
because “the Army’s judgment is based on accurate facts” and because plaintiff “presents the
same facts that have been considered by various Army boards and asks [the court] to substitute
[its] judgment for theirs”); Jackson v. Labor, No. 2:06-CV-02157, 2008 WL 539925, at *4 (E.D. Cal.
Feb. 25, 2008) (ruling that plaintiff may not bring amendment lawsuit under Privacy Act to re-
litigate determination of Federal Employees’ Compensation Act benefits); Davenport v. Harvey,
No. 06-CV-02669, slip op. at 8 (S.D. Cal. May 3, 2007) (rejecting claim “seek[ing] to alter factual
findings and conclusion made by the [DOD Office of Hearings and Appeals] [administrative
judge] as part of Plaintiff’s appeal of the denial of his security clearance”), aff’d in pertinent part,
vacated in part, & remanded sub nom. Davenport v. McHugh, 372 F. App’x 820 (9th Cir. 2010);
Lee v. Geren, 480 F. Supp. 2d 198, 209 (D.D.C. Mar. 29, 2007) (finding that plaintiff “is not
seeking to correct any true errors in his records” but instead “is hoping that this Court will
expunge all references in his records to an adverse personnel action that he could not
challenge directly because the CSRA precludes such review”); Lechliter v. Army, No. 04-814,
2006 WL 462750, at *2-3 (D. Del. Feb. 27, 2006) (“To the extent that [plaintiff] is asking [the
court] to alter the ultimate determination by the Department that he is not disabled, rather than
to correct factual errors recited in his records, such relief is outside that provided by the Privacy
Act.”); Levant v. Roche, 384 F. Supp. 2d 262, 270 (D.D.C. 2005) (concluding that plaintiff’s “true
complaint is not about the accuracy of his records, but about the underlying decision [not to
promote him to the rank of major general, which those records] reflect”); Byrnes v. MSPB, No.
04-742, 2005 WL 486156, at *2-3 (D.D.C. Mar. 2, 2005) (ruling that plaintiff could not collaterally
attack “an inartfully drafted settlement agreement” terminating a lawsuit by seeking to amend
agreement to include a provision requiring MSPB to “depublish” its prior decision); Bernard v.
DOD, 362 F. Supp. 2d 272, 280-81 (D.D.C. 2005) (dismissing plaintiff’s amendment claim
because plaintiff did not “seek to correct a factual or historical error” but rather challenged
agency’s substantive judgments or decisions); Gowan v. Air Force, No. 90-94, slip op. at 26, 33
(D.N.M. Sept. 1, 1995) (commenting that “Privacy Act, unfortunately, may not be used as a
collateral attack on the improper referral of charges [for court martial], nor may the Privacy Act
be used as a method for the Court to oversee the activities of the armed services”), aff’d, 148
F.3d 1182 (10th Cir. 1998); Williams v. McCausland, 90 Civ. 7563, 1994 WL 18510, at *17 (S.D.N.Y.
Jan. 18, 1994) (denying plaintiff’s request to supplement record of his administrative proceeding
before MSPB because request “constitutes an attempt to contest the MSPB’s determination on
the merits of his request for a stay of his removal”); Smith v. Cont’l Assurance Co., No. 91 C
0963, 1991 WL 164348, at *5 (N.D. Ill. Aug. 22, 1991) (finding that plaintiff cannot use Privacy Act
to collaterally attack agency decision regarding her Federal Employees Health Benefit Act
claim); Rowan v. USPS, No. 82-C-6550, 1984 U.S. Dist. LEXIS 17042, at *6 (N.D. Ill. May 2, 1984)
(asserting that the Privacy Act is not “a means for all disgruntled governmental employees to
have unflattering appraisals removed from their personnel files or shaded according to their
own whims or preferences”); Leib v. VA, 546 F. Supp. 758, 762 (D.D.C. 1982) (“The Privacy Act
was not intended to be and should not be allowed to become a ‘backdoor mechanism’ to subvert
the finality of agency determinations.” (internal citation omitted)); Lyon v. United States, 94
F.R.D. 69, 72 (W.D. Okla. 1982) (asserting that a Privacy Act claim cannot be “a backdoor
mechanism to subvert authority bestowed upon the Secretary of Labor to handle employee
compensation claims” and stating that the FECA “provides the exclusive method of presenting
compensation claims resulting from on-the-job injuries of federal employees”); Bashaw v.
Treasury, 468 F. Supp. 1195, 1196-97 (E.D. Wis. 1979) (citing OMB 1975 Guidelines with approval
and holding that amendment remedy is “neither a necessary nor an appropriate vehicle for
resolving the merits of the plaintiff’s [discrimination] claims”); Kennedy v. Andrus, 459 F. Supp.
240, 242 (D.D.C. 1978) (noting that OMB 1075 Guidelines “clearly forbid collateral attack in the
case of final judicial or quasi-judicial actions” and observing that “the same considerations
would seem to apply to agency personnel actions, such as the reprimand here, for collateral
attack under the Privacy Act could undermine the effectiveness of agency grievance systems”),
aff’d, 612 F.2d 586 (D.C. Cir. 1980) (unpublished table decision); cf. Subh v. Army, No. 1:10cv433,
2010 WL 4961613, at *4 (E.D. Va. Nov. 30, 2010) (rejecting plaintiff’s attempt “to rewrite history
to pretend that he correctly answered ‘yes’ to question 22 [on Standard Form 86, the
‘Questionnaire for National Security Positions’] when in fact he falsely answered ‘no’” because
“[t]he Privacy Act plainly does not exist to allow applicants to obtain such a ‘do-over’ of their
security forms in the guise of an administrative ‘correction’”); Doe v. HHS, 871 F. Supp. 808, 814-
15 (E.D. Pa. 1994) (“[T]he specific reporting provisions encompassed in the [Health Care Quality
Improvement] Act supersede[] any claims [plaintiff] might have under the Privacy Act.”), aff’d,
66 F.3d 310 (3d Cir. 1995) (unpublished table decision).
Criminal court convictions and sentences are generally not subject to civil amendment court
review under the Privacy Act. Federal prisoners frequently attempt to invoke the subsection (g)
(1)(A) amendment remedy as a basis for a collateral attack on a conviction or the duration of a
sentence. Just as in the damages context – discussed in the “5 U.S.C. § 552a(g)(1)(C) - Damages
Lawsuits for Failure to Assure Fairness in Agency Determination” section, below – courts have
frequently ruled that unless the conviction or sentence has been invalidated in a prior
proceeding, the prisoner’s exclusive remedy is a writ of habeas corpus. See, e.g., Reeves v. BOP,
885 F. Supp. 2d 384, 389 (D.D.C. 2012) (“A civil action under the Privacy Act is not the proper
means by which a federal prisoner may secure a reduction in the duration of his confinement.”);
Crompton v. Kent, No. 12-cv-757, 2012 WL 5903088, at *3 (W.D. Wis. Nov. 26, 2012) (holding that
a prisoner’s claim to amend his presentence report cannot succeed because the individual
defendants were immune and that BOP “cannot be ordered to amend plaintiff’s presentence
report because it has no authority to take such an action”); King v. Johns, No. 4:10cv1835, 2010
WL 4065405, at *1 (N.D. Ohio Oct. 14, 2010) (“[A] complaint seeking relief under . . . § 552a is not
a permissible alternative to a petition for writ of habeas corpus if the plaintiff essentially
challenges the legality of his confinement.”); Truesdale v. DOJ, 731 F. Supp. 2d 3, 11 (D.D.C. 2010)
(dismissing Privacy Act claims because a ruling in plaintiff’s favor would impact the duration of
his confinement, and should be brought in a petition for a writ of habeas corpus “not by way of a
suit brought under the Privacy Act”); Davis v. United States, No. 09-1961, 2010 WL 2011549, at *1
n.1 (D. Md. May 18, 2010) (“[T]o the extent Petitioner believes that his sentence should be
modified, such claims may only be made in the context of a habeas petition.”); Brown v. BOP, 498
F. Supp. 2d. 298, 303-04 (D.D.C. 2007) (“The Privacy Act is not the proper means by which a
prisoner may collaterally attack his sentence absent a showing that his sentence has been
invalidated in a prior proceeding.”); Forrester v. Parole Comm’n, 310 F. Supp. 2d 162, 168-70
(D.D.C. 2004) (concluding that reaching plaintiff’s Privacy Act claim seeking order to expunge
information “would have a probabilistic impact on his confinement . . . and therefore plaintiff
may only raise [such a claim] in a petition for a writ of habeas corpus”); Graham v. Hawk, 857 F.
Supp. 38, 40-41 (W.D. Tenn. 1994) (“The Privacy Act is not a means of circumventing [habeas]
exhaustion requirement.”), aff’d, 59 F.3d 170 (6th Cir. 1995) (unpublished table decision).
Similarly, the D.C. Circuit has concluded that the Privacy Act amendment provisions do not allow
for amendment of military records: “The proper means by which to seek a change to military
records is through a proceeding before the . . . Board for Correction of Military Records,” not
under the Privacy Act. Glick v. Army, No. 91-5213, 1992 WL 168004, at *1 (D.C. Cir. June 5, 1992)
(per curiam); see also Cargill v. Marsh, 902 F.2d 1006, 1007-08 (D.C. Cir. 1990) (per curiam)
(affirming dismissal of Privacy Act claim and concluding proper means to seek substantive
change in military records is through proceeding before the Boards for Correction of Records);
Walsh v. Hagee, 900 F. Supp. 2d 51, 60 (D.D.C. 2012) (“For [plaintiff] to obtain injunctive relief to
amend his military record, he must proceed under 10 U.S.C. § 1552.”); Doe v. Navy, 764 F. Supp.
1324, 1327 (N.D. Ind. 1991) (“[P]laintiff is not free to choose to attempt amendment of his military
records under the Privacy Act alone without resort to the records correction board remedy.”); cf.
Hardy, 692 F. Supp. 2d at 80-81 (rejecting claim seeking correction of Army memorandum of
reprimand including “implication that [plaintiff] intentionally misrepresented his educational
credentials” because “the Army’s judgment is based on accurate facts” and because plaintiff
“presents the same facts that have been considered by various Army boards and asks [the
court] to substitute [its] judgment for theirs”); Walker v. United States, No. 93-2728, 1998 WL
637360, at *14 (E.D. La. Sept. 16, 1998) (citing Cargill and finding plaintiff’s claim “unavailing” to
extent that he “is attempting to use the Privacy Act as a vehicle for his collateral attack on the
Army’s allegedly improper failure to correct his military records”), aff’d, 184 F.3d 816 (5th Cir.
1999) (unpublished table decision). But see Diederich v. Army, 878 F.2d 646, 647-48 (2d Cir.
1989) (holding that “Privacy Act claims were properly before the district court” and that plaintiff
was not required to further exhaust administrative remedies before asserting claim for
amendment of military records where his direct request to Army for correction had been stalled
before appeals board for several months); see also Def. Priv. Bd., Advisory Opinions No. 4,
Corrections of Military Records Under the Privacy Act, in Judge Advocate General’s School, U.S.
Army, JA 235, Government Information Practices – Casebook, A-13 (March 2000),
https://www.justice.gov/paoverview_ja-235 (affording review under Privacy Act for factual
matters only but noting that challenges to judgmental decisions may be made to the Boards for
Correction of Military or Naval Records).
Finally, several courts have ruled that statutes that provide other avenues of redress, such as
the CSRA, can bar certain kinds of subsection (g)(1)(C) damages actions. These cases are
discussed below under “5 U.S.C. § 552a(g)(1)(C) - Damages Lawsuits for Failure to Assure
Fairness in Agency Determination.”
The courts are split as to whether records that are exempt from the Privacy Act’s access provision
are also exempt from the Privacy Act’s amendment suits.
The Courts of Appeals for the Fifth, Seventh, and Ninth Circuits have concluded that records
that are exempt from access under the Privacy Act are not subject to amendment suits. The
Court of Appeals for the Fifth Circuit held that a plaintiff had no right to amend the record at
issue even though that record was only “exempt from the access requirements of the Act.”
Smith v. United States, 142 F. App’x 209, 210 (5th Cir. 2005) (per curiam) (emphasis added). In
other words, the court explained, “the scope of accessibility and the scope of amendment under
the Privacy Act are coextensive.” Id. The plaintiff in Smith had sought to amend a report that
was “prepared in response to [his Federal Tort Claims Act] claim.” Id. The Fifth Circuit
explained that because this report “was prepared in reasonable anticipation of a civil suit or
proceeding” within the meaning of the subsection (d)(5) exemption, “[t]he report is . . . also
exempt from the amendment requirements of the Act.” Id. Thus, the court concluded, the
amendment claim was “barred by exemption.” Id. Subsection (d)(5) is discussed below under
“Ten Exemptions.”
The Smith court agreed with earlier cases in the Court of Appeals for the Ninth and Seventh
Circuits. The Ninth Circuit held that “Congress intended to provide the remedies of amendment
or expungement only for records that are accessible under the Privacy Act.” Baker v. Navy, 814
F.2d 1381, 1385 (9th Cir. 1987) (finding that plaintiff’s ability to access record under FOIA or
because of personal knowledge of its existence, did not permit him to amend record because it
was not contained in system of records as required for access by subsection (d)(1) of Privacy
Act). Similarly, the Seventh Circuit concluded that “you cannot amend a document if you don’t
have access to it.” Wentz v. DOJ, 772 F.2d 335, 338 (7th Cir. 1985) (alternative holding)
(concluding that amendment was not appropriate because the record was exempt from access
under subsection (d)(1), pursuant to subsection (j)(2)).
The Courts of Appeals for the District of Columbia, First, and Fourth Circuits also have
concluded that courts do not have jurisdiction under subsection (g)(1)(A) to order the
amendment of records addressed by the Civil Service Reform Act’s (CSRA) comprehensive
remedial scheme. See Wills v. OPM, No. 93-2079, 1994 WL 22349, at *3-4 (4th Cir. Jan. 28,
1994) (alternative holding) (per curiam) (unpublished table decision) (finding jurisdiction was
proper under CSRA where challenge to merits of statement on SF-50 was actually complaint
regarding adverse employment decision); Vessella v. Air Force, No. 92-2195, 1993 WL 230172, at
*2 (1st Cir. June 28, 1993) (citing Kleiman, infra, and holding that plaintiff could not “bypass the
CSRA’s regulatory scheme” by bringing Privacy Act claim for same alleged impermissible
adverse personnel practices that he challenged before MSPB, even though MSPB dismissed his
claims as untimely); Kleiman v. Energy, 956 F.2d 335, 338 (D.C. Cir. 1992) (quoting Carducci v.
Regan, 714 F.2d 171, 174 (D.C. Cir. 1983) and refusing to allow exhaustive remedial scheme of
CSRA to be “impermissibly frustrated” by granting review of personnel decisions under the
Privacy Act); see also Wonders v. McHugh, No. 1:12-CV-817, 2013 WL 1729928, at *6 (M.D. Ala.
Apr. 4, 2013) (finding plaintiff’s claims about “personnel actions” fell within “CSRA’s general
prohibition against prejudicial treatment” rather than under Privacy Act); Minshew v. Donley, 911
F. Supp. 2d 1043, 1067 (D. Nev. 2012) (explaining that CSRA preempts plaintiff’s Privacy Act
claim: “[T]he CSRA is the exclusive means for federal employees to challenge prohibited
personnel practices, a federal employee may not resort to other statutes to effectively
challenge, review, reverse, or otherwise collaterally attack a decision falling within the scope of
the CSRA”); Lee v. Geren, 480 F. Supp. 2d 198, 206, 208 (D.D.C. 2007) (following “the course set
by [Kleiman]” by “evaluat[ing] the merits of plaintiff’s claims . . . in a way that does not do
violence to the CSRA” but ultimately finding that “[t]here is simply nothing inaccurate about”
plaintiff’s records).
3. Remedies
The Privacy Act allows for broad injunctive remedies in amendment suits, including expungement.
The Act provides for broad injunctive remedies, contemplating “expungement [of inaccuracies]
and not merely redress by supplement.” R.R. v. Army, 482 F. Supp. 770, 774 (D.D.C. 1980); see
also Smith v. Nixon, 807 F.2d 197, 204 (D.C. Cir. 1986); Hobson v. Wilson, 737 F.2d 1, 65-66 (D.C.
Cir. 1984), overruled in part on other grounds, Leatherman v. Tarrant Cnty. Narcotics Intel. &
Coord. Unit, 507 U.S. 163 (1993).
Once an agency offers to destroy a record in response to an expungement request, the lawsuit
is at an end, and the agency cannot be compelled to affirmatively determine and announce that
the challenged record violated the Act. See Reuber v. United States, 829 F.2d 133, 144-49 (D.C.
Cir. 1987); see also Comm. in Solidarity v. Sessions, 929 F.2d 742, 745 n.2 (D.C. Cir. 1991);
Metadure Corp. v. United States, 490 F. Supp. 1368, 1375 (S.D.N.Y. 1980). But see Doe v. U.S.
Civil Serv. Comm’n, 483 F. Supp. 539, 551 (S.D.N.Y. 1980).
The expungement remedy often is sought in cases asserting constitutional claims in addition to
Privacy Act claims, such as claims for violation of the Fourth Amendment’s due process
protections. As the District of Columbia Circuit Court of Appeals has stated, “Congress’s
provision of specific Privacy Act remedies does not bar” a plaintiff’s equitable Constitutional
claims. Abdelfattah v. DHS, 787 F.3d 524, 534 (D.C. Cir. 2015) (holding that “[w]e have
repeatedly recognized a plaintiff may request expungement of agency records for both
violations of the Privacy Act and the Constitution”); see Chastain v. Kelley, 510 F.2d 1232, 1235-
38 (D.C. Cir. 1975); Doe v. Air Force, 812 F.2d 738, 740-41 (D.C. Cir. 1987) (explaining that
expungement of records seized from plaintiff’s Air Force barracks may be “available as a
remedy if it is determined that the retained copies and information were unconstitutionally
obtained”); Fendler v. Parole Comm’n, 774 F.2d 975, 979 (9th Cir. 1985); Ezenwa v. Gallen, 906 F.
Supp. 978, 986 (M.D. Pa. 1995); cf. Johnson v. Sessions, No. 92-201, 1992 WL 212408, at *2
(D.D.C. Aug. 19, 1992) (refusing to invoke equitable powers to expunge plaintiff’s arrest record
because court did not have jurisdiction to order FBI to violate its own regulations which require
FBI to wait for authorization from appropriate judicial authority before expunging arrest record);
NTEU v. IRS, 601 F. Supp. 1268, 1273 (D.D.C. 1985) (“Although the [inherent equitable power to
order the expungement of a record] is most frequently employed to vindicate express or implied
constitutional or statutory rights . . . the remedy need not always be so limited.”).
However, when such equitable remedies are requested pursuant solely to the doctrine of
ancillary jurisdiction – “which recognizes federal courts’ jurisdiction over some matters
(otherwise beyond their competence) that are incidental to other matters” – the courts generally
have not permitted equitable expungement. See Kokkonen v. Guardian Life Ins. Co. of Am., 511
U.S. 375, 378 (1994). Following Kokkonen, a number of circuits have found that Federal courts
do not maintain “inherited” powers ancillary to its original action to hear requests for equitable
expungement of records; jurisdiction must be grounded in the Constitution or by statute.
United States v. Wahi, 850 F.3d 296, 302 (7th Cir. 2017); Doe v. United States, 833 F.3d 192, 199
(2d Cir. 2016); United States v. Field, 756 F.3d 911, 916 (6th Cir. 2014); United States v. Coloian,
480 F.3d 47, 52 (1st Cir. 2007); United States v. Meyer, 439 F.3d 855, 862 (8th Cir. 2006); United
States v. Dunegan, 251 F.3d 477, 479 (3d Cir. 2001); United States v. Sumner, 226 F.3d 1005, 1014
(9th Cir. 2000).
B. 5 U.S.C. § 552a(g)(1)(B) - Access Lawsuits

“Whenever any agency . . . refuses to comply with an individual request under subsection (d)(1)
of this section [the individual may bring a civil action against the agency].” 5 U.S.C. § 552a(g)(1)
(B).
Comment:
Subsection (g)(1)(B) authorizes an individual to bring a civil suit against an agency that refuses
to comply with the individual’s access request. Sovereign immunity is not a defense in such
cases. See In re U.S. Office of Pers. Mgmt. Data Sec. Breach Litig., 928 F.3d 42, 61 (D.C. Cir.
2019) (noting that Privacy Act “provides . . . a waiver of sovereign immunity”); Braun v. USPS, No.
16-2079, 2017 WL 4325645, at *5 (D.D.C. Sept. 17, 2017) (concluding that Privacy Act access
lawsuit is not barred by sovereign immunity, because Act is statutory waiver of such immunity).

Requesters must exhaust administrative remedies before filing access suits under subsection (g)(1)
(B); unlike amendment suits under subsection (g)(1)(A), the exhaustion requirement in access suits
is not jurisdictional.
Just as under the FOIA, a requester must comply with agency procedures and exhaust all
available administrative remedies – through pursuit of an access request to the agency and, if
that request is denied, through an administrative appeal – prior to bringing a subsection (g)(1)(B)
action.
The exhaustion requirement cannot be found in the language of the Privacy Act itself, and
arises instead from jurisprudential exhaustion principles. Thus, it is not jurisdictional. Because
“[t]he language in [subsections (d)(1) and (g)] does not expressly require exhaustion of particular
administrative remedies,” there is no statutory requirement for exhaustion related to a request
for access to records. Taylor v. Treasury, 127 F.3d 470, 476 (5th Cir. 1997). The Court of
Appeals for the Fifth Circuit noted that, “[w]henever the Congress statutorily mandates that a
claimant exhaust administrative remedies, the exhaustion requirement is jurisdictional because
it is tantamount to a legislative investiture of exclusive original jurisdiction in the agency.” Id. at
475. However, in “the absence of a statutory requirement of exhaustion . . . the jurisprudential
doctrine of exhaustion controls. . . . The jurisprudential exhaustion doctrine is not jurisdictional
in nature.” Id. (citations omitted). The Fifth Circuit concluded that the plaintiff’s “failure to
exhaust administrative remedies did not constitute a jurisdictional bar to assertion of his claim
[for access to records, but] . . . application of the jurisprudential exhaustion doctrine in this case
indicates that . . . [plaintiff’s] claims under the Privacy Act must be dismissed for failure to state
a claim upon which relief can be granted.” Id. at 476-77.
The Courts of Appeals for the Third and Ninth Circuits also have recognized a jurisprudential
exhaustion requirement in Privacy Act cases. The Court of Appeals for the Third Circuit
followed Taylor and stated, “To the extent exhaustion of administrative remedies is required, it
is not a jurisdictional prerequisite.” Wadhwa v. VA, 342 F. App’x 860, 862-63 (3d Cir. 2009) (per
curiam) (citing Taylor, 127 F.3d at 475-76) (emphasis added). Rather, courts have required
plaintiffs seeking access to records to exhaust administrative remedies pursuant to the
“jurisprudential exhaustion doctrine.” See, e.g., id. The Third Circuit “disagree[d] with the
District Court’s conclusion that it lacks jurisdiction to entertain [plaintiff’s] claim [for access to
records] under the Privacy Act because [plaintiff] failed to exhaust his administrative
remedies.” 342 F. App’x at 862. See also Buckley v. Schaul, 135 F. App’x 960, 960 (9th Cir.
2005) (holding that “even in the absence of an explicit exhaustion requirement, a district court
may in its discretion require such exhaustion”).
As noted above in the section entitled, “5 U.S.C. § 552a(g)(1)(A) - Amendment Lawsuits,” access
lawsuits differ in this respect from amendment lawsuits. See also, e.g., Kvech v. Holder, No. 10-
cv-545, 2011 WL 4369452, at *8 (D.D.C. Sept. 19, 2011) (“While the Privacy Act requires that
plaintiffs first resort to administrative remedies for denials of requests to amend records, . . . the
statute does not contain a similar requirement with respect to an access claim.”). Because
subsection (d)(2) regarding amendment by its terms requires exhaustion, that requirement is
jurisdictional in nature. See 5 U.S.C. § 552a(d)(2); see also Quinn v. Stone, 978 F.2d 126, 137-38
(3d Cir. 1992) (“These provisions entail a requirement that the plaintiff exhaust her
administrative remedies before she can take advantage of [subsection (g)(1)(A)]” (citing Dickson
v. OPM, 828 F.2d 32, 40-41 (D.C. Cir. 1987))). But see Singh v. DHS, No. 1:12cv00498, 2013 WL
1704296, at *10-12 (E.D. Cal. Apr. 19, 2013) (following Taylor, a Privacy Act access case, and
finding exhaustion requirement for the plaintiff’s amendment claim as non-jurisdictional).
Plaintiffs’ access requests must conform to agency regulations to exhaust administrative remedies.
Nearly all courts have concluded that plaintiffs fail to exhaust administrative remedies if their
access requests do not conform to agency regulations. See, e.g., Vaughn v. Danzig, 18 F. App’x
122, 125 (4th Cir. 2001) (per curiam) (affirming district court’s summary judgment for agency
because plaintiff’s “telephonic request for the record before it was destroyed did not comply
with the requirement for submitting a request under the Freedom of Information Act, Privacy
Act, or Navy regulations implementing those statutes”); Taylor, 127 F.3d at 473-78 (upholding
dismissal of plaintiff’s request because plaintiff’s “Privacy Act requests plainly did not comply
with [agency] regulations because he did not list the systems that he wished to have searched,
their location, and the business address of the systems officer”); Powell v. IRS, 317 F. Supp. 3d
266 (D.C.C. 2018) (concluding that plaintiff failed to exhaust all but one request because he did
not comply with agency requirements to clearly mark request or to state that request was
pursuant to statute), reconsidered in nonpertinent part, Powell v. IRS, No. CV 17-278, 2018 WL
10196621, at *1 (D.D.C. Sept. 12, 2018); Powell v. IRS, 255 F. Supp. 3d 33, 42 (D.D.C. 2017)
(dismissing same plaintiff’s earlier suit because he referred only to FOIA in his initial request
and failed to file any proper request under agency’s Privacy Act regulations); Haley v. SSA, No.
JKB-14-3775, 2015 WL 3745618 (D. Md. June 11, 2015) (dismissing complaint because plaintiff
did not mail request to proper office or properly identify records requested); Canada v. Soc. Sec.
of Worcester Mass., No. 14-40041-TSH, 2014 U.S. Dist. LEXIS 198790, at *4-5 (D. Mass. 2014)
(concluding that plaintiff failed to state cause of action because he did not allege that he had
asked for document in question under agency’s Privacy Act regulations); Godaire v. Napolitano,
No. 3:10cv01266, 2010 WL 6634572, at *7 (D. Conn. Nov. 17, 2010); Ioane v. Comm’r of IRS, No.
3:09-CV-00243, 2010 WL 2600689, at *4 (D. Nev. Mar. 11, 2010); Sterrett v. Navy, No. 09-CV-
2083, 2010 WL 330086, at *3-4 (S.D. Cal. Jan. 20, 2010); Gadd v. United States, No.
4:08CV04229, 2010 WL 60953, at *12 (E.D. Ark. Jan. 5, 2010), aff’d, 392 F. App’x 503 (8th Cir.
2010); Ramstack v. Army, 607 F. Supp. 2d 94, 102-03 (D.D.C. 2009); Willis v. DOJ, 581 F. Supp. 2d
57, 69-70 (D.D.C. 2008); Mulhern v. Gates, 525 F. Supp. 2d 174, 187 (D.D.C. 2007); Brown v. DOJ,
No. 02-2662, slip op. at 20-24 (N.D. Ala. June 21, 2005); MacLeod v. IRS, No. 99-1088, 2001 U.S.
Dist. LEXIS 9327, at *3-4 (S.D. Cal. June 4, 2001); Broaddrick v. Exec. Office of the President, 139
F. Supp. 2d 55, 61 (D.D.C. 2001), aff’d per curiam, No. 01-5178 (D.C. Cir. May 1, 2002); Scaife v.
IRS, No. 02-1805, 2003 U.S. Dist. LEXIS 22661, at *8 (D.D.C. Nov. 20, 2003); Flowers v. Exec.
Office of the President, 142 F. Supp. 2d 38, 44 (D.D.C. 2001); Walker v. Henderson, No. 98 C
3824, 1999 WL 39545, at *9 (N.D. Ill. Jan. 20, 1999), appeal voluntarily dismissed, No. 99-1615
(7th Cir. May 27, 1999); Reeves v. United States, No. 94-1291, 1994 WL 782235, at *2 (E.D. Cal.
Nov. 16, 1994), aff’d, 108 F.3d 338 (9th Cir. 1997) (unpublished table decision); Taylor v. Def. Fin.
& Accounting Servs., No. 2:12-2466, 2014 U.S. Dist. LEXIS 268, at *16-25 (E.D. Cal. Jan. 3, 2014);
Fields v. IRS, No. 12-14753, 2013 WL 3353921, at *3 (E.D. Mich. July 3, 2013); Cross v. Potter, No.
3:09-CV-1293, 2013 WL 1149525, at *9 (N.D.N.Y. Mar. 19, 2013); Guzman v. United States, No. S-
93-1949, slip op. at 3-5 (E.D. Cal. Oct. 5, 1994); Hass v. Air Force, 848 F. Supp. 926, 930 (D. Kan.
1994); Gergick v. Austin, No. 89-0838-CV-W-2, 1992 U.S. Dist. LEXIS 7338, at *13-16 (W.D. Mo.
Apr. 29, 1992), aff’d, No. 92-3210 (8th Cir. July 9, 1993); Wood v. IRS, No. 1:90-CV-2614, 1991 U.S.
Dist. LEXIS 19707, at *8 (N.D. Ga. July 26, 1991); Searcy v. SSA, No. 91-C-26 J, slip op. at 8-11 (D.
Utah June 25, 1991) (magistrate’s recommendation), adopted, (D. Utah Sept. 19, 1991), aff’d, No.
91-4181, 956 F.2d 278 (10th Cir. 1992) (unpublished table decision); Crooker v. Marshals Serv.,
577 F. Supp. 1217, 1217-18 (D.D.C. 1983); Lilienthal v. Parks, 574 F. Supp. 14, 18 & n.7 (E.D. Ark.
1983); Gibbs v. Rauch, No. 77-59, slip op. at 2-3 (E.D. Ky. Feb. 9, 1978); Larsen v. Hoffman, 444 F.
Supp. 245, 256 (D.D.C. 1977); cf. Banks v. DOJ, 605 F. Supp. 2d 131, 139 (D.D.C. 2009) (concluding
that plaintiff failed to exhaust administrative remedies with respect to instant request because
he did not pay record duplication fees for earlier request); Nurse v. Sec’y of the Air Force, 231 F.
Supp. 2d 323, 331 (D.D.C. 2002) (“[W]hile the FOIA requires that a request must ‘[reasonably]
describe’ the records, Privacy Act requests require greater specificity.”); but see Clutter v.
Perdue, No. H-18-310, 2019 WL 1589942, at *7 (S.D. Tex. Jan. 28, 2019) (allowing plaintiff’s claim
to proceed without explicitly considering his compliance with agency requirements because he
sufficiently pled that he submitted a FOIA/Privacy Act request for records but that the request
was not acknowledged and that records were not produced).
In access suits, plaintiffs generally must file an administrative appeal to exhaust administrative
remedies.
The courts also generally have dismissed a plaintiff’s complaint for failure to exhaust
administrative remedies if the plaintiff did not file an administrative appeal to an agency’s
denial of the access request. See Lopez v. NARA, 301 F. Supp. 3d 78, 90 (D.D.C. 2018)
(dismissing plaintiff’s Privacy Act claim for failure to exhaust administrative remedies where
plaintiff “never internally appealed NARA’s determination, and plaintiff never sent a proper
request to CIA”); Kearns v. FAA, 312 F. Supp. 3d 97, 107 (D.D.C. 2018) (finding that because
plaintiff “did not appeal the FAA’s determination regarding his November 2015 Privacy Act
request, Kearns did not pursue the full extent of his administrative remedies”); Varad v. United
States Dep’t of Treasury, No. 18-91338-RGS, 2018 WL 3849861, at *2 (D. Mass. Aug. 13, 2018)
(dismissing plaintiff’s complaint because her access requests were submitted to agency less
than 30 days ago, suggesting that requester had not yet filed or completed appeal); Barouch v.
DOJ, 422 F. Supp. 2d 30, 67-68 (D.D.C. 2013); Yee v. Solis, No. C-08-4259, 2010 WL 1655816, at
*14 (N.D. Cal. Apr. 22, 2010), aff’d on other grounds, No. 10-16376, 2012 WL 902895 (9th Cir. Mar.
19, 2012); Gadd, 2010 WL 60953, at *12; Bettweiser v. Lucas, No. 06-CIV-0142, 2007 WL
2601089, at *2 (D. Idaho Sept. 10, 2007); Clemmons v. DOJ, No. 06-00305, 2007 WL 1020796, at
*5 (D.D.C. Mar. 30, 2007); Sussman v. DOJ, No. 03-3618, 2006 WL 2850608, at *5 (E.D.N.Y. Sept.
30, 2006); Glenn v. Rumsfeld, No. C 05-01787, 2006 WL 515626, at *6-7 (N.D. Cal. Feb. 28,
2006); Biondo v. Navy, 928 F. Supp. 626, 630-33 (D.S.C. 1995), aff’d, 86 F.3d 1148 (4th Cir. 1996)
(unpublished table decision); Hass v. Air Force, 848 F. Supp. 926, 930 (D. Kan. 1994); cf.
Ramstack, 607 F. Supp. 2d at 104 (holding defendant bears burden of proving affirmative
defense of failure to exhaust administrative remedies). But see Fischer v. FBI, No. 07-2037,
2008 WL 2248711, at *2 (D.D.C. May 29, 2008) (excusing failure to file administrative appeal
where agency had previously remanded request on administrative appeal and requester
apparently did not understand that he had to file second appeal after agency reprocessed the
request); Mumme v. Labor, 150 F. Supp. 2d 162, 171 (D. Me. 2001) (refusing to “strictly apply
formalistic procedural rules against [p]laintiff” because “[p]rocedural rules . . . cut both ways,”
and it was not clear that agency’s response letter “included any written explanation of the
partial grant of [p]laintiff’s appeal as required by [its] regulation”), aff’d, No. 01-2256 (1st Cir.
June 12, 2002).
An agency’s failure to meet its own deadlines does not constructively exhaust an individual’s
administrative remedies.
The Court of Appeals for the Fourth Circuit and several district courts have noted that an
individual cannot “constructively exhaust” administrative remedies under the Privacy Act – i.e.,
deem that administrative remedies are exhausted where the agency failed to timely respond –
because “the Privacy Act contains no equivalent to FOIA’s ‘constructive exhaustion’ provision [5
U.S.C. § 552(a)(6)(C)].” Pollack v. DOJ, 49 F.3d 115, 116 n.1, 118-19 (4th Cir. 1995) (indicating that
only FOIA claim was properly before district court because “Privacy Act contains no equivalent
to FOIA’s ‘constructive exhaustion’ provision which . . . enabled the district court to review his
FOIA request”); see also Kearns v. FAA, 312 F. Supp. 3d at 107 (D.D.C. 2018) (concluding that
although plaintiff argued that he “‘constructively exhausted’ his Privacy Act claims, . . . the law is
clear that such a route to exhaustion is not available under the statute”); Gadd, 2010 WL 60953,
at *12 (citing Pollack and dismissing access claim for failure to exhaust administrative
remedies); Barouch v. DOJ, 962 F. Supp. 2d at 68 (stating that no equivalent constructive
exhaustion provision exists under Privacy Act and finding “that plaintiff failed to exhaust his
administrative remedies with respect to his [Privacy Act] request to EOUSA” and accordingly,
court lacked subject matter jurisdiction); Sussman v. DOJ, No. 03-3618, 2006 WL 2850608, at *5
(E.D.N.Y. Sept. 30, 2006) (“The Privacy Act . . . does not allow for ‘constructive exhaustion,’ and
prohibits a requester from filing an action without having obtained a response from the
agency.”); Anderson v. USPS, 7 F. Supp. 2d 583, 586 n.3 (E.D. Pa. 1998) (citing Pollack for
proposition that “Privacy Act contains no section equivalent to the ‘constructive exhaustion’
provision of the FOIA,” but alternatively finding that access suit must be dismissed for failure to
exhaust administrative remedies), aff’d, 187 F.3d 625 (3d Cir. 1999) (unpublished table decision);
cf. Johnson v. FBI, No. 94-1741, slip op. at 6 (D.D.C. Aug. 31, 1995) (citing Pollack but determining
that “since plaintiff has sought an action in equity, and has not exhausted his administrative
remedies through administrative appeal . . . plaintiff is barred from seeking injunctive relief
under the Privacy Act”).
An agency’s failure to comply with its own regulations, however, can undercut an exhaustion
defense. See Jonsson v. IRS, No. 90-2519, 1992 WL 115607, at *1 (D.D.C. May 4, 1992); Haldane v.
Comm’r, No. 90-654M, 1990 U.S. Dist. LEXIS 11612, at *4-6 (W.D. Wash. Aug. 23, 1990).

Access suits are reviewed in the federal courts de novo.
The civil remedies subsection for access suits establishes parameters for such suits, including
the standard of judicial review. In civil actions for access, courts “shall determine the matter de
novo.” 5 U.S.C. § 552a(g)(3)(A). See Doe v. United States, 821 F.2d 694, 697-98 (D.C. Cir. 1987)
(en banc); Barouch v. DOJ, 87 F. Supp. 3d 10, 32 (D.D.C. 2015). Courts may review records in
camera to determine whether any of the exemptions set forth in subsection (k) apply. See 5
U.S.C. § 552a(g)(3)(A). Furthermore, in Privacy Act access cases, courts may rely on agency
affidavits or declarations to enter summary judgment in favor of the government, e.g., an
affidavit describing search terms and type of search performed to demonstrate that agency
conducted an adequate search. Elgabrowny v. CIA, No. 17-CV-00066, 2019 WL 1440345 (D.D.C.
Mar. 31, 2019) (citing Chambers v. Interior, 568 F. 3d 998, 1003 (D.C. Cir. 2009)). For more
detailed discussions of these topics, see “Individual’s Right of Access” section above and “Ten
Exemptions, Seven Specific Exemption Rules Agencies May Promulgate” section below.
Once an agency provides the requested records, any pending access claim is moot.
Several courts have recognized that jurisdiction to consider a Privacy Act access claim exists
only if the government has failed to comply with a request for records; once a request is
complied with and the responsive records have been disclosed, a Privacy Act access claim is
moot. See Jackson v. Shinseki, 526 F. App’x 814, 817 (10th Cir. 2013) (affirming district court’s
decision that plaintiff’s claim was moot because “defendants had ‘provided [appellant] with
copies of all responsive documents in their possession,’ thus agency was ‘discharg[ed]of their
obligations under the Privacy Act’”); Campbell v. SSA, 446 F. App’x 477, 480 (3d Cir. 2011);
Yonemoto v. VA, 305 F. App’x 333, 334 (9th Cir. 2008); Lovell v. Alderete, 630 F.2d 428, 430 (5th
Cir. 1980) (dismissing both FOIA and Privacy Act claims as moot where “[e]ven though the
information [plaintiff sought] was delivered late, [plaintiff] now has all of the information he
requested”); Crummey v. SSA, 794 F. Supp. 2d 46, 61 (D.D.C. June 30, 2011), aff’d per curiam, No.
11-5231, 2012 WL 556317 (D.C. Cir. Feb. 6, 2012); Dickerson v. SSA, No. A-10-CA-795-SS, 2011 WL
1332426, at *4 (W.D. Tex. June 8, 2011); Sterrett, 2010 WL 330086, at *2-3; Jordan v. DOJ, No. 07-
cv-02303, 2009 WL 2913223, at *26 (D. Colo. Sept. 8, 2009); Van Allen v. HUD, No. G-07-315,
2009 WL 1636303, at *1 (S.D. Tex. June 9, 2009); Falwell v. Exec. Office of the President, 158 F.
Supp. 2d 734, 740 (W.D. Va. 2001); Mumme, 150 F. Supp. 2d at 171-72; Fisher v. FBI, 94 F. Supp.
2d 213, 216 (D. Conn. 2000) (finding that plaintiff’s claim was moot where agency provided
material and that “[t]he fact that the records came after some delay is not necessarily
tantamount to an improper denial of the records”); Jacobs v. Reno, No. 3:97-CV-2698-D, 1999
U.S. Dist. LEXIS 3104, at *14-15 (N.D. Tex. Mar. 11, 1999) (dismissing access claim as moot where
plaintiff had received access to records and finding no eligibility for award of attorney fees and
costs based on plaintiff’s assertion that his lawsuit may have caused agency to comply with
Privacy Act when it would not otherwise have done so, “particularly when § 552a(d)(1) imposes
no deadline for agency compliance and absent evidence of extended and unjustified delay”),
aff’d, 208 F.3d 1006 (5th Cir. 2000) (unpublished table decision) Biondo, 928 F. Supp. at 631;
Letscher v. IRS, No. 95-0077, 1995 WL 555476, at *1 (D.D.C. July 6, 1995); Polewsky v. SSA, No.
5:93-CV-200, slip op. at 9-10 (D. Vt. Mar. 31, 1995) (magistrate’s recommendation), adopted, (D.
Vt. Apr. 13, 1995), aff’d, No. 95-6125, 1996 WL 110179, at *2 (2d Cir. Mar. 12, 1996); Smith v. Cont’l
Assurance Co., No. 91 C 0963, 1991 WL 164348, at *3 (N.D. Ill. Aug. 22, 1991); cf. Riser v. State,
No. 09-3273, 2010 WL 4284925, at *7 (S.D. Tex. Oct. 22, 2010) (dismissing claim “seek[ing] a
declaratory judgment that the agencies’ earlier withholding of his records . . . was improper” as
moot “because the documents have now been produced”); Yee, 2010 WL 1655816, at *14
(asserting that Privacy Act claim for access was moot where magistrate judge in prior order had
found that agency complied with his order to produce the record at issue to plaintiff).
Some courts have required plaintiffs to allege that an agency’s failure to provide access was
improper, not simply that the request was denied.
To maintain an access lawsuit under subsection (g)(1)(B), the plaintiff must allege not only that
access was requested and denied, but also that the denial or failure to act on the request was
improper. See Camper v. NSA, No. 1:18-cv-01794-PWG, 2019 WL 3841940, at *5 (D. Md. Aug. 15,
2019) (holding that plaintiff failed to allege what was improper about agency’s stated legal
grounds for denial, citing Singh v. DHS, No. 12-498-AWI, 2014 WL 67254, at *4 (E.D. Cal. Jan. 8,
2014), Biondo, 928 F. Supp. at 631 (D.S.C. 1995), and Bruan v. Agency, No. 15-18-H-DLC-JTJ, 2015
WL 12591720, at *1 (D. Mont. Oct. 30, 2015)); Fleischman v. Comm’r of Soc. Sec., No. 3:15-CV-
897-J-PDB, 2016 WL 7474577 (M.D. Fla. Dec. 29, 2016); cf. Beach v. DHS, No. CV 08–00420–
RGK, 2008 WL 11337801, at *2 (C.D. Cal. Sept. 2, 2008) (plaintiff sufficiently stated claim for
relief under subsection (g)(1)(B) by alleging that agency refused to disclose documents after
multiple requests).
Most courts have considered access to tax records under the Internal Revenue Code, rather than
the Privacy Act.
The Court of Appeals for the District of Columbia Circuit has ruled that “the specific provisions
of [26 U.S.C.] § 6103 rather than the general provisions of the Privacy Act govern the disclosure
of . . . tax information” and that “individuals seeking ‘return information’ . . . must do so pursuant
to § 6103 of the Internal Revenue Code, rather than the Privacy Act.” Lake v. Rubin, 162 F.3d 113,
115-16 (D.C. Cir. 1998). In reaching this conclusion, the D.C. Circuit looked to the legislative
history of § 6103 and embraced an earlier ruling by the Court of Appeals for the Seventh Circuit,
Cheek v. IRS, 703 F.2d 271, 272 (7th Cir. 1983) (per curiam), that similarly had held that § 6103
“displaces” the Privacy Act and shields tax return information from release to a first-party
requester. See also Kendrick v. Wayne Cnty., No. 10-13752, 2011 WL 2580675, at *1-2 (E.D. Mich.
June 29, 2011); Paige v. IRS, No. 1P-85-64-C, slip op. at 3-4 (S.D. Ind. Jan. 13, 1986); cf. Maxwell v.
O’Neill, No. 00-01953, 2002 WL 31367754, at *4 (D.D.C. Sept. 12, 2002) (“while [section] 6103
may supersede the Privacy Act, it does not supersede the FOIA”), aff’d, No. 04-5082 (D.C. Cir.
May 27, 2005). But cf. Sinicki v. Treasury, No. 97 CIV. 0901, 1998 WL 80188, at *3-5 (S.D.N.Y. Feb.
24, 1998) (finding Cheek unpersuasive in context of wrongful disclosure claim and denying
motion to dismiss Privacy Act claim, stating that “the language, structure, purpose and
legislative history of Section 6103 do not make manifest and clear a legislative intent to repeal
the Privacy Act as it applies to tax return information”).
The Court of Appeals for the Ninth Circuit has interpreted 26 U.S.C. § 7852(e) to likewise
prevent Privacy Act access to records pertaining to tax liability. Jacques v. IRS, 972 F.2d 1339
(unpublished disposition), 1992 WL 185449, at *2 (9th Cir. Aug. 5, 1992); O’Connor v. United
States, No. 89-15321, slip op. at 5 (9th Cir. June 4, 1991); see also Prince v. Comm’r, No. 98-17183,
1999 WL 511185, at *1 (9th Cir. July 15, 1999) (concluding that district court lacked subject
matter jurisdiction over claim for attorney fees in Privacy Act suit for access to tax return
records due to 26 U.S.C. § 7852(e)’s prohibition against application of subsection (g) of Privacy
Act to determinations of tax liability); Hart v. United States, No. 00-2158, 2000 WL 1727737, at
*1-2 (E.D. Pa. Sept. 27, 2000) (following Maxwell v. Rubin, infra, and dismissing access claim for
lack of subject matter jurisdiction for records relating, “directly and indirectly, to tax disputes
with the IRS concerning liability,” because although § 7852(e) does not exempt the IRS from the
access provision, it does exempt it from the civil remedy provision), aff’d, 275 F.3d 35 (3d Cir.
2001) (unpublished table decision); Weiss v. Sawyer, 28 F. Supp. 2d 1221, 1227-28 (W.D. Okla.
1997) (applying 26 U.S.C. § 7852 to prevent apparent access claim); cf. Baker v. Matson, No. 98
M 1675, 1998 U.S. Dist. LEXIS 21312, at *8-9 (D. Colo. Dec. 7, 1998) (ruling that court had no
jurisdiction over Privacy Act access claim) (magistrate’s recommendation), adopted, No. 98 M
1675, 1999 WL 521287 (D. Colo. Jan. 12, 1999). The Ninth Circuit’s rationale differs from the
rationale applied by the D.C. Circuit, however. Cf. Lake v. Rubin, 162 F.3d at 114-16 (affirming
judgments of district court “not on the jurisdictional rationale contained in” opinions in the Ninth
Circuit based on § 7852, which the D.C. Circuit questioned, but instead on the basis of 26 U.S.C.
§ 6103, which provides the exclusive means by which individuals may obtain their tax records);
Wood v. IRS, No. 1:90-CV-2614, 1991 U.S. Dist. LEXIS 19707, at *1, 8 (N.D. Ga. July 29, 1991)
(denying plaintiff summary judgment on its Privacy Act claim for access to tax records, based
on plaintiff’s failure to exhaust remedies, without addressing whether court had jurisdiction to
review the claim in light of § 7852 or § 6103).
3. Remedies
Courts can order agencies to produce the requested records; monetary damages, however, are not
available in access cases.
In access lawsuits, courts can enjoin the agency from withholding records and order their
production to the individual. See 5 U.S.C. § 552a(g)(3)(A); Kursar v. Transportation Sec. Admin.,
581 F. Supp. 2d 7, 19 (D.D.C. 2008) (citing Doe v. Stephens, 851 F.2d 1457, 1463 (D.C. Cir. 1988));
Dick v. Holder, 67 F. Supp. 3d 167, 187 (D.D.C. 2014) (citing, inter alia, Kursar).
Lastly, damages are not recoverable in an access case. See Benoist v. United States, No. 87-
1028, slip op. at 3 (8th Cir. Nov. 4, 1987); Thurston v. United States, 810 F.2d 438, 447 (4th Cir.
1987); Kvech, 2011 WL 4369452, at *8 n.13; Brown v. DOJ, No. 02-2662, slip op. at 27 (D. Ala.
June 21, 2005); Haddon v. Freeh, 31 F. Supp. 2d 16, 22 (D.D.C. 1998); Vennes v. IRS, No. 5-88-36,
slip op. at 6-7 (D. Minn. Oct. 14, 1988) (magistrate’s recommendation), adopted, (D. Minn. Feb. 14,
1989), aff’d, No. 89-5136MN, 890 F.2d 419 (8th Cir. 1989) (unpublished table decision); Bentson
v. Comm’r, No. 83-048-GLO-WDB, slip op. at 2 (D. Ariz. Sept. 14, 1984); see also Quinn v. HHS,
838 F. Supp. 70, 76 (W.D.N.Y. 1993) (citing Thurston in dictum). But cf. Beattie v. Astrue, 845 F.
Supp. 2d 184, 195 (D.D.C. 2012) (ruling that plaintiff “failed to make out a claim under the
Privacy Act” because agency’s responses did not meet the intentional and willful standard);
Robinson v. Watkins, No. 4:11cv89, 2011 WL 6029969, at *5 (E.D. Va. Oct. 13, 2011) (“The relief
provided [under the Privacy Act] is that the plaintiff will be given access to the record, and for
monetary damages if an agency’s persistent refusal to allow access is ‘intentional and willful.’”);
Riser, 2010 WL 4284925, at *7 (“Plaintiff’s factual assertions about his repeated Privacy Act
requests and the delay in receiving records are insufficient to raise an inference of willful or
intentional withholding of records about him.”); Fischer v. DOJ, 723 F. Supp. 2d 104, 115 (D.D.C.
2010) (refusing to award damages on ground that agency “neither inappropriately withheld
information nor acted in bad faith” where plaintiff sought damages pursuant to subsection (g)(1)
(D) in connection with his access request).
C. 5 U.S. § 552a(g)(1)(C) - Damages Lawsuits for Failure to Assure Fairness

in Agency Determination
“Whenever any agency . . . fails to maintain any record concerning any individual with such
accuracy, relevance, timeliness, and completeness as is necessary to assure fairness in any
determination relating to the qualifications, character, rights, or opportunities of, or benefits to
the individual that may be made on the basis of such record, and consequently a determination
is made which is adverse to the individual . . . the individual may bring a civil action against the
agency.” 5 U.S.C. § 552a(g)(1)(C).
Comment:
Subsection (g)(1)(C) allows individuals to sue an agency for failure to maintain records with such
“accuracy, relevance, timeliness, and completeness” as is necessary to assure fairness in agency
determinations.
This section provides a civil remedy against an agency that does not maintain its records in
accordance with the requirements of section (e)(5) of the Privacy Act. The standard for
maintaining records under this provision is identical to the standard under subsection (e)(5),
which requires agencies to maintain records used in making determinations about individuals
“with such accuracy, relevance, timeliness, and completeness as is reasonably necessary to
assure fairness to the individual in the determination.” See, e.g., Bettersworth v. FDIC, 248 F.3d
386, 390 n.3 (5th Cir. 2001) (explaining that the “statutory obligation” imposed by subsection (e)
(5) “is made enforceable by substantively identical language in subsection 552a(g)(1)(C)”); Doe
v. United States, 821 F.2d 694, 698 n.10 (D.C. Cir. 1987) (en banc) (concluding that agency record
met accuracy standard although subsection (e)(5) “uses the phrase ‘reasonably necessary to
assure fairness’ whereas subsection (g)(1)(C)] does not include the word ‘reasonably.’ We
attribute no substantive significance, for the issue at hand, to the omission of the word
‘reasonably’ in § 552a(g)(1)(C).”); Gard v. Dep’t of Educ., 789 F. Supp. 2d 96, 106 (D.D.C. 2011)
(explaining that claim alleging violation of subsection (e)(5) “is entirely duplicative” of claim
alleging violation of subsection (g)(1)(C) because “[c]laims predicated upon violations of Section
552a(e)(5) . . . must be brought under 552a(g)(1)(C)”).
The key element of the standard – the necessity ‘to assure fairness in any determination’ – calls
for a balanced judgment, one inherently involving a reasonableness criterion. Edison v. Army,
672 F.2d 840, 843 (11th Cir. 1982) (concluding that although it “must be read in pari materia with
subsection (e)(5),” “[i]f the court determines that the agency has done what is reasonable in
assuring the accuracy of the information, no more is required.”).
Assuming that an individual meets the requirements for establishing an agency’s failure to
maintain a record concerning an individual with “accuracy, relevance, timeliness, and
completeness,” “actual damages” sustained by the individual, but in no case less than $1000,
are recoverable. See 5 U.S.C. § 552a(g)(4)(A). The meaning of “actual damages” and the $1000
minimum recovery provision are discussed below under “Principles Applicable to Damages
Lawsuits, Actual Damages.”

Most courts have concluded that plaintiffs are not required to exhaust administrative remedies to
obtain damages under (g)(1)(C).
Most courts have concluded that exhaustion of administrative remedies is not a prerequisite to
a civil action for damages under subsection (g)(1)(C). For example, in Hewitt v. Grabicki, 794
F.2d 1373, 1379 (9th Cir. 1986), the Ninth Circuit contrasted subsection “(g)(1)(A) (action for
order to amend record permitted when agency review resulted in denial of request or agency
refused to review)” with subsection “(g)(1)(C) (permits action where agency’s failure to maintain
proper records results in adverse determination against individual)” to conclude that
“[e]xhaustion of administrative remedies is not a precondition to bringing an action for damages
under the Privacy Act.” Phillips v. Widnall, No. 96-2099, 1997 WL 176394, at *2-3 (10th Cir. Apr.
14, 1997); Hubbard v. EPA, 809 F.2d 1, 7 (D.C. Cir. 1986), vacated in nonpertinent part & reh’g en
banc granted (due to conflict within circuit), 809 F.2d 1 (D.C. Cir. 1986), resolved on reh’g en banc
sub nom. Spagnola v. Mathis, 859 F.2d 223 (D.C. Cir. 1988); Nagel v. HEW, 725 F.2d 1438, 1441 &
n.2 (D.C. Cir. 1984); Johnson v. Air Force, No. CV F 09-0281, 2010 WL 1780231, at *6 (E.D. Cal. Apr.
30, 2010) (citing Hewitt), aff’d on other grounds, 465 F. App’x 644 (9th Cir. 2012); Reitz v. USDA,
No. 08-4131, 2010 WL 786586, at *11 n.12 (D. Kan. Mar. 4, 2010); Murphy v. United States, 121 F.
Supp. 2d 21, 28 (D.D.C. 2000), aff’d per curiam, 64 F. App’x 250 (D.C. Cir. 2003); M.K. v. Tenet, 99
F. Supp. 2d 12, 20 (D.D.C. 2000) (quoting Nagel); Gergick v. Austin, No. 89-0838-CV-W-2, 1992
U.S. Dist. LEXIS 7338, at *13-16 (W.D. Mo. Apr. 29, 1992), aff’d, No. 92-3210 (8th Cir. July 9, 1993).
A few other courts have found otherwise, however, requiring plaintiff to exhaust administrative
remedies before bringing an (e)(5) claim under (g)(1)(C). Moore v. Potter, No. 3:04-CV-1057, 2006
WL 2092277, at *8 (M.D. Fla. July 26, 2006); see, e.g., Olivares v. NASA, 882 F. Supp. 1545, 1546,
1552 (D. Md. 1995) (concluding that plaintiff’s failure to exhaust administrative remedies
precludes damages claim under subsection (e)(5)), aff’d, 103 F.3d 119 (4th Cir. 1996)
(unpublished table decision); Graham v. Hawk, 857 F. Supp. 38, 40 (W.D. Tenn. 1994) (stating
that “[e]ach paragraph of 5 U.S.C. § 552a(g) . . . requires as a prerequisite to any action that the
agency refuse an individual’s request to take some corrective action regarding his file”), aff’d,
59 F.3d 170 (6th Cir. 1995) (unpublished table decision).
A provision of the Prison Litigation Reform Act of 1996 (“PLRA”), 42 U.S.C. § 1997e(a) (2018),
requires inmates to exhaust administrative remedies prior to bringing an “action . . . with respect
to prison conditions,” which may include accuracy of records and requests for correction. 42
U.S.C. § 1997e(a). However, when the inmate seeks remedies concerning accuracy pursuant to
subsection (e)(5)/(g)(1)(C) and correction of records under (d)(2) in a system of records that
maintains exemptions of (e)(5) and (d)(2), this provision of the PLRA has minimal practical
effect. See Barnett v. United States, 195 F. Supp. 3d 4, 8 (D.D.C. 2016) (any claims for correction
of alleged erroneous information contained in an inmate’s central file, including presentence
reports, fails because BOP has exempted its Inmate Central Record System from Privacy Act’s
(e)(5) accuracy and (d)(2) amendment requirements under (j)(2), 28 C.F.R. § 16.97(j)). But cf.
McCulough v. BOP, No. 1:06-cv-00563, 2011 WL 3568800, at *3-4 (E.D. Cal. Aug. 12, 2011)
(recommending dismissal of claim that “BOP violated the Privacy Act through its maintenance
of inaccurate records and use of those records as the basis for decisions that adversely
affected Plaintiff” on ground that plaintiff failed to satisfy exhaustion requirement of PLRA)
(magistrate’s recommendation), adopted, 2011 WL 4373939 (E.D. Cal. Sept. 19, 2011). For a
discussion of the exhaustion requirement imposed by the PLRA on claims for damages brought
by prisoners under subsection (g)(1)(D), see the discussion below under “5 U.S.C. § 552a(g)(1)(C) -
Damages Lawsuits for Failure to Comply with Other Privacy Act Provisions.”
2. Elements of a Damages Claim

In a suit for damages under subsection (g)(1)(C), an individual has the burden of proving that: (1)
he or she “has been aggrieved by an adverse determination”; (2) the agency “failed to maintain
his or her records with the degree of accuracy necessary to assure fairness in the
determination”; (3) the agency’s “reliance on the inaccurate records was the proximate cause of
the adverse determination”; and (4) the agency “acted intentionally or willfully in failing to
maintain accurate records.” Deters v. U.S. Parole Comm’n, 85 F.3d 655, 657 (D.C. Cir. 1996).
In most cases, courts have found that plaintiffs have not met one or more of these elements and,
therefore, were not entitled to damages
a. First Element: Aggrieved by Adverse Determination
Considering the first requirement for a damages suit under subsection (g)(1)(C), the courts often
have concluded that the plaintiff was not “aggrieved” or that the agency action at issue did not
constitute an “adverse determination.” See, e.g., Bettersworth v. FDIC, 248 F.3d 386, 392-93
(5th Cir. 2001) (holding that Federal Reserve Bank letter informing company that its application
was unlikely to be approved did not constitute “adverse determination” against plaintiff
because there were “diverse grounds relied upon in the Reserve Bank’s letter,” entity applying
was company, not plaintiff, and “informal oral or written statements made in the deliberative
process about a particular administrative determination do not constitute the determination
itself”); Jarrell v. Army Review Bd. Agency, No. 3:19-CV-00349, 2020 WL 2128612, at *3 (S.D.
Ohio May 5, 2020), report and recommendation adopted sub nom. Jarrell v. Army Review Boards
Agency, No. 3:19-CV-00349, 2020 WL 2909969 (S.D. Ohio June 3, 2020) (plaintiff did not
establish that he was “aggrieved” by inaccuracy in brother’s record because under subsection
552a(g)(1)(C), “only ‘the individual’ with inaccurate records who has suffered an adverse
determination may bring a § 552a(g)(1)(C) action”); Yusim v. SSA, 406 F. Supp. 3d 194, 196
(E.D.N.Y. 2018) (finding that SSA’s allegedly inaccurate listing of claimant’s application date for
benefits did not violate his Privacy Act rights, where he did not claim that failure to maintain
accurate records was done intentionally or willfully or that he suffered adverse determination);
Melvin v. SSA, 126 F. Supp. 3d 584, 606 (E.D.N.C. 2015) (dismissing plaintiff’s (g)(1)(C) claim
because there was “no adverse agency determination resulting from the SSA’s alleged failure
to maintain the September 29, 2010, appeal letter” and no decision had been made by SSA with
regard to plaintiff’s benefits); Scott v. Conley, 937 F. Supp. 2d 60, 78 (D.D.C. 2013) (dismissing
plaintiff’s Privacy Act claim for failure to allege “some adverse effect,” because plaintiff “has
not alleged facts to show that she has suffered or is suffering any adverse determination or
effect because of BOP’s alleged failure to comply with the requirement that it collect only
‘relevant and necessary’ information”); Elliott v. BOP, 521 F. Supp. 2d 41, 56 (D.D.C. 2007) (“The
fact that Plaintiff was kept at [a particular institution] during [the period during which plaintiff
alleged that BOP relied upon inaccurate or incomplete medical records] does not mean that the
BOP actually made a ‘determination’ to do so.”); Lee v. Geren, 480 F. Supp. 2d 198, 209-10 (D.D.C.
Mar. 29, 2007) (concluding that “mere issuance of a notice of proposed termination does not
constitute an ‘adverse determination’ under the Privacy Act” and that “[t]he only ‘adverse
determination’ at issue in this case is plaintiff’s fourteen-day suspension,” where plaintiff
received notice of proposed termination but was only suspended for two weeks); but see, e.g.,
Perry v. BOP, 371 F.3d 1304, 1305 (11th Cir. 2004) (relying on Ninth Circuit’s formulation of
elements necessary for Privacy Act claim under (g)(1)(C) in Rose v. United States, 905 F.2d 1257,
1259 (9th Cir. 1990), and concluding plaintiffs had alleged necessary elements to state claim,
vacating district’s court decision and remanding for district court to consider complaint under
Privacy Act); Toolasprashad v. BOP, 286 F.3d 576, 583-86 (D.C. Cir. 2002) (holding that transfer
of prisoner in alleged retaliation for exercise of his First Amendment rights constitutes
assertion of “adverse determination” under Privacy Act, sufficient to “survive [agency’s] motion
to dismiss”); Fleck v. VA OIG, No. CV 18-1452, 2020 WL 42842, at *6-8 (D.D.C. Jan. 3, 2020)
(denying VA’s motion to dismiss where second agency’s decision not to hire plaintiff was adverse
action, plaintiff sufficiently alleged factual inaccuracies in OIG report, and inaccuracies led to
second agency’s failure to hire him).
b. Second Element: Failure to Maintain Accurate, Relevant, Timely and/or Complete Records
Similarly, courts rarely have concluded that an agency failed to maintain accurate records. See,
e.g., Jones v. Luis, 372 F. App’x 967, 969-70 (11th Cir. 2010) (per curiam) (ruling that district court
properly dismissed Privacy Act claim where plaintiff “does not allege any errors in the BOP’s
record keeping” but rather merely “alleges that [a BOP official] misused the information in the
records to make an adverse determination against” plaintiff); Treadwell v. BOP, 32 F. App’x 519,
520-21 (10th Cir. 2002) (finding plaintiff’s claim that BOP erroneously based his security
classification in part on nonviolent juvenile robbery offense does not amount to violation of
Privacy Act where plaintiff agreed that conviction accurately appeared on his record but
disagreed with way BOP used that information); Williams v. BOP, No. 94-5098, 1994 WL 676801,
at *1 (D.C. Cir. Oct. 21, 1994) (asserting appellant did not establish either that agency
“maintained an inaccurate record or that it made a determination adverse to him in reliance on
inaccurate information capable of verification, the statutory prerequisites to maintaining an
action pursuant to the Privacy Act”); Hadley v. Moon, No. 94-1212, 1994 WL 582907, at *1-2 (10th
Cir. Oct. 21, 1994) (finding plaintiff must allege actual detriment or adverse determination in
order to maintain claim under Privacy Act); Ashbourne v. Hansberry, No. 12-cv-01153302, 2015
WL 11303198, at *7-9 (D.D.C. Nov. 25, 2015) (finding that plaintiff failed to allege claim under
subsection (g)(1)(C) since plaintiff did not present evidence of a single inaccurate record relied
upon by agency when reviewing misleading information provided by plaintiff during pre-
employment process), aff’d, 703 F. App’x. 3 (D.C. Cir. 2017); Doe v. Rogers, 139 F. Supp. 3d 120,
168 (D.D.C. 2015) (dismissing plaintiff’s (g)(1)(C) claim because “only agency ‘decision’ that
arguably meets this definition [of an adverse agency determination] is the Secretarial Review
Decision, but, again, the plaintiffs have not identified any inaccurate agency report that the
Secretary relied on to reach that decision”); Cross v. Potter, No. 3:09-CV-1293, 2013 WL 1149525,
at *9 (N.D.N.Y. Mar. 19, 2013) (dismissing plaintiff’s claim under § 552a(g)(1)(C) because “[t]he
record of a criminal acquittal is not an inaccuracy within her record simply because [p]laintiff
believes that the criminal charge was improperly brought against her”); Kvech v. Holder, No. 10-
cv-545, 2011 WL 4369452, at *5-6 (D.D.C. Sept. 19, 2011) (although plaintiff “pled facts
sufficient to show she was aggrieved by an adverse determination and the FBI acted
intentionally,” she “failed to plead facts which might establish” (1) “FBI failed to ‘assure fairness’
by maintaining inaccurate records; and (2) reliance on the inaccurate records was the
‘proximate cause’ of the adverse determination”); Feldman v. CIA, 797 F. Supp. 2d 29, 44-47
(D.D.C. 2011) (dismissing plaintiff’s (g)(1)(C) claim because plaintiff failed to set forth that agency
failed to maintain records with degree necessary to assure fairness in CIA director’s
determination, and because plaintiff primarily focused on disagreement with interpretation of
legal issues rather than factual errors); Hollins v. Cross, No. 1:09cv75, 2010 WL 1439430, at *5
(N.D. W. Va. Mar. 17, 2010) (“[B]ecause the plaintiff has failed to show that his [presentence
investigation report] is actually erroneous, he cannot show that the BOP’s use of that document
to make . . . administrative decisions, has had an adverse effect on him.”); Ramirez v. DOJ, 594 F.
Supp. 2d 58, 66-67 (D.D.C. 2009) (dismissing plaintiff’s (g)(1)(C) complaint because plaintiff
failed to show the records held by defendants were inaccurate), aff’d per curiam on other
grounds, No. 10-5016, 2010 WL 4340408 (D.C. Cir. Oct. 19, 2010); Doe v. DOJ, 660 F. Supp. 2d 31,
43 (D.D.C. 2009) (concluding that plaintiff “failed to show that there was an error in the records”
by objecting only to “misinterpretation of [accurate] records by DOJ employees, for which there
is no remedy under the Privacy Act”); De la Cruz-Jimenez v. DOJ, 566 F. Supp. 2d 7, 9-10 (D.D.C.
2008) (finding that plaintiff failed to establish the threshold requirement of an inaccurate
record, thus dismissing plaintiff’s (g)(1)(C) claim); but see, e.g., Perry, 371 F.3d at 1305 (finding
plaintiffs had alleged necessary elements to state claim, vacating district’s court decision and
remanding for district court to consider complaint under Privacy Act); Fleck v. VA OIG, 2020 WL
42842, at *6-8 (denying VA’s motion to dismiss where second agency’s decision not to hire
plaintiff was adverse action, plaintiff sufficiently alleged factual inaccuracies in OIG report, and
inaccuracies led to second agency’s failure to hire him); Ashbourne v. Hansberry, 302 F. Supp.
3d 338, 347 (D.D.C. 2018) (finding that plaintiff properly pled in her complaint that defendant
DHS failed to maintain accurate records when it intentionally and deliberatively failed to verify
facts in deciding to terminate plaintiff’s federal employment).
Most cases brought under (g)(1)(C) involve the “accuracy” standard, but the D.C. District Court
allowed a case to proceed under the “relevance” component.
Although most litigation pursuant to sections (e)(5)/(g)(1)(C) of the Privacy Act arises from
challenges to the accuracy component of the “accuracy, relevance, timeliness, and
completeness” standard, the District Court for the District of Columbia has considered a claim
alleging irrelevancy. In Gerlich v. DOJ, the court noted that “[m]ost ‘adverse determination’
claims hinge on inaccurate or incomplete records.” 659 F. Supp. 2d 1, 15 (D.D.C. 2009), aff’d in
part, rev’d in part, 711 F.3d 161, 163 (D.C. Cir. 2013). Here, however, the plaintiffs alleged that
“irrelevant records (i.e., the records of their First Amendment activities) led to an adverse
[hiring] determination against them.” Id. In denying the Department’s motion to dismiss, the
court stated: “By the plain language of (g)(1)(C), relevance stands on equal footing with
accuracy, timeliness and completeness as a basis for pursuing money damages for an adverse
determination.” Id. at 15-16 (holding that summary judgment was inappropriately granted under
subsections (e)(5) and (e)(7) claims and concluding “in light of the destruction of appellants’
records, that a permissive spoliation inference was warranted because the senior Department
officials had a duty to preserve the annotated applications and internet printouts given that
Department investigation and future litigation were reasonably foreseeable”). For a more
complete discussion of Gerlich, see the discussion under “5 U.S.C. § 552a(e)(5) - Maintain
Accurate, Relevant, Timely, and Complete Records” above.
c. Third element: Proximate Cause
Courts commonly have dismissed an individual’s (g)(1)(c) suit if that individual did not meet the
third requirement for such claims, i.e., that the agency’s reliance on inaccurate records was the
proximate cause of the adverse determination. See, e.g., Chambers v. Interior, 568 F.3d 998,
1007 (D.C. Cir. 2009) (dismissing plaintiff’s (g)(1)(C) claim because plaintiff failed to show
specific adverse determination resulting from agency’s failure to maintain accurate records);
Hutchinson v. CIA, 393 F.3d 226, 229-30 (D.C. Cir. 2005) (concluding that plaintiff failed to show
that alleged inaccuracies proximately caused adverse determination because record
demonstrates that she was dismissed for sustained poor performance spanning three years);
Rogers v. BOP, 105 F. App’x 980, 983-84 (10th Cir. 2004) (plaintiff failed to state Privacy Act
claim under (g)(1)(C) because he failed to show that inaccurate record caused his eligibility for
parole, rather than his legal ineligibility); Gowan v. Air Force, 148 F.3d 1182, 1194 (10th Cir. 1998)
(finding no adverse effect from Air Force’s informing Wyoming Bar of court-martial charges
preferred against plaintiff where plaintiff himself later informed Wyoming Bar without knowing
Air Force had already done so); Williams v. BOP, No. 94-5098, 1994 WL 676801, at *1 (D.C. Cir.
Oct. 21, 1994) (asserting appellant did not establish either that agency “maintained an
inaccurate record or that it made a determination adverse to him in reliance on inaccurate
information capable of verification, the statutory prerequisites to maintaining an action
pursuant to the Privacy Act”); Colley v. James, 254 F. Supp. 3d 45, 67 (D.D.C. 2017) (finding that
plaintiffs did not establish that the Air Force violated Privacy Act by engaging in willful or
intentional conduct because agency had corrected inaccurate information pertaining to their
appeal and there was no indication that incorrect information had been relied upon as part of
appeal); Gillman v. United States, No. 16-00001, 2017 WL 969180, at *4-5 (D. Hawaii March 13,
2017) (finding that plaintiff “failed to establish the existence of a genuine issue of material fact
—namely, whether VA personnel acted intentionally or willfully in maintaining allegedly

inaccurate medical records,” and failed to provide “evidence to show that the VA’s maintenance
of allegedly inaccurate mental health records caused a required adverse determinationor actual
damages”); Ashbourne, 2015 WL 11303198, at *7-9 (finding that plaintiff failed to allege claim
under subsection (g)(1)(C) where plaintiff did not present evidence of inaccurate record relied
upon by agency when reviewing misleading information provided by plaintiff during pre-
employment process); Doe v. Rogers, 139 F. Supp. 3d at 168 (dismissing plaintiff’s (g)(1)(C) claim
because “only agency ‘decision’ that arguably meets this definition [of an adverse agency
determination] is the Secretarial Review Decision, but, again, the plaintiffs have not identified
any inaccurate agency report that the Secretary relied on to reach that decision”); Dick v.
Holder, 67 F.Supp.3d 167, 183-186 (D.D.C. 2014) (notwithstanding that plaintiff’s claim (g)(1)(C)
claim fails because alert FBI issued in response to statements made by plaintiff to agency
personnel was exempt from Privacy Act’s maintenance requirements, dismissing claim because
even if court accepted plaintiff’s security clearance suspension or mandatory fitness
examination as adverse determinations, plaintiff failed to show alert was cause of adverse
determinations); Singh v. DHS, No. 1:12-cv-00498, 2014 WL 67254, at *9-11 (E.D. Cal. Jan. 8, 2014)
(dismissing plaintiff’s (g)(1)(C) and (g)(1)(D) claims because plaintiff did not allege “sufficient
causal connection between the Government’s failure to document the alleged promise to
[p]laintiff that he would not be deported in conjunction with his plea and the removal
proceedings that were instituted as a result of his conviction”); Scott, 937 F. Supp. 2d at 78
(dismissing plaintiff’s Privacy Act claim for failure to allege “some adverse effect,” because
plaintiff “has not alleged facts to show that she has suffered or is suffering any adverse
determination or effect because of BOP’s alleged failure to comply with the requirement that it
collect only ‘relevant and necessary’ information”); New-Howard v. Shinseki, No. 09-5350, 2012
WL 2362546, at *9 (E.D. Pa. June 21, 2012) (“Plaintiff presents absolutely no evidence of
instances in which she was denied leave due to an absence of accrued leave” and “[a]s a
consequence, Plaintiff can maintain no cause of action for damages on the basis of the failure
to maintain records regarding her leave.”); Radakovic v. OPM, No. 11-10706, 2012 WL 1900037, at
*3 (D. Mass. May 23, 2012) (“Plaintiff does not allege at the time of the ‘adverse determination’ . .
. [agency] had any information available” because letter explaining reasons for plaintiff’s
separation from former employer was not provided to agency until “two years and one month
after plaintiff’s termination” and therefore plaintiff, “as a matter of law, does not allege a §
552a(g)(1)(C) violation.”), aff’d, No. 12-1934 (1st Cir. Apr 10, 2013); Kvech, 2011 WL 4369452, at
*5-6 (although plaintiff “pled facts sufficient to show she was aggrieved by an adverse
determination and the FBI acted intentionally,” she “failed to plead facts which might establish”
(1) “FBI failed to ‘assure fairness’ by maintaining inaccurate records; and (2) reliance on the
inaccurate records was the ‘proximate cause’ of the adverse determination.”); Conley v. United
States, No. 2:10-cv-444, 2011 WL 1256611, at *6-7 (S.D. Ohio Mar. 31, 2011) (“[A]ny possible
recovery under [(g)(1)(C)] is precluded because [plaintiff] has failed to adequately plead that an
adverse determination resulted from any of the [agency’s] alleged violations of the Privacy
Act.”); Ramey v. Marshals Serv., 755 F. Supp. 2d 88, 96-97 (D.D.C. 2010) (finding that plaintiff did
not “set forth specific facts showing a genuine issue for trial on the question of whether the U.S.
Marshals relied on inaccurate information in ordering Plaintiff's removal from the Twelfth
Circuit Contract”); Reitz, 2010 WL 786586, at *11 (dismissing plaintiff’s (g)(1)(C) claim because
plaintiff failed to show that mistake in Farm Service Agency’s records caused or led to the
agency’s adverse determination); Krieger v. DOJ, 529 F. Supp. 2d 29, 49-50 (D.D.C. 2008)
(explaining that even if former agency employee’s performance appraisal reports were missing
from his file, he “has adduced no evidence that his missing [reports] were the proximate cause
of his failure to obtain job offers”); Murphy v. United States, 167 F. Supp. 2d 94, 97-98 (D.D.C.
2001) (stating that although documents delayed plaintiff’s transfer and thus played a part in
transfer process, plaintiff “has neither shown that they caused the transfer nor identified a
genuine issue of fact that is material to the dispositive issue of causation”), aff’d per curiam, 64
F. App’x 250 (D.C. Cir. 2003); Schwartz v. DOJ, No. 94 CIV. 7476, 1995 WL 675462, at *7-8
(S.D.N.Y. Nov. 14, 1995) (finding alleged inaccuracy in presentence report “cannot have caused
an adverse determination” where sentencing judge was made aware of error and stated that
fact at issue was not material for sentencing, nor did any omission of additional facts in report
result in plaintiff’s “not receiving a fair determination relating to his rights”), aff’d, 101 F.3d 686
(2d Cir. 1996) (unpublished table decision); Kellett v. United States, 856 F. Supp. 65, 70-71
(D.N.H. 1994) (concluding that factors plaintiff claimed were inaccurate were not proximate
cause of agency determination where those factors “were not substantially relied on in
rendering the decision” and that where officials “did not substantially rely on the inaccurate
information,” plaintiff did not “establish intentional or willful conduct”), aff’d sub nom. Kellett v.
U.S. Bureau of Prisons, 66 F.3d 306 (1st Cir. 1995) (unpublished table decision); but see, e.g.,
Perry, 371 F.3d at 1305 (finding plaintiffs had alleged necessary elements to state claim,
vacating district’s court decision and remanding for district court to consider complaint under
Privacy Act); Fleck v. VA OIG, 2020 WL 42842, at *6-8 (denying VA’s motion to dismiss where
second agency’s decision not to hire plaintiff was adverse action, plaintiff sufficiently alleged
factual inaccuracies in OIG report, and inaccuracies led to second agency’s failure to hire him);
Makowski v. United States, 27 F. Supp. 3d 901, 914-15 (N.D. Ill. 2014) (“[Plaintiff] has linked the
alleged Privacy Act violation with his alleged damages by stating that ICE issued an unlawful
detainer against him because of its reliance on DHS’s inaccurate records, the detainer
disqualified [plaintiff] from boot camp, [plaintiff] was not processed into boot camp until his
father retained an attorney’s assistance to prompt ICE to cancel the detainer, and the delay in
processing into boot camp caused [plaintiff] to remain incarcerated from May to July 2011,
preventing him from seeking employment.”).
d. Fourth Element: Intentional or Willful Conduct
Finally, plaintiffs rarely have established that an agency intentionally or willfully failed to
maintain accurate records. See, e.g., Deters v. Parole Comm’n, 85 F.3d 655, 660 (D.C. Cir. 1996)
(concluding that where Parole Commission informed plaintiff that it would consider his
challenge and examine the accuracy of his records at parole hearing, no fact-finder could
determine that agency “flagrantly disregarded” plaintiff’s Privacy Act rights and that “a
violation (if any) could in no sense be deemed ‘patently egregious and unlawful.’”); Yusim, 406 F.
Supp. 3d at 196 (finding that SSA’s allegedly inaccurate listing of claimant’s application date for
benefits did not violate his Privacy Act rights, where he did not claim that failure to maintain
accurate records was done intentionally or willfully or that he suffered adverse determination);
Colley v. James, 254 F. Supp. 3d 45, 67 (D.D.C. 2017) (finding that plaintiffs did not establish that
the Air Force violated Privacy Act by engaging in willful or intentional conduct because agency
had corrected inaccurate information pertaining to their appeal and there was no indication that
incorrect information had been relied upon as part of appeal); Ahuruonye v. Interior, 239 F. Supp.
3d 136, 143 (D.D.C. 2017) (finding that plaintiff “failed to meet his burden of demonstrating that
the defendant intentionally or willfully failed to maintain his 2014 Within Grade Increase Notice
in the format requested”); Gillman v. United States, 2017 WL 969180, at *4-5 (finding that
plaintiff “failed to establish the existence of a genuine issue of material fact – namely, whether
VA personnel acted intentionally or willfully in maintaining allegedly inaccurate medical
records,” and failed to provide “evidence to show that the VA’s maintenance of allegedly
inaccurate mental health records caused a required adverse determinationor actual damages”);
Kellett, 856 F. Supp. at 70-71 (concluding that factors plaintiff claimed were inaccurate were
not proximate cause of agency determination where those factors “were not substantially relied
on in rendering the decision” and that where officials “did not substantially rely on the
inaccurate information,” plaintiff did not “establish intentional or willful conduct”); but see
Ashbourne v. Hansberry, 302 F. Supp. 3d at 347 (finding that plaintiff properly pled in her
complaint that defendant DHS failed to maintain accurate records when it intentionally and
deliberatively failed to verify facts in deciding to terminate plaintiff’s federal employment). For
additional discussion of the “intentional or willful” standard under 5 U.S.C. § 552a(g)(4) for
damages actions, see discussion below under “Principles Applicable to Damages Lawsuits,
Intentional or Willful Standard.”

Courts review (g)(1)(C) lawsuits under the standards set out in that section, not de novo.
Unlike amendment lawsuits under subsection (g)(1)(A), courts do not review subsection (g)(1)(C)
actions under a de novo standard. Compare 5 U.S.C. § 552a(g)(2) with id. § 552a(g)(4). Instead,
the courts determine whether the standards for “accuracy, relevance, timeliness, and
completeness” set forth in subsection (g)(1)(C) have been met. See White v. OPM, 787 F.2d 660,
663 (D.C. Cir. 1986) (“In § 552a(g)(1)(C) . . . suits for damages, however, de novo review is not
called for. Rather, the reviewing court is to inquire whether the standard articulated
in § 552a(g)(1)(C) has been met.”); see also Sellers v. BOP, 959 F.2d 307, 312-13 (D.C. Cir. 1992);
Nolan v. DOJ, No. 89-A-2035, 1991 WL 134803, at *3 (D. Colo. July 17, 1991), appeal dismissed in
pertinent part on procedural grounds, 973 F.2d 843 (10th Cir. 1992); Reitz, 2010 WL 786586, at
*10; see also Doe v. United States, 821 F.2d 694, 712 (D.C. Cir. 1987) (en banc) (Mikva, J., joined by
Robinson and Edwards, JJ., dissenting).
Plaintiffs cannot use subsection (g)(1)(C) lawsuits to collaterally attack agency determinations.
Just as in the amendment context (see “5 U.S.C. § 552a(g)(1)(A) - Amendment Lawsuits”

discussion above), many courts have expressed disfavor toward litigants who attempt to invoke
the subsection (g)(1)(C) damages remedy as a basis for collateral attacks on judicial and quasi-
judicial agency determinations, such as those denying benefit and or detrimental employment
decisions. See, e.g., Taylor v. Def. Fin. & Accounting Servs., No. 2:12-2466, 2014 U.S. Dist. LEXIS
268, at *25 (E.D. Cal. Jan. 3, 2014) (finding that plaintiff cannot use claim under (g)(1)(C) and (g)
(1)(D) to reopen determinations that plaintiff owed an overpay debt); Middlebrooks v. Mabus, No.
1:11cv46, 2011 WL 4478686, at *5 (E.D. Va. Sept. 23, 2011) (“Even if these claims were not
untimely, . . . plaintiff’s challenge to the accuracy of her record is a veiled attempt to relitigate
her discrimination claim, which is . . . beyond the scope of the [Privacy] Act” because “[t]he Act is
a vehicle for correcting facts in agency records if those facts are erroneously recorded but not
for altering records that reflect an administrative decision or assessments.”); Feldman, 797 F.
Supp. 2d at 47 (dismissing Privacy Act claim because “plaintiff's inaccuracy claims, at their
core, attempt to attack the judgment of a federal official, rather than to correct a factual or
historical error in an official record that proximately caused an adverse determination”); Doe v.
DOJ, 660 F. Supp. 2d at 42-43 (“[P]laintiff’s arguments that defendants lacked a basis to
terminate him because his job did not require a security clearance or because they failed to
follow the correct procedures . . . or that DOJ gave too much weight to his psychologist’s . . .
letter are impermissible attacks on DOJ’s personnel decisions and administrative actions.”
(citations omitted)); Allmon v. BOP, 605 F. Supp. 2d 1, 7 (D.D.C. 2009) (ruling that prisoner may
not “us[e] [a] Privacy Act suit as a means to effect his transfer to a less-secure facility”); Ray v.
DHS, No. H-07-2967, 2008 WL 3263550, at *10-11 (S.D. Tex. Aug. 7, 2008) (“To the extent that
[plaintiff’s] section 552a(g)(1)(C) claim seeks review of the TSA’s decision to suspend him
indefinitely without pay based on his failure to disclose his previous offenses,” it must be
dismissed because “[t]he Privacy Act . . . does not authorize relitigation of the substance of
agency decisions.”); Brown v. Prob. Office, No. 03-872, 2005 WL 2284207, at *3 (E.D. Tex. Aug.
15, 2005) (magistrate’s recommendation) (rejecting plaintiff’s claim as essentially a “challeng[e
to] the application of the classification guidelines, not the accuracy or completeness of the
information”), adopted, No. 03-872 (E.D. Tex. Sept. 9, 2005); Compro-Tax v. IRS, No. H-98-2471,
1999 U.S. Dist. LEXIS 5972, at *11-12 (S.D. Tex. Apr. 9, 1999) (magistrate’s recommendation)
(finding no intentional or willful agency action, and stating that “Privacy Act may not be used to
collaterally attack a final agency decision as ‘inaccurate,’ or ‘incomplete’ merely because the
individual contests the decision”), adopted, No. H–98–2471, 1999 WL 501014 (S.D. Tex. May 12,
1999); Douglas v. Farmers Home Admin., No. 91-1969, 1992 U.S. Dist. LEXIS 9159, at *2-3 (D.D.C.
June 26, 1992) (applying principles of White v. U.S. Civil Serv. Comm’n, 589 F.2d 713 (D.C. Cir.
1978) (per curiam) (holding that (g)(1)(A) plaintiff was not entitled to bring Privacy Act damages
action for allegedly inaccurate appraisal of his property where he had not sought judicial review
under APA)); Castella v. Long, 701 F. Supp. 578, 584-85 (N.D. Tex. 1988) (holding “collateral
attack on correctness of the finding supporting the discharge decision” is improper under Act),
aff’d, 862 F.2d 872 (5th Cir. 1988) (unpublished table decision); Holmberg v. United States, No.
85-2052, slip op. at 2-3 (D.D.C. Dec. 10, 1985) (stating that Privacy Act “cannot be used to attack
the outcome of adjudicatory-type proceedings by alleging that the underlying record was
erroneous”); cf. Bhatia, 2011 WL 1298763, at *4-5 (dismissing as “unripe” plaintiff’s “attempt[] to
collaterally attack the validity of the criminal indictment . . . under the guise of Privacy Act
claims” because “[t]he validity or invalidity of the criminal charges contained in the indictment
cannot be determined until the criminal action is finally resolved”), aff’d, 507 F. App’x 649 (9th
Cir. 2013). The OMB 1975 Guidelines, 40 Fed. Reg. at 28,969,
https://www.justice.gov/paoverview_omb-75, also address this issue.
Similarly, subsection (g)(1)(C) lawsuits filed to attack a criminal conviction or sentence are not
cognizable.
Federal prisoners frequently attempt to invoke the subsection (g)(1)(C) damages remedy as a
basis for a collateral attack on a conviction or the duration of a sentence. The Court of Appeals
for the D.C. Circuit has explained that “such a claim is not cognizable” unless the conviction or
sentence “has been invalidated in a prior proceeding.” White v. Prob. Office, 148 F.3d 1124, 1125-
26 (D.C. Cir. 1998) (per curiam). In White, the D.C. Circuit held that a Privacy Act claim for
damages could not be brought to “collaterally to attack” a federal prisoner’s sentence, stating
that: “Because a judgment in favor of [plaintiff] on his challenge to the legal conclusions in his
presentence report would necessarily imply the invalidity of his sentence, which has not been
invalidated in a prior proceeding, his complaint for damages under the Privacy Act must be
dismissed.” Id. at 1125-26. See also, e.g., Aguiar v. DEA, 334 F. Supp. 3d 130, 146 (D.D.C. 2018)
(finding plaintiff’s claims relating to accuracy of his GPS data not cognizable under Privacy Act
because such claims were being used to collaterally attack his conviction and sentence); Lewis
v. Parole Comm’n, 770 F. Supp. 2d 246, 249-51 (D.D.C. 2011) (dismissing claim that agency’s
reliance on allegedly inaccurate information adversely affected plaintiff in parole hearings
because “it is ‘probabilistic’ that the plaintiff’s claim, if successful, would result in a decreased
sentence or a more favorable parole decision” and such claims must be brought in habeas);
Cargill v. Prob. Office for the Middle Dist. of N.C., No. 10-0388, 2010 WL 917010, at *1 (D.D.C. Mar.
9, 2010) (citing White v. Prob. Office and stating that “plaintiff cannot maintain his Privacy Act
claim for damages based on the premise that his sentence is unlawful unless he can also show
that his sentence was invalidated by an appropriate court”); Skinner v. BOP, 584 F.3d 1093,
1098, 1101 (D.C. Cir. 2009) (explaining that federal inmate’s subsection (g)(1)(C) claim “is barred
unless and until he successfully challenges the disciplinary hearing on which it is based
through an action in habeas corpus”); Corley v. Parole Comm’n, 709 F. Supp. 2d 1, 5 (D.D.C. 2009)
(“To the extent that this Privacy Act case is a disguised collateral attack on the plaintiff’s
conviction and sentence by denying that an indictment ever issued or that a conviction was ever
obtained . . . this court must dismiss the case.”); Brown v. BOP, 498 F. Supp. 2d. 298, 303-04
(D.D.C. 2007) (“The Privacy Act is not the proper means by which a prisoner may collaterally
attack his sentence absent a showing that his sentence has been invalidated in a prior
proceeding.”); Wattleton v. Lappin, 94 F. App’x 844, 845 (D.C. Cir. 2004) (per curiam) (“[S]uccess
on [the] Privacy Act claim would, at a minimum, have a ‘probabilistic impact’ on the duration of
[the prisoner’s] custody, [because] appellant is required to proceed by way of a habeas
petition.”); Doyon v. DOJ, 304 F. Supp. 2d 32, 35 (D.D.C. 2004) (“A challenge to the professional
judgment of [BOP] officials in assessing points for purposes of establishing a prisoner’s custody
classification is not properly mounted by means of a Privacy Act suit.”); Razzoli v. BOP, 230 F.3d
371, 373, 376 (D.C. Cir. 2000) (holding that “habeas is indeed exclusive even when a non-habeas
claim would have a merely probabilistic impact on the duration of custody” and, therefore,
finding “not cognizable” prisoner’s claim that agency violated Privacy Act by relying on
inaccurate information in postponing his eligibility for parole); Thomas v. Parole Comm’n, No. 94-
0174, 1994 WL 487139, at *6 (D.D.C. Sept. 7, 1994) (stating that plaintiff should not be allowed to
use Privacy Act “to collaterally attack the contents of his presentence report,” as he “originally
had the opportunity to challenge the accuracy . . . before the judge who sentenced him”).
Other courts outside the D.C. Circuit also have rejected these types of claims on similar
grounds. See, e.g., Whitley v. Hunt, 158 F.3d 882, 889-90 (5th Cir. 1998) (affirming district
court’s conclusion that there was “no factual or legal basis” for claim that “prison officials
abused their discretion by relying upon the sentence imposed against Whitley to determine his
classification”; “Whitley is essentially claiming that his sentence itself was incorrectly entered.
That is an issue that should have been resolved on direct appeal from his criminal conviction”);
Hurley v. BOP, No. 95-1696, 1995 U.S. App. LEXIS 30148, at *4 (1st Cir. Oct. 24, 1995) (stating
that any alleged inaccuracy in plaintiff’s presentence report, which agency relied on, “should
have been brought to the attention of the district court at sentencing; or, at the very least, on
appeal from his conviction and sentence”); Wingo v. Farley, No. 4:12-CV-2072, 2013 WL 2151638,
at *3 (N.D. Ohio May 16, 2013) (explaining that “Privacy Act is not the proper vehicle to challenge
an agency’s opinions or judgments. Rather, the Act ‘is intended to remedy factual or historical
errors, and is not a vehicle for addressing the judgments of federal officials . . . reflected in
records maintained by federal agencies.’”); Eubanks v. United States, No. 2:09cv126, 2010 WL
1141436, at *2 (N.D. W. Va. Jan. 12, 2010) (magistrate’s recommendation) (asserting that claim
“seeking damages for the alleged miscalculation of [plaintiff’s] sentence should be dismissed”
because his “sentence calculation has never been invalidated”), adopted, 2010 WL 1141437 (N.D.
W. Va. Mar. 22, 2010), aff’d per curiam, 405 F. App’x 796 (4th Cir. 2010); Blanton v. Schultz, No.
105CV0001, 2005 WL 3507969, at *3 (E.D. Cal. Dec. 21, 2005) (finding that prisoner’s argument
that BOP is using “false information” to assign prisoner less favorable custody and security
classifications “is nothing more than an attempt to resurrect an otherwise improper [petition for
writ of habeas corpus]”).
Courts often have found Privacy Act damages claims under subsection (g)(1)(C) precluded by other
statutes.
As in the amendment context, 26 U.S.C. § 7852(e) (2018) (a provision of the Internal Revenue
Code) also displaces the Privacy Act’s damages remedy for inaccurate records in matters
concerning tax liability. See, e.g., Risk v. United States, No. 07-60025, 2007 WL 9701106, at * 2
(finding that “plaintiffs’ reliance on the Privacy Act of 1974 is also misplaced since the Internal
Revenue Code explicitly states that [(g)(1)(C)] is inapplicable in tax matters” (citing to 26 U.S.C.
§ 7852(e)); see also Ford v. United States, No. 91-36319, 1992 WL 387154, at *2 (9th Cir. Dec. 24,
1992); McMillen v. Treasury, 960 F.2d 187, 188 (1st Cir. 1991); Swartz v. IRS, No. 05-72215, 2006
WL 1374472, at *2 (May 18, 2006); Sherwood v. United States, No. 96-2223, 1996 WL 732512, at
*9 (N.D. Cal. Dec. 9, 1996).
In Hubbard v. EPA, the leading D.C. Circuit case concerning the causation requirement of
subsection (g)(1)(C), the D.C. Circuit’s finding of a lack of causation was heavily influenced by
the Civil Service Reform Act’s (CSRA) jurisdictional bar to district court review of government
personnel practices. See 809 F.2d at 5. Although the D.C. Circuit stopped short of holding that
the CSRA’s comprehensive remedial scheme constitutes a jurisdictional bar to a subsection (g)
(1)(C) action, it noted that “it would be anomalous to construe the pre-existing Privacy Act to
grant the district court power to do indirectly that which Congress precluded directly: ‘the
Privacy Act was not intended to shield [federal] employees from the vicissitudes of federal
personnel management decisions.’” Id. (quoting Albright v. United States, 732 F.2d 181, 190 (D.C.
Cir. 1984)); cf. Biondo v. Navy, No. 2:92-0184-18, slip op. at 21-23 (D.S.C. June 29, 1993) (finding,
based upon Hubbard, “that the ‘collateral attack’ argument complements the causation
requirement of the Privacy Act”). The concurring opinion in Hubbard argued, however, that
“[n]othing in the wording or legislative history of either Act” supports the majority’s “suggestion
that serious consideration of a Privacy Act claim in the context of a federal personnel dispute
somehow creates a potential conflict with the” (CSRA). 809 F.2d at 12-13 (Wald, J., concurring)
(citing Molerio v. FBI, 749 F.2d 815, 826 (D.C. Cir. 1984), Albright, 732 F.2d at 188, and Borrell v.
U.S. Int’l Commc’n Agency, 682 F.2d 981, 992-93 (D.C. Cir. 1982)). That opinion also noted that
circuit court precedents since the passage of the CSRA have, “without a hint of the majority’s
caution, reviewed the Privacy Act claims of federal employees or applicants embroiled in
personnel disputes.” Id.
Although Hubbard merely applied a strict causation test where a government personnel
determination was being challenged, several more cases have gone further and construed the
CSRA’s comprehensive remedial scheme to constitute a jurisdictional bar to subsection (g)(1)(C)
damages lawsuits challenging federal employment determinations. See Yu v. VA, 528 F. App’x
181, 184 (3d Cir. 2013) (affirming district court decision that VA’s actions that took place after
plaintiff’s termination “are personnel decisions because they ‘occurred only as result of the
employment relationship’ [plaintiff] had with the VA,” and therefore, preclude Privacy Act
damages claims); Doe v. FDIC, 545 F. App’x 6, 8 (2d Cir. 2013) (stating that because “Doe’s
Privacy Act claims fall within the definition of a ‘prohibited personnel action,’ the CSRA dictates
that Doe may not pursue her claims in federal court”); Orsay v. DOJ, 289 F.3d 1125, 1128-31 (9th
Cir. 2002); Phillips v. Widnall, No. 96-2099, 1997 WL 176394, at *3 (10th Cir. Apr. 14, 1997) (citing
Henderson v. SSA, infra, to hold that claim concerning alleged inaccuracies and omissions in
appellant’s employment file that formed basis of her claim for damages to remedy loss of
promotion and other benefits of employment “is not a recognizable claim under the Privacy Act,”
as “CSRA provides the exclusive remedial scheme for review of [appellant’s] claims related to
her position”); Vessella v. Air Force, No. 92-2195, 1993 WL 230172, at *2 (1st Cir. June 28, 1993)
(citing Hubbard and Henderson v. SSA, for the proposition that the Privacy Act “cannot be used
. . . to frustrate the exclusive, comprehensive scheme provided by the CSRA”); Houlihan v. OPM,
909 F.2d 383, 384-85 (9th Cir. 1990) (per curiam); Henderson v. SSA, 908 F.2d 559, 560-61
(10th Cir. 1990), aff’g 716 F. Supp. 15, 16-17 (D. Kan. 1989)); Minshew v. Donley, 911 F. Supp. 2d
1043, 1067-68 (D. Nev. 2012) (explaining that CSRA preempts plaintiff’s Privacy Act claim
because plaintiff “effectively seeks to achieve through a Privacy Act claim an interpretation of
the settlement agreement [between plaintiff] and the Air Force which resolved the appeal of
her removal pending before the MSPB . . . [plaintiff] thus must bring her claim before the MSPB,
not this Court”); Doe v. FDIC, No. 11 Civ. 307, 2012 WL 612461, at *5 (S.D.N.Y. Feb. 27, 2012) (“To
the extent [plaintiff] has alleged that the disclosures underlying her Privacy Act claims were
personnel actions taken in response to her reporting violations of banking laws and regulations,
the Court finds that these claims are precluded by the CSRA.”); Lim v. United States, No. 10-
2574, 2011 WL 2650889, at *8 (D. Md. July 5, 2011) (“[W]hile labeled as a Privacy Act violation,
[plaintiff] is ultimately challenging the basis for his discharge, a personnel decision which
cannot be challenged outside the framework of the CSRA.”); Pippinger v. Sec’y of the Treasury,
No. 95-CV-017, 1996 U.S. Dist. LEXIS 5485, at *15 (D. Wyo. Apr. 10, 1996) (citing Henderson and
stating that to extent plaintiff challenges accuracy of his personnel records, court does not
have jurisdiction “to review errors in judgment that occur during the course of an
employment/personnel decision where the CSRA precludes such review”), aff’d sub nom.
Pippinger v. Rubin, 129 F.3d 519 (10th Cir. 1997); Barhorst v. Marsh, 765 F. Supp. 995, 999 (E.D.
Mo. 1991); Barkley v. USPS, 745 F. Supp. 892, 893-94 (W.D.N.Y. 1990); McDowell v. Cheney, 718 F.
Supp. 1531, 1543 (M.D. Ga. 1989); Tuesburg v. HUD, 652 F. Supp. 1044, 1049 (E.D. Mo. 1987);
Edwards v. Baker, No. 83-2642, slip op. at 4-6 (D.D.C. July 16, 1986) (rejecting plaintiff’s Privacy
Act challenge to an “employee performance appraisal system” on the grounds that “plaintiffs
may not use that Act as an alternative route for obtaining judicial review of alleged violations of
the CSRA”).
Courts in other cases have declined to go that far. See, e.g., Doe v. FBI, 718 F. Supp. 90, 100-01
n.14 (D.D.C. 1989) (rejecting contention that CSRA limited subsection (g)(1)(C) action), aff’d in
part, rev’d in part & remanded, on other grounds, 936 F.2d 1346 (D.C. Cir. 1991); see also Halus v.
Army, No. 87-4133, 1990 WL 121507, at *5 n.8 (E.D. Pa. Aug. 15, 1990) (finding that the “court
may determine whether a Privacy Act violation caused the plaintiff damage (here, the loss of his
job)”); Hay v. Sec’y of the Army, 739 F. Supp. 609, 612-13 (S.D. Ga. 1990) (quoting Rogers v. Labor,
607 F. Supp. 697, 699 (N.D. Cal 1985), and Hewitt v. Grabicki, 794 F.2d at 1379) (acknowledging
that “Privacy Act ‘may not be employed as a skeleton key for reopening consideration of
unfavorable federal agency decisions,’” but allowing Privacy Act claim to proceed because,
where “agency acted in an ‘intentional or willful’ manner in failing to maintain accurate
records, district court may award actual damages sustained by the individual as a result of an
adverse determination based upon such records”).
To date, the D.C. Circuit has declined to rule that the CSRA bars a Privacy Act claim for
damages. See Kleiman v. Energy, 956 F.2d 335, 337-39 & n.5 (D.C. Cir. 1992) (holding that
Privacy Act did not afford relief where plaintiff did not contest that record accurately reflected
his assigned job title, but rather challenged his position classification – personnel decision
judicially unreviewable under the CSRA – but noting that nothing in opinion “should be taken to
cast doubt on Hubbard’s statement that ‘the Privacy Act permits a federal job applicant to
recover damages for an adverse personnel action actually caused by an inaccurate or
incomplete record’” (quoting Hubbard, 809 F.2d at 5)); Holly v. HHS, No. 88-5372, 1990 WL
13096, at *1 (D.C. Cir. Feb. 7, 1990) (declining to decide whether CSRA in all events precludes
Privacy Act claim challenging federal employment determination; instead applying doctrine of
“issue preclusion” to bar individual “from relitigating an agency’s maintenance of the
challenged records” because arbitrator had previously found that no “[agency] manager acted
arbitrarily, capriciously or unreasonably in determining [that plaintiff] was not qualified”);
Ahuruonye v. Interior, 312 F. Supp. 3d. 1, 14-15 (D.D.C. 2018) (acknowledging that Privacy Act
should not be used to circumvent CSRA, but finding that Privacy Act permits federal job
applicant or employee to recover damages for adverse personnel action actually caused by
inaccurate or incomplete record); Gard v. Dep’t of Educ., 789 F. Supp. 2d 96, 106 (D.D.C. 2011)
(citing and quoting Hubbard, but finding that plaintiff’s “claims must fail to the extent that he
has not produced any evidence supporting a reasonable inference that a Privacy Act violation
itself actually caused the adverse events of which he complains”); Peter B. v. CIA, 620 F. Supp.
2d 58, 76 (D.D.C. 2009) (explaining that if plaintiff “seeks to correct factually inaccurate
records,” then his claim “would not be precluded by the CSRA,” but concluding that “[i]t is
premature to determine whether [plaintiff] seeks to [do this], or if [plaintiff] disagrees with the
[agency’s] judgments contained in his records”); Lee v. Geren, 480 F. Supp. 2d at 210-12
(following Hubbard and Kleiman and concluding that allegedly inaccurate documents produced
during investigation of plaintiff did not actually cause his suspension but rather “merely
memorialized” that determination and thus “had no independent effect of their own”); Doe v.
Goss, No. 04-2122, 2007 WL 106523, at *8-9 (D.D.C. Jan. 12, 2007) (citing Hubbard and finding
that CSRA did not preclude plaintiff’s accuracy claim or his “information-gathering” claim
because plaintiff alleged actual causation with respect to both claims). But see Holly v. HHS,
No. 89-0137, slip op. at 1 (D.D.C. Aug. 9, 1991) (citing Kleiman for proposition that court lacks
subject matter jurisdiction in Privacy Act damages action in which plaintiff challenges
personnel action governed by CSRA), aff’d, 968 F.2d 92 (D.C. Cir. 1992) (unpublished table
decision).
The Court of Appeals for the Ninth Circuit considered the interplay between the Privacy Act and
a statute that broadly precludes judicial review of VA disability benefit decisions – 38 U.S.C. §
211(a) (later repealed, now see 38 U.S.C. § 511 (2018)) – and concluded that it barred a subsection
(g)(1)(C) damages action. Rosen v. Walters, 719 F.2d 1422, 1424-25 (9th Cir. 1983). In Rosen, the
plaintiff contended that the VA deliberately destroyed medical records pertinent to his disability
claim, thereby preventing him from presenting all the evidence in his favor. Id. at 1424. The
Ninth Circuit ruled that such a damages claim would “necessarily run counter to the purposes
of § 211(a)” because it would require a determination as to whether “but for the missing records,
Rosen should have been awarded disability benefits.” Id. at 1425. Further, it declined to find
that the Privacy Act “repealed by implication” 38 U.S.C. § 211(a). Id.; see also Demoruelle v. VA,
No. 16-00562, 2017 WL 2836989, at *5 (D. Hawaii June 30, 2017) (dismissing plaintiff’s accuracy
claims since court is precluded from having jurisdiction over claims that seek review of VA’s
benefit decisions pursuant to 38 U.S.C. § 511(a) and consistent with Veterans for Common Sense
v. Shinseki, 678 F.3d 1013 (9th Cir. 2012)); Thomas v. Principi, 265 F. Supp. 2d 35, 39-40 (D.D.C.
2003) (holding claim for failure to maintain accurate and complete records was barred by
former 38 U.S.C. § 511 “because the injuries that allegedly resulted from defendants’ failure to
maintain [plaintiff’s] records all ultimately concern the adverse benefits determination made by
the [VA]”), aff’d in pertinent part, rev’d in part, 394 F.3d 970 (D.C. Cir. 2005); R.R. v. Army, 482 F.
Supp. 770, 775-76 (D.D.C. 1980) (rejecting damages claim for lack of causation and noting that
“[w]hat plaintiff apparently seeks to accomplish is to circumvent the statutory provisions
making the VA’s determinations of benefits final and not subject to judicial review”); cf. Kaswan
v. VA, No. 81-3805, 1988 WL 98334, at *12 (E.D.N.Y. Sept. 15, 1988) (stating that Privacy Act is
“not available to collaterally attack factual and legal decisions to grant or deny veterans
benefits”), aff’d, 875 F.2d 856 (2d Cir. 1989) (unpublished table decision); Leib v. VA, 546 F.
Supp. 758, 761-62 (D.D.C. 1982) (“The Privacy Act was not intended to be and should not be
allowed to become a ‘backdoor mechanism’ to subvert the finality of agency determinations.”
(quoting Lyon v. United States, 94 F.R.D. 69, 72 (W.D. Okla. 1982))). Relying on Rosen, the
District Court for the District of Idaho similarly held that the statutory scheme regarding the
awarding of retirement benefits and “Congress’s intent that OPM, MSPB and the Federal Circuit
review decisions regarding the denial of disability retirement benefits” prohibited it from
reviewing Privacy Act damages claim where plaintiff alleged that VA’s failure to maintain file
resulted in his being denied disability retirement benefits by OPM. Braun v. Brown, No. CV 97-
0063-S, slip op. at 7-11 (D. Idaho June 22, 1998).
Several courts have held that the provision of the Federal Employees’ Compensation Act
(FECA), 5 U.S.C. § 8116(c) (2018), that provides that the liability of the United States under FECA
with respect to the injury of an employee is exclusive, operates to preclude a cause of action
under the Privacy Act, and deprives the court of subject matter jurisdiction. See, e.g., Vogrin v.
ATF, No. 598CV117, 2001 WL 777427, at *7-8 (N.D. W. Va. Mar. 30, 2001), aff’d per curiam, No. 01-
1491 (4th Cir. July 3, 2001). The court ruled that FECA’s exclusivity provision “precludes a suit
under the Privacy Act even if FECA does not provide benefits for all of the injuries that [the
plaintiff] claims.” Id. at *7; see also Scott v. USPS, No. 05-0002, 2006 WL 2787832, at *3-4
(D.D.C. Sept. 26, 2006) (explaining that “even though [plaintiff] was ultimately denied
compensation under FECA based on a lack of competent medical evidence” and establishing
that agency’s disclosure of records caused her alleged emotional injury, “that is immaterial to
the issue of the Court’s jurisdiction”); Lyon v. United States, 94 F.R.D. 69, 72 (W.D. Okla. 1982)
(finding Privacy Act claim cannot be “a backdoor mechanism to subvert authority bestowed
upon the Secretary of Labor to handle employee compensation claims”; stating FECA “provides
the exclusive method of presenting compensation claims resulting from on-the-job injuries of
federal employees”); cf. Jackson v. Labor, No. 2:06-CV-02157, 2008 WL 539925, at *4 (E.D. Cal.
Feb. 25, 2008) (ruling that plaintiff may not bring amendment lawsuit under Privacy Act to re-
litigate determination of FECA benefits); Weber v. Henderson, 33 F. App’x 610, 612 (3d Cir. 2002)
(holding that Privacy Act claim was barred by res judicata where plaintiff could have raised
Privacy Act claim in prior suit when he brought claim against same defendants as cause of
action under FECA).
The D.C. District Court has found that a Privacy Act claim is not precluded by the exclusivity of
relief under Title VII of the Civil Rights Act.
The District Court for the District of Columbia concluded, however that a Privacy Act claim was
not precluded by the exclusivity of relief under Title VII of the Civil Rights Act of 1964, 42 U.S.C.
§ 2000e (2018). See Velikonja v. Mueller, 315 F. Supp. 2d 66, 77 (D.D.C. 2004) (noting that
agency “failed to cite any cases in which a Privacy Act claim is precluded by Title VII” and that
“the court is not aware of any”), subsequent opinion, 362 F. Supp. 2d 1, 13-19 (D.D.C. 2004)
(finding no inaccuracies, adverse determination, or intentional or willful conduct), aff’d in part &
rev’d in part sub nom. Velikonja v. Gonzales, 466 F.3d 122 (D.C. Cir. 2006) (affirming on ground of
finding of no inaccuracies, adverse determination, or intentional or willful conduct).
The courts have split as to whether the (g)(1)(C) standards apply only to the receiving agency or to
any agency.
In Perry v. FBI, 759 F.2d 1271, 1275-76 (7th Cir. 1985), reh’g en banc granted on other grounds,
769 F.2d 450 (7th Cir. 1985), the Court of Appeals for the Seventh Circuit, without discussing
subsection (g)(1)(C), adopted a comparatively narrower construction of subsection (e)(5), holding
that “when one federal agency sends records to another agency to be used by the latter in
making a decision about someone, the responsibility for ensuring that the information is
accurate, relevant, timely, and complete lies with the receiving agency – the agency making ‘the
determination’ about the person in question – not the sending agency.”
Subsequently, however, in Dickson v. OPM, 828 F.2d 32, 36-40 (D.C. Cir. 1987), the D.C. Circuit
held that a subsection (g)(1)(C) damages lawsuit is proper against any agency maintaining a
record violating the standard of fairness mandated by the Act, regardless of whether that
agency is the one making the adverse determination. See also Blazy v. Tenet, 979 F. Supp. 10, 19
(D.D.C. 1997) (“The adverse determination need not be made by the agency that actually
maintains the record so long as it flowed from the inaccurate record.” (citing Dickson)),
summary affirmance granted, No. 97-5330, 1998 WL 315583 (D.C. Cir. May 12, 1998); Doe v. U.S.
Civil Serv. Comm’n, 483 F. Supp. 539, 556 (S.D.N.Y. 1980) (applying subsection (e)(5) to agency
whose records were used by another agency in making determination about individual); R.R. v.
Army, 482 F. Supp. at 773 (applying subsection (e)(5) to agency whose records were used by
another agency in making determination about individual). In so holding, the D.C. Circuit noted
that “the structure of the Act makes it abundantly clear that [sub]section (g) civil remedy
actions operate independently of the obligations imposed on agency recordkeeping pursuant to
[sub]section (e)(5).” Dickson, 828 F.2d at 38. In Dickson, the D.C. Circuit distinguished Perry on
the grounds that “[a]ppellant is not proceeding under [sub]section (e)(5), Perry does not discuss
[sub]section (g)(1)(C), and the construction of (e)(5) does not migrate by logic or statutory
mandate to a separate [sub]section on civil remedies.” 828 F.2d at 38; see also Doe v. FBI, 718 F.
Supp. at 95 n.15 (noting conflict in cases but finding that Dickson’s holding obviated need “to
enter that thicket”).
D. 5 U.S.C. § 552a(g)(1)(D) - Damages Lawsuits For Failure to Comply with

Other Privacy Act Provisions
“Whenever any agency . . . fails to comply with any other provision of this section, or any rule
promulgated thereunder, in such a way as to have an adverse effect on an individual . . . the
individual may bring a civil action.” 5 U.S.C. § 552a(g)(1)(D).
Comment:
In addition to damages under subsection (g)(1)(C)’s “accuracy, relevance, timeliness, and

completeness” standard, subsection (g)(1)(D) provides a “catch-all” remedies provisions that
allows lawsuits for actual damages against an agency for failure to comply with “any other
provision” of the Privacy Act, if there is an “adverse effect” on the individual.
1. Exhaustion of Administrative Remedy

Individuals are not required to exhaust administrative remedies before filing suit under subsection
(g)(1)(D).
Exhaustion of administrative remedies is not a prerequisite to a civil action for damages under
subsection (g)(1)(D). Diederich v. Army, 878 F.2d 646, 648 (2d Cir. 1989); Nagel v. HEW, 725 F.2d
1438, 1441 & n.2 (D.C. Cir. 1984); McKoy v. Spencer, No. 16-1313, 2019 WL 400615, at *4 -5 (D.D.C.
Jan. 31, 2019) (finding that while claim to amend record does require exhaustion of
administrative remedies, damages claim stemming from improper disclosure of personnel
records to third parties does not); Gergick v. Austin, No. 89-0838-CV-W-2, 1992 U.S. Dist. LEXIS
7338, at *13-16 (W.D. Mo. Apr. 29, 1992), aff’d, No. 92-3210 (8th Cir. July 9, 1993); Pope v. Bond,
641 F. Supp. 489, 500 (D.D.C. 1986). But see Graham v. Hawk, 857 F. Supp. 38, 40 (W.D. Tenn.
1994) (stating that “[e]ach paragraph of 5 U.S.C. § 552a(g) . . . requires as a prerequisite to any
action that the agency refuse an individual’s request to take some corrective action regarding
his file”), aff’d, 59 F.3d 170 (6th Cir. 1995) (unpublished table decision).
The Prison Litigation Reform Act imposes additional procedural requirements on prisoners,
however.
While “exhaustion is normally not required for damages actions under the Privacy Act,” note
that 42 U.S.C. § 1997e(a) (2018), a provision of the Prison Litigation Reform Act of 1996 (“PLRA”),
“imposes additional procedural requirements with respect to prisoners.” Reid v. BOP, No. 04-
1845, 2005 WL 1699425, at *3 (D.D.C. July 20, 2005). Specifically, § 1997e(a) provides that “[n]o
action shall be brought with respect to prison conditions under [any Federal law] by a prisoner
confined in any jail, prison, or other correctional facility until such administrative remedies as
are available are exhausted.” 42 U.S.C. § 1997e(a). The Supreme Court “has read the exhaustion
requirements [of § 1997e(a)] broadly to include ‘all inmate suits about prison life, whether they
involve general circumstances or particular episodes, and whether they allege excessive force
or some other wrong.’” Reid, 2005 WL 1699425, at *3 (quoting Porter v. Nussle, 534 U.S. 516,
532 (2002)). In McGee v. BOP, for example, the prisoner sued the BOP alleging unlawful
disclosure. 118 F. App’x 471, 474 (10th Cir. 2004). The Court of Appeals for the Tenth Circuit
concluded that the prisoner “failed to exhaust his administrative remedies with respect to his
Privacy Act claim” pursuant to § 1997e(a). Id. at 475; see also Smith v. B A Blackmon Warden
FCI Marianna, No. 5:18CV40, 2019 WL 3047081, at *6-7 (N.D. Fla. May 21, 2019) (magistrate
recommendation) (finding prisoner’s claim under Privacy Act “must be a separate (non-habeas)
filing subject to the PLRA, filing fee and other provisions”) adopted, 2019 WL 3037921 (N.D. Fla.
2019); Lugo-Vazquez v. Grondolsky, No. 08-986, 2010 WL 2287556, at *2-3 (D.N.J. June 2, 2010)
(granting summary judgment to agency on Privacy Act claim because plaintiff failed to exhaust
administrative remedies under § 1997e(a)); cf. Lee v. DOJ, 235 F.R.D. 274, 289-91 (W.D. Pa. 2006)
(concluding that PLRA did not apply to allegation that “pertain[ed] to the disclosure of the
[record] to a private bank, not to the means by which it was obtained,” because allegation “did
not relate to prison life”).
2. Elements of a Subsection (g)(1)(D) Claim

In a suit for damages under subsection (g)(1)(D), an individual has the burden of proving that: (1)
the information at issue is covered by the Privacy Act’s provisions; (2) the agency violated a
provision of the Privacy Act not covered by the other civil remedies provisions; (3) the violation
had an “adverse effect” on the plaintiff that was a “causal nexus” between the violation and the
adverse effect; and (4) the violation was “willful or intentional.” See, e.g., Quinn v. Stone, 978
F.2d 126, 131 (3d Cir. 1992); Pierce v. Air Force, 512 F.3d 184, 186 (5th Cir. 2007). The third
element of this cause of action, which is composed of two parts – “adverse effects” and
“causation” – is discussed in detail, below. As referenced below, analysis of the remaining
elements can be found in other sections of this Overview.
a. First Element: Information Covered by Privacy Act
Information is generally covered by the Privacy Act if it is a “record” maintained in a “system of

records.” See Quinn, 978 F.2d at 132 (concluding that information disclosed -- hunting roster
and time card -- was information covered by Privacy Act because it “contained an identifying
particular (the plaintiff's name) and was maintained within a system of records”). Certain
records, however, may be subject to the Privacy Act’s provisions, even if not maintained in a
system of records. See, e.g., McCready v. Nicholson, 465 F.3d 1 (D.C. Cir. 2006). These issues
are discussed in more detail above under the “Definitions” section.
b. Second Element: Catch-All Remedy Provision
Subsection (g)(1)(D) acts as a “catch-all remedy provision applicable if the agency ‘fails to
comply with any other provision’ of the Privacy Act.” E.g., Fazaga v. FBI, 965 F.3d 1015, 1063 (9th
Cir. 2020) (claim based on an alleged violation of subsection (e)(7)); Sussman v. Marshals Serv.,
494 F.3d 1106 (D.C. Cir. 2007) (claimed based on an alleged violation of subsection (b)). Plaintiffs
must demonstrate that an agency’s action violated a Privacy Act provision not otherwise
captured in subsections (g)(1)(A), (g)(1)(B), or (g)(1)(C) in order to successfully raise a claim under
subsection (g)(1)(D).
c. Third Element: Adverse Effect had Causal Nexus to Violation
i. Adverse Effects
A complaint is subject to dismissal for failure to state a subsection (g)(1)(D) damages claim if no
“adverse effect” is alleged. See, e.g., Doe v. Chao, 540 U.S. 614, 624 (2004) (“‘[A]dverse effect’
acts as a term of art identifying a potential plaintiff who satisfies the injury-in-fact and
causation requirements of Article III standing, and who may consequently bring a civil action
without suffering dismissal for want of standing to sue.”); Hunt v. VA, 739 F.3d 706, 707 (D.C. Cir.
2014) (“The district court lacked subject matter jurisdiction over appellant’s Privacy Act claims
for damages because the claims are based on the assertion ‘that the VA’s failure to maintain
accurate and complete records adversely affected a veteran’s benefits determinations.’”);
Hernandez v. Johnson, 514 F. App’x 492, 500 (5th Cir. 2013) (holding that “although [appellant]
complained of damages dating back to 2008, he also indicated in his deposition that he was not
aware of any of the disclosures until either 2010 or 2011,” and thus, “no reasonable jury could
find that the adverse effects [appellant] suffered were caused by these disclosures”); Shearson
v. DHS, 638 F.3d 498, 505-06 (6th Cir. 2011) (“[Plaintiff’s] request to pursue a claim under
§ 552a(e)(4) was properly denied because she failed to allege or show the requisite ‘adverse
effect’ from Defendants’ alleged failure to provide notice specifically regarding the [system of
records] at an earlier date.”); McCready v. Nicholson, 465 F.3d 1 (D.C. Cir. 2006) (remanding case
for district court to determine whether plaintiff suffered “adverse effect” by being denied
bonus); Quinn, 978 F.2d at 135 (“[T]he adverse effect requirement of (g)(1)(D) is, in effect, a
standing requirement.”); Taylor v. FAA, 351 F. Supp. 3d 97, 103-4 (D.D.C. 2018) (finding no
adverse effect from mere improper maintenance of Plaintiff’s name, address, and email address
by the FAA); Wright v. United States, No. 4:17-CV-02101, 2018 WL 4854037, at *8 (N.D. Ala. Oct.
5, 2018) (dismissing Privacy Act claim as not satisfying standing requirements where no
particularized injury regarding plaintiff’s own data being lost was alleged); Young v. Tryon, No.
12-CV-6251CJS, 2015 WL 309431, at *17 (W.D.N.Y. Jan. 23, 2015) (magistrate recommendation)
(noting lack of actual damages where complaint only alleged disclosure of medical information
caused plaintiff to be “very uncomfortable discussing his medical issues”) adopted, 2015 WL
554807 (Feb. 11, 2015); Dick v. Holder, 67 F. Supp. 3d 167, 182-3 (D.D.C. 2014 (finding agent
failed to provide allegations plausibly suggesting causal link between disclosure warning and
claimed adverse effects); Fletcher v. DOJ, 17 F. Supp. 3d 89, 95-96 (D.D.C. 2014) (stating in dicta
that “[b]ecause the requested court documents might be available from the [court] where they
originated [ ] plaintiff cannot show an adverse effect from the agency’s destruction of the
copies of the same records”); Reed v. Navy, 910 F. Supp. 2d 32, 45 (D.D.C. 2012) (finding that
disclosures did not cause plaintiff to be constructively discharged because “the causal link
between the disclosures and plaintiff’s separation from [his employer] is broken by intervening
events”); Mata v. McHugh, No. 10-cv-838, 2012 WL 2376285, at *6 (W.D. Tex. June 22, 2012)
(granting summary judgement on Privacy Act claim where plaintiff failed to plead specific
actual damages from disclosure of resume); Raley v. Astrue, No. 2:11cv555, 2012 WL 2368609,
at *7 (M.D. Ala. June 21, 2012) (“Plaintiff presents no evidence to establish that receiving
someone else’s information did in fact adversely affect her.”); Hurt v. D.C. Court Servs. &
Offender Supervision Agency, 827 F. Supp. 2d 16, 21 (D.D.C. 2011) (concluding that plaintiff did
not show that alleged improper disclosure . . . resulted in his homelessness because “decision
for him to leave [his] residence . . . was made before the alleged disclosure); Philippeaux v.
United States, No. 10 Civ. 6143, 2011 WL 4472064, at *9 (S.D.N.Y. Sept. 27, 2011) (holding that
plaintiff failed to allege that “any pertinent records have been removed” and, “[a]s a result, . . .
he fails to adequately show that he was adversely affected by any disclosure”); Bhatia v. Office
of the U.S. Attorney, N. Dist. of Cal., No. C 09-5581, 2011 WL 1298763, at *4 (N.D. Cal. Mar. 29,
2011) (finding that plaintiff who was “wrongly indicted” lacked standing because he “cannot
show, at this juncture, that he was injured by the return of the criminal indictment” because
“those charges are currently pending”); Mauldin v. Napolitano, No. 10-12826, 2011 WL 3113104,
at *3 (E.D. Mich. July 26, 2011); Conley v. United States, No. 2:10-cv-444, 2011 WL 1256611, at *7
(S.D. Ohio Mar. 31, 2011); Shope v. Navy, No. 1:CV-09-2400, 2010 WL 2766638, at *3 (M.D. Pa. July
13, 2010); Sieverding v. DOJ, 693 F. Supp. 2d 93, 106 (D.D.C. 2010), aff’d per curiam, No. 10-5149,
2010 WL 4340348 (D.C. Cir. Oct. 19, 2010); Ciralsky v. CIA, 689 F. Supp. 2d 141, 155-56 (D.D.C.
2010); Sutera v. TSA, 708 F. Supp. 2d 304, 318-19 (E.D.N.Y. 2010); Goodwin v. Johnson, No.
8:10CV40, 2010 WL 1500872, at *3 (D. Neb. Apr. 14, 2010); Doe v. DOJ, 660 F. Supp. 2d 31, 49
(D.D.C. 2009); Baker v. United States, No. 5:05-221, 2006 WL 1635634, at *4 (E.D. Ky. June 8,
2006) (finding that plaintiff failed to allege any adverse effect resulting from disclosure to
press of reasons for his medical discharge); Robinett v. State Farm Mut. Auto. Ins. Co., No. 02-
0842, 2002 WL 31498992, at *4 (E.D. La. Nov. 7, 2002) (stating that “[e]ven if [agency’s]
communication did not technically satisfy the notice requirement of [subsection (e)(8)], plaintiff
was not adversely affected by a failure to receive notice after the records were disclosed,”
because “plaintiff had no legal basis to prevent [agency] from releasing his records” and in fact
knew of possible release and tried to prevent it), aff’d per curiam, 83 F. App’x 638 (5th Cir.
2003); Fort Hall Landowners Alliance, Inc. v. BIA, No. CV-99-00052-E, slip op. at 12 (D. Idaho
Mar. 29, 2001); Hass v. Air Force, 848 F. Supp. 926, 932 (D. Kan. 1994); Swenson v. USPS, No. S-
87-1282, 1994 U.S. Dist. LEXIS 16524, at *30 (E.D. Cal. Mar. 10, 1994); Green v. USPS, No. 88-
0539, 1989 U.S. Dist. LEXIS 6846, at *6-8 (S.D.N.Y. June 19, 1989); Tracy v. SSA, No. 88-C-570-S,
slip op. at 4-5 (W.D. Wis. Sept. 23, 1988); Crichton v. Cmty. Servs. Admin., 567 F. Supp. 322, 324
(S.D.N.Y. 1983) (finding mere maintenance of allegedly “secret file” insufficient to warrant
damages where no showing of adverse effect); Church v. United States, 2 Gov’t Disclosure Serv.
(P-H) ¶ 81,350, at 81,911 (D. Md. Jan. 5, 1981) (finding no adverse effect from failure to provide
subsection (e)(3) notice); Harper v. United States, 423 F. Supp. 192, 196-97 (D.S.C. 1976); cf.
Ashbourne v. Hansberry, 302 F. Supp. 3d 338, 347-48 (D.D.C. 2018) (finding plaintiff adequately
pled adverse effect from purported falsification of her personnel records and then the use of
those records to publicly terminate her); Babatu v. Dallas VA Med. Ctr., No. 3:11-CV-00533, 2014
WL 626515, at *9 (N.D. Tex. Feb. 18, 2014) (finding that plaintiff presented genuine disputes of
material fact as to whether plaintiff was adversely affected due to “pecuniary loss in the form of
lost work-study wages as a result of the disclosure of his information”); Banks v. Butler, No.
5:08CV336, 2010 WL 4537902, at *6 (S.D. Miss. Sept. 23, 2010) (magistrate’s recommendation)
(asserting statements about plaintiff by staff members were “at most – innocuous statements of
opinion, rather than disclosures of records and create no real adverse effect”), adopted, 2010
WL 4537909 (S.D. Miss. Nov. 2, 2010); Nunez v. Lindsay, No. 3:CV005-1763, 2007 WL 517754, at
*1-2 (M.D. Pa. Feb. 12, 2007) (concluding that inmate lacked standing to bring Privacy Act claim
against BOP based on prison’s “practice of photographing friends and family who chose to visit”
him because “[a]ny invasion of privacy interests concerns the visitors, not the inmates”); Clark v.
BOP, 407 F. Supp. 2d 127, 129-131 (D.D.C. 2005) (concluding that disclosure of inmate’s medical
records to second inmate so that he could decipher word on first inmate’s chart presented
triable issue of whether first inmate’s HIV status was disclosed, but dismissing claim because
“plaintiff has not shown that the disclosure caused him to suffer an adverse effect or to sustain
actual damages”).
“Adverse effects” include nonpecuniary and nonphysical harm as well as monetary loss.
An “adverse effect” includes not only monetary damages, but also nonpecuniary and
nonphysical harm, such as mental distress, embarrassment, or emotional trauma. See, e.g.,
Speaker v. HHS Ctrs. for Disease Control & Prevention, 623 F.3d 1371, 1382-83 (11th Cir. 2010);
Doe v. Chao, 306 F.3d 170, 187 (4th Cir. 2002) (Michael, J., dissenting) (“The majority and I . . .
also agree that emotional distress can qualify as an adverse effect.”), aff’d, 540 U.S. 614 (2004);
Quinn, 978 F.2d at 135-36; Englerius v. VA, 837 F.2d 895, 897 (9th Cir. 1988); Albright v. United
States, 732 F.2d 181, 186 (D.C. Cir. 1984); Usher v. Sec’y of HHS, 721 F.2d 854, 856 (1st Cir. 1983);
Parks v. IRS, 618 F.2d 677, 682-83 & n.2 (10th Cir. 1980); Kvech v. Holder, No. 10-cv-545, 2011 WL
4369452, at *4 (D.D.C. Sept. 19, 2011); Rice v. United States, 245 F.R.D. 3, 5-6 (D.D.C. 2007);
Lechliter v. Army, No. 04-814, 2006 WL 462750, at *5 (D. Del. Feb. 27, 2006); Schmidt v. VA, 218
F.R.D. 619, 632 (E.D. Wis. 2003); Romero-Vargas v. Shalala, 907 F. Supp. 1128, 1134 (N.D. Ohio
1995); cf. Tarullo v. Def. Contract Audit Agency, 600 F. Supp. 2d 352, 359 (D. Conn. 2009)
(dismissing case where “the disclosures of [plaintiff’s] [social security number] had [no] adverse
effect on [him] other than the displeasure he felt because these disclosures were against his
wishes”); Clark v. BOP, 407 F. Supp. 2d 127, 131 (D.D.C. 2005) (“Nothing in the record . . . connects
the alleged adverse effect, i.e., plaintiff’s maltreatment, with the disclosure at issue.”); Doyon v.
DOJ, 304 F. Supp. 2d 32, 35 (D.D.C. 2004) (“[A]ssum[ing] without deciding that [BOP’s] decision
‘to restrict [plaintiff] from a transfer and many Institutional programs’ . . . is an adverse
determination,” but finding the claim to have been rendered moot.). But see Ferguson v.
Alderson Federal Prison Camp, No. 1:18-00180, 2018 WL 7820739, at *6 (S.D. W.Va., Oct. 18,
2018) (finding conclusory statement of adverse effect from alleged loss of outside medical
records by prison resulting in “wounded feelings” and “mental anguish” failed to allege any
actual damage or adverse consequence); Risch v. Henderson, 128 F. Supp. 2d 437, 441 (E.D.
Mich. 1999) (stating that even assuming that there had been a violation of the Privacy Act for
the maintenance of alleged “secret files,” because plaintiff claimed only “extreme mental
anguish and mental concern and worry,” she had “failed to demonstrate [an] ‘adverse effect’”),
aff’d sub nom. Risch v. USPS, 244 F.3d 510 (6th Cir. 2001).
For a novel interpretation of “adverse effect,” see Bagwell v. Brannon, No. 82-8711, slip op. at 5-
6 (11th Cir. Feb. 22, 1984), in which the Court of Appeals for the Eleventh Circuit found that no
“adverse effect” was caused by the government’s disclosure of an employee’s personnel file
during cross-examination while defending against the employee’s tort lawsuit, because the
“employee created the risk that pertinent but embarrassing aspects of his work record would be
publicized” and “disclosure was consistent with the purpose for which the information was
originally collected.”
“Adverse effect” is a separate element from “actual damages.”
The threshold showing of “adverse effect,” which typically is not difficult for a plaintiff to
satisfy, should carefully be distinguished from the conceptually separate requirement of “actual
damages,” discussed below. See, e.g., Fort Hall Landowners Alliance, Inc. v. BIA, 407 F. Supp.
2d 1220, 1225 (D. Idaho 2006) (explaining that “[i]t is important not to confuse this standing
requirement with the entirely separate element that requires proof of actual damages” and that
“to satisfy the Privacy Act’s adverse effect and causation requirements, plaintiffs need not
show actual damages from the disclosure, but must merely satisfy the traditional ‘injury-in-fact
and causation requirements of Article III’”). As one district court has explained, “[t]he
requirement of an ‘adverse effect’ requires more” than a “statement of ‘damages’ [that] merely
summarizes the alleged violations of law.” Foncello v. Army, No. 04-604, 2005 WL 2994011, at
*4 (D. Conn. Nov. 7, 2005).
The distinct nature of these two elements is demonstrated by the Supreme Court’s review in
FAA v. Cooper, 132 S. Ct. 1441 (2012), of an opinion by the Court of Appeals for the Ninth Circuit,
Cooper v. FAA, 622 F.3d 1016 (9th Cir. 2010). In Cooper, the Ninth Circuit, in construing the
Privacy Act to allow for the recovery of nonpecuniary damages, reasoned that because “mental
distress or emotional harm is sufficient to constitute an adverse effect,” a construction of the
Act that allowed a plaintiff to establish standing for an injury that results in nonpecuniary harm,
but that would not allow the plaintiff to seek actual damages for such a nonpecuniary injury
would “frustrate the intent of Congress.” Id. at 1021. The Ninth Circuit majority further stated
that “[i]n contrast, our opinion is true to the overall objective of the Act, allowing a plaintiff who
demonstrates a nonpecuniary adverse effect to have the opportunity to recover nonpecuniary
damages.” Id. However, on writ of certiorari a majority of the Supreme Court reversed the Ninth
Circuit’s opinion and held that the Privacy Act does not authorize damages for nonpecuniary
injuries such as mental or emotional distress. The Supreme Court did not consider the separate
issue of “adverse effect” in its ruling. See FAA v. Cooper, 132 S. Ct. at 1453; see also, Fazaga v.
FBI, 916 F.3d 1202, 1249 (9th Cir. 2019) (finding only damages and not injunctive relief available
for Privacy Act violations of the catch-all provision at § 552a(g)(1)(D)); Coleman v. U.S., 912 F.3d
824, 836 (5th Cir. 2019) (affirming summary judgement on Privacy Act claim against plaintiff
who did not offer any evidence of actual harm other than her own unsubstantiated allegations of
emotional trauma); Richardson v. Bd. of Governors of Fed. Reserve Sys., 288 F. Supp. 3d 231,
236-37 (D.D.C. 2018) (finding claim that plaintiff suffered “adverse and harmful effects”
insufficient where effects included “mental distress, emotional trauma, embarrassment,
humiliation” that are not authorized under Privacy Act and where alleged “lost or jeopardized
present and future financial opportunities” were not supported by sufficient facts to sustain
claim of actual damages).
ii. Causation
A showing of causation – that the violation caused an adverse effect, and that the violation
caused “actual damages,” as discussed below – is also required. See, e.g., Beaven v. DOJ, 622 F.
3d 540, 558 (6th Cir. 2010); Sweeney v. Chertoff, 178 F. App’x 354, 357-58 (5th Cir. 2006);
Mandel v. OPM, 79 F. App’x 479, 481-82 (2d Cir. 2003), aff’g 244 F. Supp. 2d 146, 153 (E.D.N.Y.
2003); Orekoya v. Mooney, 330 F.3d 1, 10 (1st Cir. 2003); Quinn, 978 F.2d at 135; Hewitt v.
Grabicki, 794 F.2d 1373, 1379 (9th Cir. 1986); Albright, 732 F.2d at 186-87; Edison v. Army, 672
F.2d 840, 842, 845 (11th Cir. 1982); Lugo v. DOJ, 214 F. Supp. 3d. 32, 41 (D.D.C. 2016); Iqbal v. DOJ,
No. 3:11-cv-369, 2013 U.S. Dist. LEXIS 138793, at *15 (M.D. Fla. Sept. 26, 2013); Colgan v. Mabus,
No. 11cv2278, 2013 U.S. Dist. LEXIS 129215, at *7-8 (S.D. Cal. Sept. 10, 2013); Su v. NASA, No.
5:09-cv-02838, 2013 WL 1663608, at *6-7 (N.D. Cal. Apr. 17, 2013); Reed, 910 F. Supp. 2d at 45-
46; Grant v. United States, No. 2:11-cv-00360, 2012 WL 5289309, at *8-9 (E.D. Cal. Oct. 23,
2012); York v. McHugh, 698 F. Supp. 2d 101, 108 (D.D.C. 2010); Mitchell v. VA, No. 1:07-cv-1015-
TCB, 2008 WL 11432084, at *3 (N.D. Ga. June 12, 2008); Thompson v. State, 400 F. Supp. 2d 1, 14
(D.D.C. 2005); Harmer v. Perry, No. 95-4197, 1998 WL 229637, at *3 (E.D. Pa. Apr. 28, 1998), aff’d,
No. 98-1532 (3d Cir. Jan. 29, 1999); Swenson, No. S-87-1282, 1994 U.S. Dist. LEXIS 16524, at *30
(E.D. Cal. Mar. 10, 1994); Connelly v. Comptroller of the Currency, No. H-84-3783, slip op. at 4
(S.D. Tex. June 3, 1991); Rodgers v. Army, 676 F. Supp. 858, 862 (N.D. Ill. 1988); Tuesburg v. HUD,
652 F. Supp. 1044, 1048 (E.D. Mo. 1987); Ely v. DOJ, 610 F. Supp. 942, 946 (N.D. Ill. 1985), aff’d,
792 F.2d 142 (7th Cir. 1986) (unpublished table decision). But see Rickles v. Marsh, No. 3:88-100,
slip op. at 8-9 (N.D. Ga. Jan. 10, 1990) (awarding minimum damages even in absence of
causation).
It also has been held that “[f]or there to be a causal link between the injury and the violation of
the Act, the injury necessarily must be distinct and independent from the violation of the Act
itself.” Schmidt v. VA, 218 F.R.D. at 632; see also Doe v. Chao, 306 F.3d at 186 (Michaels, J.,
dissenting) (“The causal prong makes it especially clear that an adverse effect must be
something distinct from the intentional and willful violation itself. For if a violation of the
Privacy Act was sufficient to constitute an adverse effect, there could be no question of
whether the violation caused the adverse effect, and hence the causal prong would be
superfluous.”); Quinn, 978 F.2d at 135 (stating that in addition to establishing an adverse effect
sufficient to confer standing, “plaintiff must also allege a causal connection between the
agency violation and the adverse effect”); cf. Doe v. Chao, 540 U.S. 614, 627 (2004) (“The
‘entitle[ment] to recovery’ necessary to qualify for the $1,000 minimum is not shown merely by
an intentional or willful violation of the Act producing some adverse effect.”). But cf. Romero-
Vargas v. Shalala, 907 F. Supp. 1128, 1134-35 (N.D. Ohio 1995) (stating, prior to Supreme Court’s
decision in Doe v. Chao, that “emotional distress caused by the fact that the plaintiff’s privacy
has been violated is itself an adverse effect, and that statutory damages can be awarded
without an independent showing of adverse effects”; stating further in memorandum on motion
to alter or amend judgment that “[i]t is eminently reasonable to infer that plaintiffs suffered
mental distress by the fact of knowing their personal information had been disclosed”).
d. Fourth Element: Intentional or Willful Standard
In addition, an agency must be found to have acted in an “intentional or willful” manner in order
for a damages action to succeed. See 5 U.S.C. § 552a(g)(4). This standard is discussed below
under “Civil Remedies, Principles Applicable to Damages Lawsuits, Intentional or Willful
Standard.”

Certain statutes preempt the Privacy Act’s remedies for alleged violations of the Privacy Act’s
disclosure provisions.
The issue of the Privacy Act’s applicability to disclosures of tax information has been analyzed
by the Court of Appeals for the District of Columbia Circuit in Gardner v. United States, 213 F.3d
735 (D.C. Cir. 2000), aff’d, No. 96-1467, 1999 U.S. Dist. LEXIS 2195, at *14-17 (D.D.C. Jan. 29,
1999). In Gardner, the D.C. Circuit concluded that the Internal Revenue Code preempts the
Privacy Act for remedies for disclosures of tax information, holding that 26 U.S.C. § 6103 is “the
exclusive remedy for a taxpayer claiming unlawful disclosure of his or her tax returns and tax
information.” 213 F.3d at 741-42. Similarly, although not going quite as far, the Court of Appeals
for the Fifth Circuit had previously held that “[26 U.S.C.] § 6103 is a more detailed statute that
should preempt the more general remedies of the Privacy Act, at least where . . . those remedies
are in conflict.” Hobbs v. United States, 209 F.3d 408, 412 (5th Cir. 2000) (finding § 6103 and the
Privacy Act to be “in conflict” where disclosure fell within one of the exceptions in § 6103, and
holding that “[t]o the extent that the Privacy Act would recognize a cause of action for
unauthorized disclosure of tax return information even where § 6103 would provide an
exception for the particular disclosure, § 6103 trumps the Privacy Act”). Other courts, too, have
found the provisions of the tax code to be exclusive as to wrongful disclosures of tax
information. See Ross v. United States, 460 F. Supp. 2d 139, 151 (D.D.C. 2006) (“[Section] 6103 is
the exclusive remedy for a taxpayer claiming unlawful disclosure of his or her tax returns and
information.”); Schwartz v. Kempf, No. 4:02-cv-198, 2004 U.S. Dist. LEXIS 2238, at *10-12 (W.D.
Mich. Jan. 22, 2004) (citing Gardner and finding the provisions of the Privacy Act to be “trumped
by the more specific provisions of the Internal Revenue Code found in 26 U.S.C. § 6103”);
Berridge v. Heiser, 993 F. Supp. 1136, 1144-45 (S.D. Ohio 1997) (holding that 26 U.S.C. § 7431(a)
(1), which provides a mechanism for the award of civil damages for unauthorized disclosure of
tax return information (as defined in 26 U.S.C. § 6103), is the “exclusive remedy by which
[plaintiff] may bring a cause of action for improper disclosure of return information”); Gov’t Nat’l
Mortgage, Ass’n v. Lunsford, No. 95-273, 1996 U.S. Dist. LEXIS 1591, at *8 (E.D. Ky. Feb. 2, 1996)
(dismissing Privacy Act claim for wrongful disclosure (presumably brought under subsection (g)
(1)(D)) and stating that “26 U.S.C. § 7852(e) precludes the maintenance of Privacy Act damages
remedies in matters concerning federal tax liabilities”).
Nevertheless, the Courts of Appeals for the Fourth and the Eighth Circuits, as well as the United
States Tax Court, have readily applied the Privacy Act as well as the provisions of the tax code
to disclosures of tax return information, with no discussion of the issue of preemption. See, e.g.,
Scrimgeour v. IRS, 149 F.3d 318, 325-26 (4th Cir. 1998) (affirming denial of damages and finding
that the agency had not acted with gross negligence under 26 U.S.C. § 7431 or greater than
gross negligence under the Privacy Act for wrongful disclosure claims resting upon identical
factual allegations); Taylor v. United States, 106 F.3d 833, 835-37 (8th Cir. 1997) (affirming
finding that disclosures did not violate 26 U.S.C. § 6103 or Privacy Act); Stone v. Comm’r of IRS,
No. 3812-97, 1998 WL 547043, at *3 (T.C. Aug. 31, 1998) (finding that disclosures did not violate
either 26 U.S.C. § 6103 or Privacy Act). In addition, one district court specifically considered the
issue and arrived at the conclusion that the Privacy Act’s remedies are available for the
wrongful disclosure of tax return information. Sinicki v. Treasury, No. 97 CIV. 0901, 1998 WL
80188, at *3-5 (S.D.N.Y. Feb. 24, 1998) (denying motion to dismiss Privacy Act wrongful
disclosure claim and stating that “the language, structure, purpose and legislative history of
Section 6103 do not make manifest and clear a legislative intent to repeal the Privacy Act as it
applies to tax return information”).
Several district courts have held that various sections of the Internal Revenue Code prevent
their exercise of subject matter jurisdiction over Privacy Act claims brought under subsection
(g)(1)(D) for alleged violations of other provisions of the Privacy Act. See Welborn v. IRS, 218 F.
Supp. 3d 64, 81 (D.D.C. 2016) (citing 26 U.S.C. §§ 6103(a), 7431 as preempting failure to
safeguard and unauthorized disclosure claims under Privacy Act); Diamond v. IRS, No. CV 13-
8042-GHK, 2014 WL 7883613, at *9, 115 A.F.T.R.2d 2015-319 (C.D. Cal. Nov. 14, 2014) (magistrate
recommendation) (citing 26 U.S.C. § 6103 as superseding a Privacy Act claim for unauthorized
disclosure of tax return), adopted, 2015 WL 64805, 115 A.F.T.R.2d 2015-328, 2015-1 USTCP
50,162 (C.D. Cal. Jan. 5, 2015); Schwartz v. Kempf, 2004 U.S. Dist. LEXIS 2238, at *10-12 (citing
26 U.S.C. § 7852(e), stating that “provisions of the Privacy Act do not apply, either directly or
indirectly, to assessing the possibility of a tax liability,” where plaintiffs alleged that IRS violated
Privacy Act by contacting persons regarding plaintiffs’ tax situation); Berridge v. Heiser, 993 F.
Supp. 1136, 1145 (S.D. Ohio 1997) (holding that 26 U.S.C. § 7852(e) prevented it from exercising
jurisdiction over plaintiff’s Privacy Act claims under subsections (e)(2), (e)(5), and (e)(6) related
to tax liability); Estate of Myers v. United States, 842 F. Supp. 1297, 1302-04 (E.D. Wash. 1993)
(dismissing Privacy Act subsection (g)(1)(D) damages claim and applying § 7852(e)’s
jurisdictional bar to preclude subject matter jurisdiction to consider action against IRS for
alleged violation of subsection (e)(3) concerning summons issued to assist in determination of
foreign tax liability); cf. Smilde v. Richardson, Comm’r, No. 97-568, 1997 U.S. Dist. LEXIS 15050,
at *6-7 (D. Minn. Aug. 28, 1997) (relying on limitation of Privacy Act applicability pursuant to
sections 6103 and 7852(e), and finding that “Privacy Act does not support subject matter
jurisdiction” to enjoin IRS from contracting out processing of tax returns), aff’d per curiam, 141
F.3d 1170 (8th Cir. 1998) (unpublished table decision); Trimble v. United States, No. 92-74219,
1993 WL 288295, at *1 (E.D. Mich. May 18, 1993) (citing 26 U.S.C. § 7852(e) for Privacy Act’s
inapplicability and dismissing unspecified Privacy Act claim), aff’d, 28 F.3d 1214 (6th Cir. 1994)
(unpublished table decision).
Note also that some courts have held that the exclusivity provision of the Federal Employees’
Compensation Act, 5 U.S.C. § 8116(c) (2018), precludes a cause of action under the Privacy Act.
See, e.g., Smith v. Nicholson, 287 F. App’x 402, 403-05 (5th Cir. 2008) (per curiam) (discussing
where Labor Secretary denied plaintiff’s FECA claim alleging that VA injured him by disclosing
his records “not for lack of coverage, but for insufficient proof,” holding that “such a denial is
conclusive as to FECA coverage”; “the Secretary found FECA applicable” and “[t]hat decision
precludes any further action on [plaintiff’s] Privacy Act claim”); Richards v. CIA, 837 F. Supp. 2d
574, 579-580 (E.D. Va. 2011) (dismissing Privacy Act claim because “[t]he disclosures and the
subsequent harm came exclusively in the context of [plaintiff’s] employment at the CIA” and
stating that “absent a determination by the Secretary of Labor that FECA does not cover
[plaintiff’s] Privacy Act claim, this Court has no jurisdiction to entertain the Privacy Act claim”);
Carte v. United States, No. 2:07-0515, 2010 WL 3259420, at *7-8 (S.D. W. Va. Aug. 18, 2010)
(concluding that “whether viewed as being precluded by a merits based DOL decision or a
decision of lesser quantum leaving open the substantial question of whether [plaintiff’s] injuries,
if any, were sustained while performing his duties, section 8116(c) bars a Privacy Act claim from
being pursued in this action,” where plaintiff attempted to recover for injury allegedly caused by
agency’s disclosure of his medical information by filing both FECA claim and Privacy Act claim);
Vogrin v. ATF, No. 598CV117, 2001 WL 777427, at *7-8 (N.D. W. Va. Mar. 30, 2001) (ruling that
FECA’s exclusivity provision “precludes a suit under the Privacy Act even if FECA does not
provide benefits for all of the injuries that [the plaintiff] claims”), aff’d per curiam, 15 F. App’x 72
(4th Cir. 2001).
Similarly, it has been held that the Civil Service Reform Act deprives a court of subject matter
jurisdiction over a Privacy Act claim brought under subsection (g)(1)(D). See Henderson v. Air
Force, No. 06-323, 2008 WL 4542761, at *2-3 (D. Ariz. Oct. 10, 2008), aff’d, 370 F. App’x 807 (9th
Cir. 2010). This issue is discussed more fully above in the section titled, “5 U.S.C. § 552a(g)(1)(C) -
Damages Lawsuits for Failure to Assure Fairness in Agency Determinations.”
Subsection (g)(1)(D) suits cannot be used to collaterally attack agency determinations.
Consistent with case law under subsection (g)(1)(C), the District Court for the District of
Columbia has stated that a plaintiff “cannot rely on any arguable violation of the Privacy Act”
under (g)(1)(D) – in that case an alleged wrongful disclosure – to “collaterally attack” an agency
personnel decision. Hanna v. Herman, 121 F. Supp. 2d 113, 123-24 (D.D.C. 2000) (finding that
MSPB did not err in refusing to address plaintiff’s Privacy Act argument, but, “assuming
arguendo that [he] preserved [it],” discussing merits of plaintiff’s “Privacy Act defense to the
demotion”), summary affirmance granted sub nom. Hanna v. Chao, No. 00-5433 (D.C. Cir. Apr. 11,
2001); Hinson-Gribble v. OPM, No. 5:16-CV-70-FL, 2017 WL 9480265, at *5 (E.D.N.C. July 11, 2017)
(dismissing Privacy Act claim to extent that plaintiff seeks to obtain relief from substantive
decisions made with respect to various benefits she contends are due her); Melvin v. VA, F. Supp.
3d 350, 357 (D.D.C. 2014) (finding Privacy Act provisions for amending records not designed to
permit collateral attack upon that which has already been subject of a judicial or quasi-judicial
action). See also Cross, No. 3:09-CV-1293, 2013 WL 1149525, at *10 (N.D.N.Y. Mar. 19, 2013)
(dismissing plaintiff’s damages claim for wrongful disclosure relating to her termination from
United States Postal Service because she “does not articulate the disclosure of any specific
information contained in a system of records”); Doe v. DOJ, 660 F. Supp. 2d at 50-51 (concluding
that plaintiff’s subsection (b)/(g)(1)(D) claim against MSPB for refusing to allow him to proceed
under pseudonym was “collateral attack” of that decision because plaintiff’s claim “attempts to
achieve the same forbidden objective” as prototypical collateral attacks – “relitigating issues
already decided by the ALJ”).
E. Principles Applicable to Damages Lawsuits

“In any suit brought under the provisions of subsection (g)(1)(C) or (D) of this section in which the
court determines that the agency acted in a manner which was intentional or willful, the United
States shall be liable to the individual in an amount equal to the sum of . . . actual damages
sustained by the individual as a result of the refusal or failure, but in no case shall a person
entitled to recovery receive less than the sum of $1,000.” 5 U.S.C. § 552a(g)(4).
1. Intentional or Willful Standard

Comment:
Damages suits under the Privacy Act require that the agency acted in an “intentional or willful”
manner.
In order for there to be any liability in a subsection (g)(1)(C) or (g)(1)(D) damages lawsuit, the
agency must have acted in an “intentional or willful” manner. 5 U.S.C. § 552a(g)(4). The words
“intentional” and “willful” in subsection (g)(4) do not have their vernacular meanings; instead,
they are “terms of art.” White v. OPM, 840 F.2d 85, 87 (D.C. Cir. 1988) (per curiam); see also
Convertino v. DOJ, 769 F. Supp. 2d 139, 145-46 (D.D.C. 2011) (noting that “[s]tandards of
intentionality and willfulness are anything but rare in the law” but explaining that “the Privacy
Act’s intent or willfulness requirement is peculiar to the Act and must not be confused with less
exacting standards parading under the same name from other common law or statutory
sources” (citing White)), rev’d and remanded on other grounds, 684 F.3d 93 (D.C. Cir. 2012). The
Act’s legislative history indicates that this unique standard is “[o]n a continuum between
negligence and the very high standard of willful, arbitrary, or capricious conduct,” and that it “is
viewed as only somewhat greater than gross negligence.” 120 Cong. Rec. 40,406, reprinted in
Source Book at 862.
While not requiring premeditated malice, see Parks v. IRS, 618 F.2d 677, 683 (10th Cir. 1980),
cases analyzing subsection (g)(4) have held that, to meet the “intentional or willful” standard,
the agency’s actions must be:
• So patently egregious and unlawful that anyone undertaking the conduct should have
known it was unlawful. E.g., Maydak v. United States, 630 F.3d 166, 179-83 (D.C. Cir. 2010);
Sussman v. Marshals Serv., 494 F.3d 1106, 1122 (D.C. Cir. 2007); Laningham v. Navy, 813 F.2d
1236, 1242-43 (D.C. Cir. 1987) (per curiam); Albright v. United States, 732 F.2d 181, 189 (D.C.
Cir. 1984); Wisdom v. HUD, 713 F.2d 422, 424-25 (8th Cir. 1983);
• Somewhat greater than gross negligence. E.g., Coleman v. United States, 12 F.3d 824, 836-
837 (5th Cir. 2019); Maydak, 630 F.3d at 179-83; Beaven v. DOJ, 622 F.3d 540, 547-53 (6th
Cir. 2010); Powers v. Parole Comm’n, 296 F. App’x 86, 87 (D.C. Cir. 2008); Scrimgeour v. IRS,
149 F.3d 318, 326 (4th Cir. 1998); Rose v. United States, 905 F.2d 1257, 1260 (9th Cir. 1990);
Britt v. Naval Investig. Service, 886 F.2d 544, 551 (3d Cir.1989); Andrews v. VA, 838 F.2d 418,
424-25 (10th Cir. 1988); Bruce v. United States, 621 F.2d 914, 917 (8th Cir. 1980);
• In flagrant disregard of an indiviudal’s rights under the Privacy Act. E.g., Lewis v.
Mossbrooks, 788 F. App’x 455, 458 (9th Cir. 2019); Maydak, 630 F.3d at 179-83; Pippinger v.
Rubin, 129 F.3d 519, 530 (10th Cir. 1997); Deters v. Parole Comm’n, 85 F.3d 655, 660 (D.C. Cir.
1996); Kellett v. BOP, 66 F.3d 306 (1st Cir. 1995) (per curiam) (unpublished table decision);
Covert v. Harrington, 876 F.2d 751, 756-57 (9th Cir. 1989); or
• Without grounds for believing the agency’s actions to be lawful. E.g., Maydak, 630 F.3d at
179-83; Kellett, 66 F.3d at *3; Covert, 876 F.2d at 756-57; Albright, 732 F.2d at 189-90.
Negligence violations are insufficient to meet the “intentional or willful” standard.
A mere negligent or inadvertent violation of the Privacy Act is not enough to clear this
formidable “intentional or willful” barrier for a plaintiff seeking damages. See, e.g., Lewis v.
Mossbrooks, 788 F. App’x at 458 (concluding that plaintiff’s complaint did not suggest that in
failing to remove flag in his record, any VA employee “‘flagrantly disregard[ed]’ Lewis’ privacy
rights or acted ‘without grounds for believing [their action] to be lawful,’ rather than
negligently.” (citations omitted)); Campbell v. SSA, 446 F. App’x 477, 479, 481 (3d Cir. 2011)
(upholding district court conclusion that “there was no record evidence to support an assertion
of willful or intentional conduct” where district court found that plaintiff’s “assertion that his
wife discovered some documents in her SSA file that should have been in his file, if true,
established nothing more than negligence”); Maydak, 630 F.3d at 179-83 (holding that BOP did
not intentionally or willfully commit Privacy Act violations because, among other reasons,
records “were used only for legitimate law enforcement purposes” and notwithstanding court’s
“critical discussion of the review and retention policies” in prior opinions, “BOP officials were
still never placed on clear notice that their practices violated the Act”); Wilkerson v. Shinseki,
606 F.3d 1256, 1268 (10th Cir. 2010) (finding standard not met where VA physician accessed
plaintiff’s medical records because physician testified that “he thought he could access the
record so long as he had a ‘need to know’” and “given that [plaintiff’s] health records were
relevant to whether he could continue working at the VA, [that] belief was reasonable”);
Scrimgeour, 149 F.3d at 326 (finding plaintiff did not “demonstrate the higher standard of
culpability required for recovery under the Privacy Act” where court had already determined
that IRS’s release of his tax returns did not meet lower standard of gross negligence under
provision of Internal Revenue Code); Deters, 85 F.3d at 660 (finding that Parole Commission did
not “‘flagrantly disregard’” plaintiff’s privacy when it supplemented his file with rebuttal
quantity of drugs attributed to him in presentence investigation report (PSI) and offered inmate
hearing concerning accuracy of disputed report and concluding that “[e]ven if the Commission
inadvertently or negligently violated [plaintiff’s] Privacy Act rights by not examining the
accuracy of the PSI before preparing a preliminary assessment . . . such a violation (if any) could
in no sense be deemed ‘patently egregious and unlawful’” (quoting Albright and Laningham,
infra)); Dowd v. IRS, 776 F.2d 1083, 1084 (2d Cir. 1985) (per curiam) (holding “mere
administrative error” in negligently destroying files was not predicate for liability); Chapman v.
NASA, 736 F.2d 238, 242-43 (5th Cir. 1984) (per curiam) (holding standard not met where
agency “reasonably could have thought” untimely filing of evaluations was proper; “before our
previous opinion ‘timely’ had no precise legal meaning in this circuit”); Wisdom v. HUD, 713 F.2d
422, 424-25 (8th Cir. 1983) (finding no willful violation of Act where good faith release of loan
default records is pursuant to unchallenged “Handbook”); Perry v. Block, 684 F.2d 121, 129 (D.C.
Cir. 1982) (finding delayed disclosure of documents through administrative oversight was not
intentional or willful); Bruce v. United States, 621 F.2d 914, 917 (8th Cir. 1980) (finding standard
not met where agency relied on regulations permitting disclosure of records pursuant to
subpoena, as there were “at that time no regulations or other authority to the contrary”); Brown
v. Esper, No. 1:17-cv-02004-RM-STV 2019 WL 6893019 at *9 (Dec. 18, 2019) (“The fact that DHA
employees were able to locate files pertaining to Plaintiff on the shared drive is not indicative of
flagrant or egregious conduct rising to [willful or intentional conduct]. Nor does the fact that
DHA employees received training on the Privacy Act mean that every alleged violation is
intentional or willful.”); Yusim v. Office of Acting Commissioner of SSA, 406 F. Supp. 3d 194, 196
(E.D.N.Y. 2018) (finding defendant’s alleged “ignorance” insufficient to meet intentional or willful
standard); Chesser v. FBI, No. 1:13cv129 (LO/IDD), 2017 WL 663348, at *6 (E.D. Va. Feb. 17, 2017)
(finding that because defendant’s “letter informing plaintiff of the disclosure establishes that
defendants believed their disclosure was legal pursuant to § 552a(b)(8),” plaintiff could not
establish that defendants’ disclosure was intentional or willful); Hills v. Liberty Mut. Ins., No. 14–
CV–0328S, 2015 WL 1243337 (W.D.N.Y Mar. 18, 2015) (“[T]o the extent, if any, that Plaintiff
asserts that SSA employees should have discerned the true limited scope of the consent before
disclosing Plaintiff's information, this allegation amounts to at best mere negligence or
administrative error, which is insufficient to state a claim under the Privacy Act.”); Taylor v. Def.
Fin. & Accounting Servs., No. 2:12-2466, 2014 WL 28820, at *9 (E.D. Cal. Jan. 3, 2014) (granting
defendant’s summary judgment motion and finding that while “res ipsa loquitur is a viable
theory of negligence, it cannot be used to prove intentional or willful conduct”); Williams v.
United States, No. 12-00375, 2013 WL 3288306, at *11-15 (D. Haw. June 28, 2013) (finding that
agency attempt[] to comply with [plaintiff’s] authorization” demonstrated intent to comply with
Privacy Act and agency’s “attempts to remedy or mitigate the effects of the disclosure also
show lack of willful or intentional agency action”); Reed v. Navy, 910 F. Supp. 2d 32, 44-45
(D.D.C. 2012) (explaining that even if agency employee “made any disclosures that crossed the
line, the evidence does not support a conclusion that [agency employee] acted with ‘flagrant
disregard’ for the Act”); Grant v. United States, No. 2:11-cv-00360, 2012 WL 5289309, at *10 (E.D.
Cal. Oct. 23, 2012) (explaining that disclosure was not willful or intentional but inadvertent
because “[b]efore sending out the . . . claim package, [defendant] redacted several mentions of
plaintiff’s [medical] condition from the records in the claim package, but missed a few other
references to plaintiff’s [medical condition], as well as certain references to certain medications
that, unbeknownst to [defendant] at the time, were used to treat [plaintiff’s medical
condition].”); McIntyre v. Fulwood, 892 F. Supp. 2d 209, 218 (D.D.C. 2012) (finding defendant’s
actions were not intentional or willful because “‘[t]he Commission ceased reliance on the
erroneous information,’ and has articulated a rational basis for its decision to deny Plaintiff
parole”); Tungjunyatham v. Johanns, No. 1:06-cv-1764, 2009 WL 3823920, at *23 (E.D. Cal. Nov.
13, 2009) (finding standard not met “[i]n light of the two representatives’ established practice of
communicating by [fax] in such a fashion” where agency representative faxed to office of
plaintiff’s EEO representative records concerning plaintiff while latter representative was out of
town and, as a result, “numerous agency employees had the chance to see the documents”),
aff’d, Tungjunyatham v. Johanns, 500 F. App’x 686, 689 (9th Cir. 2012); Walker v. Gambrell, 647
F. Supp. 2d 529, 537-38 (D. Md. July 16, 2009) (alternative holding) (finding standard not met
where plaintiff missed work due to miscarriage, her husband called agency to inform office of
reason for plaintiff’s absence, employee who received call reacted in disruptive manner, and
agency official sent e-mail to staff regarding miscarriage to inform it of reason for disruption;
“disclosure may show negligence or a lack of tact and sensitivity; however, evidence of
negligence is not sufficient to show that the agency acted willfully or intentionally”); Baptiste v.
BOP, 585 F. Supp. 2d 133, 135 (D.D.C. 2008) (concluding that ICE’s failure to confirm receipt of
faxed notice regarding plaintiff’s citizenship is no worse than negligence); Mulhern v. Gates,
525 F. Supp. 2d 174, 185-86 (D.D.C. 2007) (holding inadvertent disclosure “while attempting to
assist plaintiff” not sufficient to satisfy standard); Elliott v. BOP, 521 F. Supp. 2d 41, 48 (D.D.C.
2007) (finding standard not met where BOP based plaintiff’s designation on inaccurate
presentence report because “BOP was [not] aware of any potential inaccuracy in [that] report”),
abrogated on other grounds, Williams v. United States District Court, District of Columbia, 806 F.
Supp. 2d 44, 48 (D.D.C. 2011); Thompson v. State, 400 F. Supp. 2d 1, 12-13 (D.D.C. 2005) (finding
standard not met in subsection (e)(2) claim where agency “assumed that it would be appropriate
to correspond with [plaintiff’s doctor] about [plaintiff’s] medical condition” because “it was
plaintiff’s doctor who made the first contact with the [agency], offering unsolicited medical
information on plaintiff’s behalf”); Wiley v. VA, 176 F. Supp. 2d 747, 756-57 (E.D. Mich. 2001)
(stating that even if agency violated Privacy Act by disclosing VA claims file to employer
pursuant to broadly written release, agency’s actions were not “beyond grossly negligent,” as
“reasonable minds clearly could differ on the scope of the release,” and thus agency’s reliance
on it “cannot be deemed wholly groundless”); Porter v. USPS, No. CV595-30, slip op. at 10, 13,
21-22 (S.D. Ga. July 24, 1997) (concluding that Postal Service acted with “mere negligence”
when it disclosed letter from plaintiff’s attorney written as response to plaintiff’s proposed
termination to two union officials with belief that they had “a right and duty to know the
disciplinary affairs of a fellow postal worker” even though plaintiff had not filed grievance
through union and “had specifically instructed the management that he did not want anyone
from the [union] representing his interests”), aff’d, 166 F.3d 352 (11th Cir. 1998) (unpublished
table decision); Smith v. BOP, No. 94-1798, 1996 WL 43556, at *2 (D.D.C. Jan. 31, 1996) (finding
standard not met where adverse determination had been rectified; the fact that certain forms
were corrected immediately, even though another form may not have been, “indicates that BOP
officials did not intend to maintain plaintiff’s records incorrectly”); Baitey v. VA, No. 8:CV89-706,
slip op. at 8 (D. Neb. June 21, 1995) (finding standard not met where plaintiff failed to prove that
VA acted in “flagrant or reckless disregard of [plaintiff’s] rights under the Privacy Act” when it
disclosed his medical records in response to incomplete and unsigned medical authorization);
Olivares v. NASA, 882 F. Supp. 1545, 1549-50 (D. Md. 1995) (finding NASA’s actions in
contacting educational institutions to verify and correct discrepancies in plaintiff’s record, even
assuming initial consent to contact those institutions was limited, were not even negligent and
do not “come close” to meeting standard), aff’d, 103 F.3d 119 (4th Cir. 1996) (unpublished table
decision); Stephens v. TVA, 754 F. Supp. 579, 582 (E.D. Tenn. 1990) (finding no damages where
“some authority” existed for proposition that retrieval not initially and directly from system of
records was not “disclosure,” and agency attempted to sanitize disclosed records); Blanton v.
DOJ, No. 82-0452, slip op. at 6-8 (D.D.C. Feb. 17, 1984) (finding unauthorized “leak” of record not
intentional or willful agency conduct); Krohn v. DOJ, No. 78-1536, slip op. at 3-7 (D.D.C. Nov. 29,
1984) (finding standard not met where agency relied in good faith on previously unchallenged
routine use to publicly file records with court); Daniels v. St. Louis VA Reg’l Office, 561 F. Supp.
250, 252 (E.D. Mo. 1983) (finding mere delay in disclosure due in part to plaintiff’s failure to pay
fees was not intentional or willful); Doe v. GSA, 544 F. Supp. 530, 541-42 (D. Md. 1982) (finding
disclosure not “wholly unreasonable” where “some kind of consent” given for release of
psychiatric records and where agency employees believed that release was authorized under
GSA’s interpretation of its own guidelines, even though court concluded that such interpretation
was erroneous).
In a number of other cases, courts have found that the plaintiff did not meet the “intentional or
willful standard” without deciding whether the agency had violated the Privacy Act.
In addition to cases in which the court held that a mere negligent or inadvertent violation of the
Privacy Act was insufficient to meet the “intentional or willful standard,” additional cases have
concluded that plaintiffs have failed to meet this high standard for a variety of other reasons.
See, e.g., Jacobs v. BOP, No. 12-5129, 2012 WL 6603085, at *1 (D.C. Cir. Dec. 17, 2012) (holding
that “appellant has failed to demonstrate the Bureau violated the Act in an intentional or willful
manner”); Luster v. Vilsack, 667 F.3d 1089, 1098 (10th Cir. 2011) (“[G]iven the lack of any
authority in support of [plaintiff’s] contention that it is a violation of the Privacy Act to transmit
confidential materials (all but one of which was covered by a transmittal cover sheet) to an
unsecured fax machine, we agree with the district court that [plaintiff] has not demonstrated
that any actual disclosure by [defendant] was willful and intentional.”); Puerta v. HHS, No. 99-
55497, 2000 WL 863974, at *3 (9th Cir. June 28, 2000) (finding where agency, upon advice of its
general counsel’s office, disclosed documents in response to grand jury subpoena, agency “may
have intentionally produced [the] documents, but it does not necessarily follow that [it]
intentionally violated . . . the Privacy Act”); Nathanson v. FDIC, No. 95-1604, 1996 U.S. App. LEXIS
3111, at *3-6 (1st Cir. Feb. 22, 1996) (per curiam) (affirming on grounds that disclosure was not
intentional and willful because routine use “afforded reasonable grounds for belie[f] that
[agency employee’s] conduct was lawful”); Scullion v. VA, No. 87-2405, slip op. at 4-8 (7th Cir.
June 22, 1988) (holding no damages where agency relied upon apparently valid and unrevoked
written consent to disclose records); Moskiewicz v. USDA, 791 F.2d 561, 564 (7th Cir. 1986)
(noting that “elements of recklessness often have been a key characteristic incorporated into a
definition of willful and intentional conduct”); Edison v. Army, 672 F.2d 840, 846 (11th Cir. 1982)
(stating failure to prove agency acted “unreasonably” in maintaining records precludes finding
intentional or willful conduct); Ahuruonye v. Interior, 2017 U.S. Dist. LEXIS 33207 (D.D.C. Mar. 8,
2017) (finding plaintiff had failed to demonstrate that defendant acted intentionally or willfully
because plaintiff relied “exclusively upon speculative and conclusory statements”); Hurt v. D.C.
Court Servs. & Offender Supervision Agency, 827 F. Supp. 2d 16, 21 (D.D.C. 2011) (finding
standard not met where agency officials “believed that under [agency] policy they could
disclose public information, such as the plaintiff’s conviction, to a third party without running
afoul of the Privacy Act”); Alexander v. FBI, 691 F. Supp. 2d 182, 191 (D.D.C. 2010) (finding
standard not met where agency disclosed records in response to “facially ordinary requests
submitted according to unchallenged procedures that had been in place for thirty years” and
“pursuant to its unchallenged regulations”), aff’d per curiam on other grounds, 456 F. App’x 1
(D.C. Cir. 2011); Trice v. Parole Comm’n, 530 F. Supp. 2d 213, 215 (D.D.C. 2008) (“Although plaintiff
disagreed with the victim’s version of the circumstances surrounding the assault, he was able to
provide his version of events at the revocation hearing. Plaintiff therefore cannot demonstrate
to a reasonable fact finder that the Commission acted with the requisite level of intent [by
considering only plaintiff’s version.”); Armstrong v. BOP, 976 F. Supp. 17, 22 (D.D.C. 1997) (finding
standard not met where BOP refused to amend prison records to incorporate favorable
information from inmate’s prior incarceration in accordance with BOP guidelines), summary
affirmance granted, Armstrong v. BOP, No. 97-5208, 1998 WL 65543, at *1 (D.C. Cir. Jan. 30,
1998); Harris v. USDA, No. 3:92CV-283-H, slip op. at 1-2, 4-5 (W.D. Ky. May 14, 1996) (finding
standard not met where agency acted pursuant to Correspondence Management Handbook in
maintaining supporting documentation for plaintiff’s 1975 suspension), aff’d, 124 F.3d 197 (6th
Cir. 1997) (unpublished table decision); Sterling v. United States, 826 F. Supp. 570, 572 (D.D.C.
1993) (finding standard not met where agency’s “efforts both before and after the release of
information . . . indicate a sensitivity to the potential harm the release might cause and
represent attempts to avert that harm”), summary affirmance granted, No. 93-5264 (D.C. Cir.
Mar. 11, 1994); cf. Iqbal v. DOJ, No. 3:11-cv-369-J-37, 2013 WL 3903642, at *5 (M.D. Fla. Sept. 26,
2013) (“[T]he Court previously held that Plaintiff could satisfy his burden to allege intentional
and willful conduct by making allegations consistent with Rule 9(b). . . . Plaintiff has sufficiently
met this standard.”); Stokes v. Barnhart, 257 F. Supp. 2d 288, 299-300 (D. Me. 2003) (citing
Andrews, 838 F.2d at 424-25, and Albright, 732 F.2d at 189, and allowing plaintiff to amend
complaint because agency employee’s belief “that her conduct violated any law or regulation…
is not, and cannot be, determinative”).
For claims based on alleged violations of subsection 552a(b), several courts have required
plaintiffs to identify the individual who disclosed the information in order to establish that the
disclosure was “intentional or willful.”
In the context of a claim for disclosure in violation of subsection 552a(b), several courts have
ruled that a plaintiff cannot show intentional or willful conduct without identifying the individual
or individuals who disclosed the information. See, e.g., Convertino v. DOJ, 769 F. Supp. 2d 139,
146 (D.D.C. 2011) (“To meet the Privacy Act’s high standard for a showing of willfulness or
intentionality, [plaintiff] must know the leaker’s identity. . . . [L]acking any evidence of the
leaker’s identity, no reasonable fact-finder could find that DOJ acted willfully or intentionally
with regard to any leak in this case.”), rev’d and remanded on other grounds, 684 F.3d 93 (D.C.
Cir. 2012) (reversing district court’s summary judgment and ruling that district court committed
abuse of discretion in denying appellant’s motion to stay summary judgment to allow for further
discovery to determine leaker’s identity); Paige v. DEA, 818 F. Supp. 2d 4, 14 (D.D.C. 2010) (“In
order to prove that [agency] acted willfully and intentionally, it is essential that Plaintiff identify
the source of the disclosure.”), aff’d, 665 F.3d 1355 (D.C. Cir. 2012); Convertino v. DOJ, No. 07-cv-
13842, 2008 WL 4104347, at *7 (E.D. Mich. Aug. 28, 2008) (“To establish that the DOJ committed
a willful or intentional violation, [plaintiff] must present evidence of the disclosing person’s state
of mind, which requires him to identify and question those who perpetrated the allegedly
improper disclosure.”); cf. Lee v. DOJ, 413 F.3d 53, 55, 60 (D.C. Cir. 2005) (upholding district
court order “holding [journalists] in contempt of court for refusing to answer questions
regarding confidential sources” because “[i]f [plaintiff] cannot show the identities of the
leakers, [plaintiff’s] ability to show the other elements of the Privacy Act claim, such as
willfulness and intent, will be compromised”); Hatfill v. Gonzales, 505 F. Supp. 2d 33, 43 (D.D.C.
2007) (granting motion to compel reporters to disclose identity of individuals who disclosed
information protected by Privacy Act because “the identity of DOJ and FBI sources will be an
integral component of the plaintiff’s attempt to prove the requisite agency mens rea”).
Several district courts have allowed cases to proceed because the plaintiff sufficiently alleged
intentional or willful conduct.
Several district court decisions have found “intentional or willful” violations of the statute, or
have otherwise allowed cases to proceed after finding that plaintiffs presented sufficient facts
regarding an agency’s alleged intentional or willful conduct. See, e.g., Ashbourne v. Hansberry,
302 F. Supp. 3d 338, 347-48 (D.D.C. Mar. 27, 2018) (“Accepting Ms. Ashbourne’s factual
allegations as true and drawing all reasonable inferences in her favor, it is plausible that the
DHS defendants are liable for a violation of . . . the Privacy Act.”); Kelley v. FBI, 67 F. Supp. 3d
240, 258 (D.D.C 2014) (finding plaintiff “set forth sufficient facts about the alleged disclosure of
information about plaintiffs to the media to overcome the low threshold at the motion to dismiss
stage and create an inference of intentional and willful misconduct that allows” plaintiff’s first
claim to proceed); Babatu v. Dallas VA Med. Ctr., No. 3:11-CV-00533, 2014 WL 626515, at *12
(N.D. Tex. Feb. 18, 2014) (considering “scope of employment . . . to the extent that it may be
probative of whether [agency employee] acted intentionally or willfully in accessing and
disclosing [plaintiff’s] information in [agency’s] database” and concluding that “an employee’s
conduct, as well as the agency’s conduct, is relevant to the determination of whether a violation
was intentional or willful”); Makowski v. United States, 27 F. Supp. 3d 901, 913 (N.D. Ill. 2014)
(finding that plaintiff “has sufficiently pleaded facts to support his claim that DHS willfully
violated its duty under the Privacy Act to maintain accurate records” in light of fact that agency
did not update plaintiff’s citizenship status after being put on notice “not only that its record
pertaining to [plaintiff’s] citizenship status was inaccurate, but also that this inaccuracy had the
potential to contribute to an adverse immigration enforcement determination regarding
[plaintiff] – as it did with the issuance of the 2009 detainer”); Minshew v. Donley, 911 F. Supp. 2d
1043, 1072 (D. Nev. 2012) (denying agency’s motion, as “[a] reasonable jury thus could find the
[agency] acted in flagrant disregard of [plaintiff’s] rights by making an unsolicited disclosure of
information contained within [plaintiff’s] OPF” to contractor “despite the fact that [contractor]
did not request the information and indeed objected to the [agency’s] attempt to interfere with
[plaintiff’s] placement”); Feldman v. CIA, 797 F. Supp. 2d 29, 40 (D.D.C. 2011) (finding that
“plaintiff has adequately alleged intentional or willful conduct at this stage of the litigation” and
denying agency’s motion to dismiss); McCullough v. BOP, No. 1:06-cv-00563, 2010 WL 5136133,
at *6-7 (E.D. Cal. Dec. 6, 2010) (magistrate’s recommendation) (“Plaintiff’s allegation that [BOP]
employees falsified reports and his central file and used those records to convict him of a rule
violation is sufficient to state a cognizable claim against [BOP].”), adopted, 2010 WL 5476701
(E.D. Cal. Dec. 29, 2010); Tolbert-Smith v. Chu, 714 F. Supp. 2d 37, 43-44 (D.D.C. 2010) (declining
to dismiss allegation that agency employee “placed records referring and relating to [plaintiff’s]
disability on a server accessible by other federal employees and members of the public . . . to
retaliate against her for filing an administrative complaint”); Doe v. Goss, No. 04-2122, 2007 WL
106523, at *12 (D.D.C. Jan. 12, 2007) (“If proven, Defendants’ calculated recording of false
information pursuant to these allegedly sham investigations would certainly meet Deters’
definition of a willful or intentional conduct.”); Carlson v. GSA, No. 04-C-7937, 2006 WL
3409150, at *5 (N.D. Ill. Nov. 21, 2006) (discussing e-mail sent by agency employee’s supervisor
to other agency personnel and to individuals outside agency regarding plaintiff’s termination
settlement agreement, which included “unnecessary details concerning [employee’s] personal
information” and which supervisor encouraged recipients to disseminate); Doe v. Herman, No.
297-CV-00043, 1999 WL 1000212, at *1, *13-14 (finding unnecessary the disclosure of claimant’s
social security number on multi-captioned hearing form to twenty other claimants, coal
companies, and insurance companies); Tomasello v. Rubin, No. 93-1326, slip op. at 17-19 (D.D.C.
Aug. 19, 1997) (concerning disclosure to “60 Minutes” and all 4,500 ATF employees of details
concerning plaintiff’s EEO complaint), aff’d on other grounds, 167 F.3d 612 (D.C. Cir. 1999);
Porter, No. CV595-30, slip op. at 10, 13, 22-23 (S.D. Ga. July 24, 1997) (concerning disclosure by
Postmaster to USPS personnel who had no “need to know” of plaintiff’s two-week suspension
for impersonating a postal inspector); Romero-Vargas v. Shalala, 907 F. Supp. 1128, 1133-34
(N.D. Ohio 1995) (finding telephonic verification or non-verification of plaintiffs’ social security
numbers provided by agency to their employers in violation of regulations and agency employee
manual); Swenson v. USPS, No. S-87-1282, 1994 U.S. Dist. LEXIS 16524, at *33-45 (E.D. Cal. Mar.
10, 1994) (discussing disclosure to Members of Congress, who were seeking to assist
constituent with complaint regarding rural mail delivery, of irrelevant information concerning
plaintiff’s EEO complaints and grievances); Connelly v. Comptroller of the Currency, No. H-84-
3783, slip op. at 25-27 (S.D. Tex. June 3, 1991) (addressing violation of subsection (e)(5) by
disapproving of plaintiff’s appointment as president of new bank without first obtaining
evaluations of prominent bankers who knew plaintiff); MacDonald v. VA, No. 87-544-CIV-T-15A,
slip op. at 4, 7 (M.D. Fla. July 28, 1989) (discussing disclosure of “counseling memorandum” to
plaintiff’s employer “with malicious intent and with the purpose to injure Plaintiff”); Fitzpatrick v.
IRS, 1 Gov’t Disclosure Serv. (P-H) ¶ 80,232, at 80,580 (N.D. Ga. Aug. 22, 1980) (discussing
disclosure to plaintiff’s co-workers and former co-worker that he had retired for “mental”
reasons, even though purpose of disclosure was to “quell[] rumors and gossip”), aff’d in part,
vacated & remanded in part, on other grounds, 655 F.2d 327 (11th Cir. 1982).
At least two courts of appeals, the Sixth and Ninth Circuits, have found intentional or willful
Privacy Act violations.
At least two courts of appeals have found “intentional or willful” violations of the statute – the
Court of Appeals for the Sixth Circuit and the Court of Appeals for the Ninth Circuit. See
Beaven v. DOJ, 622 F.3d 540, 547-53 (6th Cir. 2010); Louis v. Labor, 19 F. App’x 487, 488-89 (9th
Cir. 2001); Wilborn v. HHS, 49 F.3d 597, 602-03 (9th Cir. 1995); Covert v. Harrington, 876 F.2d
751, 756-57 (9th Cir. 1989); cf. Oja v. Army Corps of Eng’rs, 440 F.3d 1122, 1136 (9th Cir. 2006)
(concluding that “it was clear . . . that the [agency’s] disclosures were intentional or willful”
where agency posted information about former employee on its Web site, but dismissing claim
as untimely).
In Beaven, a group of BOP employees sued the agency for unlawful disclosure after a BOP
investigator left an “employee roster” containing “sensitive personal information” on a desk in
an area to which prisoners had access. See 622 F.3d at 544-45. The district court had “found
that [the investigator’s] course of conduct resulted in a disclosure under the Privacy Act . . . and
that his actions were ‘intentional or willful’ within the meaning of § 552a(g)(4), although his final
act of leaving the folder unsecured was ‘inadvertent.’” 622 F.3d at 547; see also v. DOJ, No. 03-
84, 2007 WL 1032301, at *2, 14-17 (E.D. Ky. Mar. 30, 2007)). The Court of Appeals for the Sixth
Circuit framed the “main issue” as “whether the requirement under § 552a(g)(4) that the district
court find that ‘the agency acted in a manner which was intentional or willful’ requires the court
to find that the final act that resulted in the disclosure was ‘intentional or willful’ or whether the
court may find that the entire course of conduct that resulted in the disclosure was ‘intentional
or willful.’” Beaven, 622 F.3d at 547. In holding the latter to be correct, the Sixth Circuit pointed
out that “[n]o court has specifically interpreted § 552a(g)(4) in the light this panel must
address” but observed, after reviewing the case law, that courts “determining whether a Privacy
Act violation occurred have not differentiated between the final act and the course of action
that results in the final act, but rather courts generally look to the entire course of conduct in
context.” Id. at 548-50. The Sixth Circuit went on to conclude that “the facts in the instant case
support[] the district court’s conclusion” and that the district court “did not commit clear error in
finding that [the investigator’s] course of conduct was ‘willful.’” Id. at 552. The court noted that
the investigator had “carried the folder, which he knew contain[ed] confidential and sensitive
information, into an inmate-accessible work area for the purpose of carrying out his own
investigative work should he need to call a . . . computer administrator at home. Yet the roster
[in the folder] not only listed the home telephone numbers of . . . computer administrators but
also included detailed private and personal information related to all [of the prison facility]
employees”; and that the roster was not marked “[Limited Official Use]-Sensitive,” as required
by a BOP Program Statement, among other violations of BOP policy. Id. The Court stated that
the investigator’s “need for some of the information . . . did not provide a legitimate basis for him
to have the entire contents of the folder with him at the time” and that his “course of conduct
that resulted in his leaving the unmarked folder in an inmate-accessible area . . . could properly
be viewed as ‘the intentional or willful failure of the agency to abide by the Act.’” Id. at 552-53.
See also Downie v. City of Middleburg Hts., 301 F.3d 688, 697-99 (6th Cir. 2002) (citing
Toolasprashad, infra, and stating that “[w]hile the Privacy Act does not provide a separate
damages remedy for the intentional or willful creation, maintenance, or dissemination of false
records in retaliation for an individual’s First Amendment rights, we believe that retaliation on
any basis clearly constitutes intentional or willful action”).
In Louis, the plaintiff had sought reconsideration of the denial of his claim for Federal
Employees Compensation benefits by the Department of Labor. See 19 F. App’x at 488. In
denying the plaintiff’s request for reconsideration, the Department indicated that it had
considered the entirety of its prior decision, including a portion of that prior decision that
impermissibly relied on a memorandum that had been the subject of prior litigation by the
plaintiff. See id.; see also Louis v. Labor, No. C99-5195, slip op. at 1-2 (W.D. Wash. Oct. 15, 1999),
aff’d in part, rev’d in part & remanded, Louis v. Labor, 19 F. App’x 487 (9th Cir. 2001); Louis v.
Labor, No. C97-5521 (W.D. Wash. Feb. 27, 1998) (magistrate’s recommendation), adopted, (W.D.
Wash. Mar. 23, 1998); Louis v. VA, No. C95-5606 (W.D. Wash. Oct. 31, 1996). Yet, the district court
in a prior action had ordered that the agency “destroy all but one known copy of the document”
and that it “maintain that single copy in a sealed envelope to be revealed to no person, agency,
or entity.” Louis v. Labor, No. C97-5521, slip op. at 3 (W.D. Wash. Feb. 27, 1998). The Ninth Circuit
ruled that the Department of Labor violated the Privacy Act when it failed “to maintain its
records in such a way as to indicate to the claims examiner that it could not rely on [that
memorandum] in reviewing Louis’ request for reconsideration.” 19 F. App’x at 489. The court
stated that the agency’s “disregard of both the district court’s prior decision rendering reliance
on [the memorandum] impermissible and its own assurance that it would annotate the memo in
its files ‘to reflect that it is not to be considered in any future action related to Dr. Louis’ claim’
constitutes a willful failure on the part of the government to abide by its obligations, and
proximately resulted in the government’s refusal to reconsider its earlier decision, thereby
adversely affecting [plaintiff].” Id.
In Wilborn, an attorney who had been employed by the Department of Health and Human
Services sought Privacy Act damages for an Administrative Law Judge’s disclosure of adverse
personnel information about him in an opinion 49 F.3d at 599-602. The court ruled that the
“uncontroverted facts plainly establish that the ALJ disclosed the information . . . without any
ground for believing it to be lawful and in flagrant disregard of the rights of Wilborn under the
Privacy Act.” Id. at 602. The Ninth Circuit noted that not only was the ALJ personally familiar
with the Privacy Act and had advised his staff concerning the Act’s disclosure prohibition, but
further, that the ALJ had been informed by an agency attorney that the language at issue was
“inappropriate and should not be included in the decision.” Id. Particularly troubling in this case
was the additional fact that all information pertaining to the adverse personnel record was
required to be, and in fact had been, removed from the system of records by the ALJ as a result
of a grievance action filed by the plaintiff. Id.
In Covert, the Ninth Circuit ruled that the Department of Energy Inspector General’s routine use
disclosure of prosecutive reports, showing possible criminal fraud, to the Justice Department
violated subsection (e)(3)(C) because, at the time of their original collection by another
component of the agency, portions of those reports – consisting of personnel security
questionnaires submitted by the plaintiffs – did not provide actual notice of the routine use. 876
F.2d 751, 754-57 (9th Cir. 1989). The Ninth Circuit held that the failure to comply with
subsection (e)(3)(C) was “greater than grossly negligent” even though the Inspector General
was relying on statutes, regulations, and disclosure practices that appeared to permit
disclosure, and no prior court had ever suggested that noncompliance with subsection (e)(3)(C)
would render a subsequent subsection (b)(3) routine use disclosure improper. Compare id. at
756-57, with Chapman, 736 F.2d at 243, Wisdom, 713 F.2d at 424-25, and Bruce, 621 F.2d at 917.
The D.C. Circuit has found that plaintiffs submitted sufficient evidence to establish that complaint
alleging “willful or intentional” data breach could proceed.
The Court of Appeals for the District of Columbia Circuit has not gone as far as the Sixth and
Ninth Circuits in finding an “intentional or willful” violation of the statute. It did find, however,
that the plaintiff had submitted sufficient evidence that a motion to dismiss was not
appropriate. See In re OPM Data Security Breach, 928 F.3d 42, 63–64 (D.C. Cir. 2019) (finding
Plaintiff’s complaint “clears that hurdle by plausibly and with specificity alleging that OPM was
willfully indifferent to the risk that acutely sensitive private information was at substantial risk
of being hacked”); Toolasprashad v. BOP, 286 F.3d 576, 584 (D.C. Cir. 2002) (remanding case
where district court had found that record would not support finding of intentional and willful
action, and stating that, “[i]f proven, retaliatory fabrication of prison records would certainly
meet [our] definition [as articulated in Deters] of a willful or intentional Privacy Act violation”).
Although only a few courts have addressed the issue, they have split over whether the Privacy Act
limits recovery of damages under state law or the Federal Tort Claims Act for negligent disclosure.
The Court of Appeals for the Third Circuit has held that the Privacy Act – with its stringent
“greater than gross negligence” standard for liability – does not indicate a congressional intent
to limit an individual’s right under state law to recover damages caused by the merely negligent
disclosure of a psychiatric report. See O’Donnell v. United States, 891 F.2d 1079, 1083-87 (3d
Cir. 1989) (Federal Tort Claims Act (“FTCA” case). But see Hager v. United States, No. 86-3555,
slip op. at 7-8 (N.D. Ohio Oct. 20, 1987) (finding Privacy Act preempts FTCA action alleging
wrongful disclosure); cf. Doe v. DiGenova, 642 F. Supp. 624, 629-30, 632 (D.D.C. 1986) (holding
state law/FTCA claim preempted by Veterans’ Records Statute, 38 U.S.C. §§ 3301-3302
(renumbered as 38 U.S.C. §§ 5701-5702 (2018))), aff’d in pertinent part, rev’d in part & remanded
sub nom. Doe v. Stephens, 851 F.2d 1457 (D.C. Cir. 1988).
2. Actual Damages
“In any suit brought under the provisions of subsection (g)(1)(C) or (D) . . . in which the court
determines that the agency acted in a manner which was intentional or willful, the United
States shall be liable to the individual [for] actual damages sustained by the individual . . . but in
no case shall a person entitled to recovery receive less than the sum of $1,000.” 5 U.S.C. §
552a(g)(4)(A).
Comment:
The Supreme Court has held that plaintiffs must show actual damages to be “entitled to recovery”
of the $1,000 minimum.
In issuing its first purely Privacy Act decision in the history of the Act, the Supreme Court
considered a decision by the Court of Appeals for the Fourth Circuit in which a divided panel
held that in order to be entitled to a statutory minimum damages award for violation of the
Privacy Act, a complainant must prove actual damages. Doe v. Chao, 540 U.S. 614 (2004), aff’g
Doe v. Chao, 306 F.3d 170, 177-79 (4th Cir. 2002). Recognizing that the Fourth Circuit’s opinion
in Doe v. Chao “conflicted with the views of other Circuits,” the Supreme Court granted
certiorari. 540 U.S. at 618 (citing Orekoya v. Mooney, 330 F.3d 1, 7-8 (1st Cir. 2003); Wilborn v.
HHS, 49 F.3d 597, 603 (9th Cir. 1995); Waters v. Thornburgh, 888 F.2d 870, 872 (D.C. Cir. 1989);
Johnson v. IRS, 700 F.2d 971, 977, and n.12 (5th Cir. 1983); Fitzpatrick v. IRS, 665 F.2d 327, 330-
31 (11th Cir. 1982) (awarding statutory minimum $1,000 damages, but denying recovery beyond
the statutory minimum because “appellant proved only that he suffered a general mental
injury”). The majority conducted “a straightforward textual analysis,” looked to the Privacy Act’s
legislative history, and ultimately, in a 6 to 3 decision, concluded that the Fourth Circuit’s view
was correct. Id. at 620-29. The Court held that to meet the “entitle[ment] to recovery” language
of subsection (g)(4)(A) to qualify for the $1,000 minimum, showing “merely . . . an intentional or
willful violation of the Act producing some adverse effect” is insufficient; “[the statute
guarantees $1,000 only to plaintiffs who have suffered some actual damages.” Id. at 627;
deLeon v. Wilkie, No. CV 19-1250 (JEB), 2020 WL 210089, at *8 (D.D.C. Jan. 14, 2020) (finding
plaintiff did not suffer actual damages where his complaint was “devoid of allegations that
either incident — i.e., the disclosure of his personnel records or of his pending disciplinary
action — caused him to suffer any actual damages”); Clutter v. Perdue, No. H-18-310, 2019 WL
1589942, at *8 (S.D. Tex. Jan. 28, 2019) (dismissing subsection (g)(1)(D) claim for failure to plead
in detail actual damages from unspecified Privacy Act violation); Taylor v. FAA, 351 F. Supp. 3d
97, 105-06 (D.D.C. 2018) (finding that because plaintiff’s complaint “made no allegation
whatsoever of pecuniary or economic harm caused by the alleged Privacy Act violation, the
court is foreclosed from granting the $1,000 statutory award he seeks”); Otero v. DOJ, 292 F.
Supp. 3d 245, 253-54 (D.D.C. 2018), aff’d sub nom. Otero v. DOJ, No. 18-5080, 2019 WL 4565497
(D.C. Cir. Sept. 4, 2019) (granting agency summary judgment where court “identifies no support
for an award of damages – actual or otherwise – arising from a purported violation of the Privacy
Act”); Chichackli v. Kerry, 203 F. Supp. 3d 48, 57-58 (D.D.C. 2016) (dismissing Privacy Act claim,
in part, by finding plaintiff failed to demonstrate “concrete and quantifiable damages” when
pleading that several fraudulent bank accounts were established in his name, fraudulent
income tax returns were filed under his social security number, and credit cards were issued
using his personal information where actual sum of damages was “still undiscovered” and
damages were “in an amount unknown at this time”); Welborn v. IRS, 218 F. Supp. 3d 64, 82-83
(D.D.C. 2016) (dismissing Privacy Act damages claim due to failure to plead actual damages
where plaintiff class alleged false tax returns were filed, future e-filing of taxes was prohibited,
lost time was spent dealing with ramifications of fraud, and there was heightened risk of further
identity theft); Pinkney v. VA, No. 1:07-CV-00142, 2008 WL 4272749, at *5-6 (S.D. Ohio Sept. 11,
2008) (stating that “the Supreme Court in Doe v. Chao carefully reviewed the statutory
language and legislative history and held that the minimum guarantee goes only to victims who
prove some actual damages”). As a result, the court abrogated any prior case law that suggests
that anything less than actual damages is sufficient to entitle an individual to an award of the
statutory minimum $1,000 damages.
The District of Columbia Circuit Court of Appeals has considered in detail whether plaintiff’s
incurred costs constitute “actual damages.” The Court of Appeals, in In re OPM Data Sec.
Breach Litig., reversed the district court’s decision dismissing a case involving a data breach
that resulted in the disclosure of the sensitive information of more than 20 million government
employees. 928 F.3d 42 (D.C. Cir. 2019). The court concluded that numerous expenses that
plaintiffs had alleged in its compliant incurred as a result of the breach constituted actual
damages, including legal fees to close fraudulent accounts, unauthorized charges on a utility
bill, credit protection and/or credit repair services, new credit card accounts fraudulently
opened in plaintiffs’ names, loans taken out in plaintiffs’ names that became delinquent, false
tax returns filed using plaintiffs’ information that led to delays in receiving federal and state tax
refunds and the forgone time value of that money, and the time plaintiffs’ took off work to
resolve the fraudulent tax return filing and to close a fraudulently opened account. Id. at 64-66.
Thus, the court determined that the plaintiffs adequately alleged actual damages.
After years of differing opinions in the circuits, in 2004, the United States Supreme Court limited
“actual damages” to pecuniary or monetary damages, abrogating earlier cases that had found to
the contrary.
Although Doe v. Chao settled the issue of whether actual damages are required to recover
either the statutory minimum or damages beyond the minimum, and that actual damages
include out-of-pocket expenses, the Supreme Court did not rule explicitly on the issue of
whether nonpecuniary damages for mental injury – such as emotional trauma, anger, fear, or
fright – satisfy the definition of actual damages. Doe v. Chao, 540 U.S. at 627 n.12 (noting
division among Courts of Appeals on “the precise definition of actual damages,” and stating
“[t]hat issue is not before us, however”). Until the Supreme Court answered this question eight
years later in FAA v. Cooper, 566 U.S. 284 (2012), discussed below, lower courts were divided on
the issue. Compare, e.g., Jacobs v. Nat’l Drug Intelligence Ctr., 548 F.3d 375, 378 (5th Cir.
2008), Johnson v. IRS, 700 F.2d at 974-80 (finding nonpecuniary damages recoverable), and
Parks v. IRS, 618 F.2d 677, 682-83, 685 (10th Cir. 1980) (stating that plaintiffs had “alleged
viable claims for damages” where only alleged adverse effect was “psychological harm”), with
Fanin v. VA, 572 F.3d 868, 872 (11th Cir. 2009) (following Fitzpatrick in requiring pecuniary
losses), cert. denied sub nom. Perkins v. VA, 130 S. Ct. 1755 (2010), Hudson v. Reno, 130 F.3d
1193, 1207 n.11 (6th Cir. 1997) (citing plaintiff’s failure to show “actual damages” as additional
basis for affirming district court decision and stating that “the weight of authority suggests that
actual damages under the Privacy Act do not include recovery for ‘mental injuries, loss of
reputation, embarrassment or other non-quantifiable injuries’” (citing Fitzpatrick)), DiMura v.
FBI, 823 F. Supp. 45, 47-48 (D. Mass. 1993) (finding that “‘actual damages’ does not include
emotional damages”). See generally Doe v. Chao, 306 F.3d at 181-82 (finding that plaintiff had
“utterly failed to produce evidence sufficient to permit a rational trier of fact to conclude that
he suffered any ‘actual damages,’” and thus stating that “we need not reach the issue of
whether the term ‘actual damages’ as used in the Act encompasses damages for non-pecuniary
emotional distress” where plaintiff “did not produce any evidence of tangible consequences
stemming from his alleged angst over the disclosure of his [social security number]” to
corroborate his “conclusory allegations” of emotional distress); id. at 198 n.13 (Michael, J.,
dissenting) (stating that “the majority’s holding commits this circuit to the position that the term
‘actual damages’ includes at least emotional distress that would qualify as ‘demonstrable’ under
[Price v. City of Charlotte, 93 F.3d 1241 (4th Cir. 1996)]”).
In Cooper, the Supreme Court settled this confusion by interpreting actual damages to be
“limited to proven pecuniary or economic harm.” 566 U.S. at 299. The plaintiff in Cooper had
alleged that the agency’s “unlawful disclosure . . . of his confidential medical information,
including his HIV status, had caused him ‘humiliation, embarrassment, mental anguish, fear of
social ostracism, and other severe emotional distress,’” but he “did not allege any pecuniary or
economic loss.” Id. at 289. In framing the issue, the Court stated: “Because respondent seeks
to recover monetary compensation from the Government for mental and emotional harm, we
must decide whether the civil remedies provision of the Privacy Act waives the Government’s
sovereign immunity with respect to such a recovery.” Id. at 291. The Court explained that any
ambiguities in the scope of the waiver must be construed “in favor of the sovereign.” Id. In
reaching its conclusion, the Court first observed that “‘actual damages’ is a legal term of art”
that has a “chameleon-like quality” because its “precise meaning . . . ‘changes with the specific
statute in which it is found.’” Id. at 289-290. The Court also picked up on its observation in Doe
v. Chao, see 540 U.S. at 625-26, that the civil remedies provision “‘parallels’ the remedial
scheme for the common-law torts of libel per quod and slander, under which plaintiffs can
recover ‘general damages’” – which “cover ‘loss of reputation, shame, mortification, injury to the
feelings and the like and need not be alleged in detail and require no proof’” – “but only if they
prove ‘special harm’ (also known as ‘special damages’)” – which “are limited to actual pecuniary
loss, which must be specially pleaded and proved.” Cooper, 566 U.S., at 295. “This parallel,” the
Court reasoned, “suggests the possibility that Congress intended the term ‘actual damages’ in
the Act to mean special damages. The basic idea is that Privacy Act victims, like victims of libel
per quod or slander, are barred from any recovery unless they can first show actual – that is,
pecuniary or material – harm.” Id. at 296. Finally, the Court placed considerable emphasis on
the fact that the Privacy Protection Study Commission (discussed above under “Introduction,
Privacy Protection Study Commission”), which Congress established “to consider, among its
other jobs, ‘whether the Federal Government should be liable for general damages,’”
recommended that general damages be allowed; however, Congress “never amended the Act to
include them.” Id. at 297. After Cooper, any prior case law suggesting that actual damages are
not limited to proven pecuniary or economic harm has been abrogated. See also Gause v. DOD,
676 F. App’x 316, 318 (5th Cir. 2017) (concluding that plaintiff did not allege actual damages
because “mental and emotional distress . . . do not meet the Supreme Court’s definition
of actual damages under the Privacy Act” and plaintiff did not provide sufficient factual
enhancement to establish “‘lost or jeopardized present or future financial opportunities,’” or
“how the disclosure of his records has caused their loss”); Freeman v. Fed. Bureau of Prisons,
No. 19-CV-02569 (CKK), 2020 WL 4673412, at *4 (D.D.C. Aug. 12, 2020) (internal citations
omitted) (finding plaintiff’s assertion that “improper disclosure has ‘caused and continue[s] to
cause [him] to suffer and sustain intentional infliction of emotional distress’ insufficient in
damages suit” because “Privacy Act does not allow a claim for damages based on . . . emotional
harm”); Martinez v. Stackley, No. CV 16-00475 HG-RLP, 2018 WL 1093810, at *13 (D. Haw. Feb.
28, 2018), aff’d sub nom. Martinez v. Spencer, 771 F. App’x 403 (9th Cir. 2019) (indicating that
damages under Privacy Act is “limited to proven pecuniary or economic harm”); Gonzalez v.
Agriculture, No. 17-24171-CIV, 2018 WL 5071395, at *7 (S.D. Fla. Aug. 29, 2018) (dismissing
plaintiff’s complaint because plaintiff did not show “that his removal from [the union] caused
him to suffer actual damages”); Richardson v. Bd. of Governors of Fed. Reserve Sys., 288 F.
Supp. 3d 231, 236–37 (D.D.C. 2018), aff’d, No. 18-5063, 2018 WL 4103305 (D.C. Cir. Aug. 15,
2018) (concluding that because plaintiff’s “allegations of harm rely on claims of emotional harm
and other non-pecuniary alleged damages” they were insufficient to state a claim under the
Privacy Act); Glass v. DOJ, 279 F. Supp. 3d 279, 281 (D.D.C. 2017), aff’d sub nom. Glass v. DOJ, No.
18-5030, 2018 WL 5115524 (D.C. Cir. Sept. 19, 2018) (concluding that plaintiff’s “vague
description of the harms allegedly sustained as a result of Defendant’s disclosure cannot
support a demand for actual damages that must be ‘limited to proven pecuniary or economic
harm’”); Palmieri v. United States, 72 F. Supp. 3d 191, 213 (D.D.C. 2014), aff’d, 896 F.3d 579 (D.C.
Cir. 2018) (noting that “[a]lthough gossip may cause an adverse effect, it does not
constitute actual damages”); Gause, 676 F. App’x at 318 (concluding that “mental and emotional
distress plaintiff alleges he suffered do not meet the Supreme Court’s definition
of actual damages under the Privacy Act”); Patwardhan v. United States, No. 13-0076, 2014 U.S.
Dist. LEXIS 36226, at *31 (C.D. Cal. Mar. 18, 2014) (finding profit and loss statements from
consecutive years to be mere speculation that does not show actual damages); Makowski v.
United States, 27 F. Supp. 3d 901, 914 (N.D. Ill. 2014) (finding it “reasonable to infer that the
seventy days of unnecessary incarceration cost [plaintiff] prospective employment
opportunities,” and that “[l]oss of economic opportunity is pecuniary harm”); Corbett v. TSA, 968
F. Supp. 2d 1171, 1188 (S.D. Fla. 2012) (dismissing plaintiff’s Privacy Act claims because he
“alleges no actual damages separate and apart from the statutory violations themselves . . .
[and] are thus insufficient to entitle him to any monetary award”); Grant v. United States, No.
2:11-cv-00360, 2012 WL 5289309, at *8 (E.D. Cal. Oct. 23, 2012) (finding plaintiff’s claim for $5
million in general damages “as a result of ‘mental distress, emotional trauma, embarrassment,
humiliation, grief, anxiety, worry, mortification, show indignity, and ordeal’” not cognizable under
the Privacy Act under Cooper) (citing Cooper, 132 S. Ct. at 1446, 1451-53, 1456).
Prior to Doe v. Chao and Cooper, the issue of what needs to be shown in order to recover
damages under subsection (g)(4)(A) had historically engendered some inconsistent and
confusing case law. See, e.g., Orekoya v. Mooney, 330 F.3d 1, 7-8 (1st Cir. 2003) (holding that
“statutory damages [of $1,000], if not actual damages, are available to individuals who suffer
adverse effects from intentional and willful violations of the [Privacy Act] and that provable
emotional distress may constitute an adverse effect”); Wilborn v. HHS, 49 F.3d 597, 603 (9th Cir.
1995) (finding no need to remand to district court for determination of amount of damages
because plaintiff had limited damages sought to statutory minimum); Quinn v. Stone, 978 F.2d
126, 135 (3d Cir. 1992) (stating that subsection (g)(1)(D) “gives an individual adversely affected
by any agency violation of the Act a judicial remedy whereby the individual may seek
damages”); Waters v. Thornburg, 888 F.2d 870, 872 (D.C. Cir. 1989) (stating that to obtain relief
under the Privacy Act plaintiff must establish that (1) the agency violated a provision of the Act;
“(2) the violation of the Act was ‘intentional or willful,’” and “(3) this action had an ‘adverse
effect’ on the plaintiff” and that “[i]f these three factors are satisfied, the plaintiff is entitled to
the greater of $1,000 or the actual damages sustained”); Johnson v. IRS, 700 F.2d 971, 977 &
n.12, 986 (5th Cir. 1983) (recognizing entitlement to statutory minimum for proven physical and
mental injuries even if “actual damages” were interpreted to include only pecuniary harm, but
going on to hold that “actual damages” includes “proven mental and physical injuries”);
Fitzpatrick v. IRS, 665 F.2d 327, 329-31 (11th Cir. 1982) (awarding statutory minimum $1,000
damages, but denying recovery beyond the statutory minimum because “appellant proved only
that he suffered a general mental injury”). See generally OMB Guidelines, 40 Fed. Reg. 28,948,
at 28,970, https://www.justice.gov/paoverview_omb-75 (stating that “[a]ctual damages or
$1,000, whichever is greater,” are recoverable (emphasis added)).
3. Limits on Injunctive Relief for Damages Claims

Unlike amendment and access claims under subsections (g)(1)(A) and (g)(1)(B), injunctive relief is
not available in damages claims under subsections (g)(1)(C) or (g)(1)(D).
It is well settled that injunctive relief as provided for in the Privacy Act is available only under
subsections (g)(1)(A) (amendment) and (g)(1)(B) (access) – both of which, incidentally, require
exhaustion – and that injunctive relief is not available under subsections (g)(1)(C) or (g)(1)(D).
See, e.g., Doe v. Chao, 540 U.S. at 635 (Ginsburg, J., dissenting); McLeod v. VA, 43 F. App’x 70, 71
(9th Cir. 2002) (quoting Cell Assocs. v. NIH, infra); Locklear v. Holland, No. 98-6407, 1999 WL
1000835, at *1 (6th Cir. Oct. 28, 1999); Risley v. Hawk, 108 F.3d 1396, 1397 (D.C. Cir. 1997) (per
curiam); Doe v. Stephens, 851 F.2d at 1463; Hastings v. Judicial Conference of the United States,
770 F.2d 1093, 1104 (D.C. Cir. 1985); Edison, 672 F.2d at 846; Hanley v. DOJ, 623 F.2d 1138, 1139
(6th Cir. 1980) (per curiam); Parks, 618 F.2d at 684; Cell Assocs. v. NIH, 579 F.2d 1155, 1161-62
(9th Cir. 1978); Halliburton v. Labor, No. 17-CV-01045-MJW, 2018 WL 1256509, at *3 (D. Colo.
Mar. 12, 2018) (dismissing 5 U.S.C. § 552a(g)(1)(D) claim where only a failure to produce disputed
records was pleaded which is remedied solely by injunctive relief under 5 U.S.C. § 552a(g)(1)(B));
Makowski v. United States, 27 F. Supp. 3d 901, 915 (N.D. Ill. 2014); Kursar v. TSA, 581 F. Supp. 2d
7, 19 (D.D.C. 2008), aff’d per curiam, on other grounds, 442 F. App’x 565 (D.C. Cir. 2011); Tarullo v.
Def. Contract Audit Agency, 600 F. Supp. 2d 352, 358 (D. Conn. 2009); AFGE v. HUD, 924 F.
Supp. 225, 228 n.7 (D.D.C. 1996), rev’d on other grounds, 118 F.3d 786 (D.C. Cir. 1997); Houston,
494 F. Supp. at 29; see also Word v. United States, 604 F.2d 1127, 1130 (8th Cir. 1979) (no
“exclusionary rule” for subsection (b) violations; “No need and no authority exists to design or
grant a remedy exceeding that established in the statutory scheme.”); Shields v. Shetler, 682 F.
Supp. 1172, 1176 (D. Colo. 1988) (Act “does not create a private right of action to enjoin agency
disclosures”); 120 Cong. Rec. at 40,406, reprinted in Source Book at 862, cf. New-Howard v.
Shinseki, No. 09-5350, 2012 WL 2362546, at *8 (E.D. Pa. June 21, 2012) (“To the extent that
Plaintiff seeks to enjoin Defendant from using the allegedly altered records in the course of
further litigation, the statute in question does not authorize the relief requested.”). But see Fla.
Med. Ass’n v. HEW, 479 F. Supp. 1291, 1299 & n.8 (M.D. Fla. 1979) construing subsection (g)(1)(D)
to confer jurisdiction to enjoin agency’s disclosure of Privacy Act-protected record. However,
courts have recognized the availability of equitable relief under the Administrative Procedure
Act for claims governed by the Privacy Act (see the discussion above under “Civil Remedies”).
Given the well-settled law that injunctive relief is not available for Privacy Act damages claims,
it would seem clear that injunctive relief is not available for any damages claim, but the D.C.
Circuit has suggested that there may be an exception for subsection (e)(7) damages claims. In
Haase v. Sessions, 893 F.2d 370, 373-75 (D.C. Cir. 1990), the D.C. Circuit, in dictum, suggested
that its decision in Nagel v. HEW, 725 F.2d 1438, 1441 (D.C. Cir. 1984), could be read to recognize
the availability of injunctive relief to remedy a subsection (e)(7) violation, under subsection (g)(1)
(D); see also Becker v. IRS, 34 F.3d 398, 409 (7th Cir. 1994) (finding that the IRS had not justified
maintenance of documents under subsection (e)(7), and stating that “the documents should be
expunged”); Scott v. Conley, 937 F. Supp. 2d 60, 81-82 (D.D.C. 2013) (dismissing plaintiff’s
subsection (e)(7) claim on other grounds, but stating “[a]lthough the Circuit did not explicitly
decide the question in Haase, its language suggests that injunctive relief for (e)(7) violations
under (g)(1)(D) would be available”); but see Wabun-Inini v. Sessions, 900 F.2d 1234, 1245 (8th
Cir. 1990); Clarkson v. IRS, 678 F.2d 1368, 1375 n.11 (11th Cir. 1982); Comm. in Solidarity v.
Sessions, 738 F. Supp. 544, 548 (D.D.C. 1990), aff’d, 929 F.2d 742 (D.C. Cir. 1991); see also
Socialist Workers Party v. Attorney Gen., 642 F. Supp. 1357, 1431 (S.D.N.Y. 1986) (in absence of
exhaustion, only damages remedy, rather than injunctive relief, is available for violation of
subsection (e)(7)). The D.C. Circuit’s view in Haase is somewhat difficult to reconcile with the
structure of subsection (g) and with the case law mentioned above.
4. Additional Considerations for Damages Claims

Plaintiffs are not entitled to the minimum recovery for each individual copy of a document that is
disclosed.
The Court of Appeals for the District of Columbia Circuit has ruled that a plaintiff was not
entitled to $1,000 for each copy of a letter that was disclosed in violation of the Privacy Act to
4500 individuals. See Tomasello v. Rubin, 167 F.3d 612, 617-18 (D.C. Cir. 1999). The D.C. Circuit
stated that “[w]hile it may be linguistically possible to read the language [of § 552a(g)(4)] so as
to forbid the aggregation of several more-or-less contemporaneous transmissions of the same
record into one ‘act[]’ or ‘failure [to comply with the Privacy Act],’ the result [sought in this case]
shows that such a reading defies common sense.” Id. at 618. In reaching its determination “that
each letter disclosure was not independently compensable,” the D.C. Circuit also reasoned that
as a waiver of sovereign immunity, subsection (g)(4) “must be construed strictly in favor of the
sovereign, and not enlarge[d] . . . beyond what the language requires.” Id. (quoting United States
v. Nordic Vill., Inc., 503 U.S. 30, 34 (1992)); cf. Siddiqui v. United States, 359 F.3d 1200, 1201-03
(9th Cir. 2004) (finding that disclosure of tax information by IRS agent to 100 people in one room
at one time constituted one act of disclosure for purposes of determining statutory damages
under Internal Revenue Code).
One court has allowed a plaintiff to recover mitigation costs for certain Privacy Act claims.
One district court has applied the doctrine of mitigation to certain Privacy Act claims, holding
that “an individual whose information is disclosed in violation of the Privacy Act may recover for
costs incurred to prevent harm from that disclosure.” Beaven v. DOJ, No. 03-84, 2007 WL
1032301, at *8 (E.D. Ky. Mar. 30, 2007) (concluding that “plaintiffs’ out-of-pocket expenses
[incurred in monitoring their financial information] to protect themselves from potential harm
were caused by the instant Privacy Act violation”), aff’d in part, rev’d in part & remanded, on
other grounds, 622 F. 3d 540 (6th Cir. 2010).
There is a circuit court split as to whether an individual can file a damages action when an agency
destroys a Privacy Act record.
There is a split of authority on the issue of whether destruction of a Privacy Act record gives rise
to a damages action. Compare Tufts v. Air Force, 793 F.2d 259, 261-62 (10th Cir. 1986), with
Rosen v. Walters, 719 F.2d 1422, 1424 (9th Cir. 1983), and Waldrop v. Air Force, 3 Gov’t
Disclosure Serv. (P-H) ¶ 83,016, at 83,453 (S.D. Ill. Aug. 5, 1981). See also Vaughn v. Danzig, 18 F.
App’x 122, 124-25 (4th Cir. 2001) (per curiam) (finding no Privacy Act violation where record of
nonjudicial punishment was maintained in files of plaintiff’s military unit at time of his
discharge, but later was destroyed pursuant to records retention policy; “Although [plaintiff]
seems to argue that the Privacy Act requires that records be maintained in perpetuity, he has
cited no authority for that proposition”; “[A]gencies are not required to retain records on the
possibility that a . . . Privacy Act request may be submitted.”); Dowd v. IRS, 776 F.2d 1083, 1084
(2d Cir. 1985) (per curiam) (declining to decide issue). Cf. Beaven, 2007 WL 1032301, at *16-17
(applying adverse inference because agency “destroyed the [records] intentionally and in bad
faith” and concluding that “[t]he inference is conclusive as to disclosure, and the defendants’
conduct therefore constitutes a violation of the Privacy Act”), aff’d, 622 F. 3d 540.
F. Principles Applicable to All Privacy Act Civil Actions

The Privacy Act does not provide relief from federal criminal prosecution, cannot be used to
collaterally attack a conviction or sentence, and is not a defense to a summons.
Several courts have stated that the civil remedies provided in the Privacy Act do not provide for
any relief in the course of a federal criminal prosecution. See, e.g., Heck v. Humphrey, 512 U.S.
477, 486-87 (1994) (finding that claims for unlawful actions that would render convictions or
sentences invalid are precluded unless there has been reversal on direct appeal, expungement,
invalidation, or issuance writ of habeas corpus); United States v. Bressler, 772 F.2d 287, 293 (7th
Cir. 1985) (“[E]ven if the defendant had made a sustainable argument [under 5 U.S.C. § 552a(e)
(3)], the proper remedy is a civil action under Section 552a(g)(1) of the Privacy Act, not dismissal
of the indictment.”); United States v. Bell, 734 F.2d 1315, 1318 (8th Cir. 1984) (asserting that even
if appellant’s (e)(3) argument was sufficiently raised at trial, “it cannot be a basis for reversing
his conviction”); United States v. Gillotti, 822 F. Supp. 984, 989 (W.D.N.Y. 1993) (“[T]he
appropriate relief for a violation of Section 552a(e)(7) is found in the statute and allows for
damages as well as amendment or expungement of the unlawful records. . . . [T]here is nothing
in the statute itself, nor in any judicial authority, which suggests that its violation may provide
any form of relief in a federal criminal prosecution.”); cf. United States v. Moreno-Nevarez, No.
13-CR-0841, 2013 U.S. Dist. LEXIS 143900, at *10-14 (S.D. Cal. Oct. 2, 2013) (finding that
“[r]egardless of the merits of Defendant’s contentions regarding possible violations of the
Privacy Act, he has not presented grounds for suppressing the information in his criminal case”
and “[t]he Privacy Act explicitly creates remedies for individuals harmed by violations of the
statute”).
A plaintiff cannot use the Privacy Act to challenge a conviction or sentence. See Skinner v. DOJ
& BOP, 584 F.3d 1093, 1101 (D.C. Cir. 2009) (affirming dismissal of damages claim under Privacy
Act because claim is not cognizable unless plaintiff first secures relief through writ of habeas
corpus); Leventhal v. Rios, No. 0: 17–CV–05441, 2018 WL 3130682, at *3 (D. Minn. May 16, 2018)
(indicating Privacy Act claim not cognizable under 28 U.S.C. § 2241 writ of habeas corpus
petition); Hill v. Smoot, 308 F. Supp. 3d 14, 22 (D.D.C. 2018) (“‘absent a showing that the
plaintiff’s conviction or sentence has been invalidated, . . . the plaintiff cannot recover damages’
for the alleged one-month he spent in custody following his arrest for a parole violation”
(quoting Johnson v. United States, 590 F. Supp. 2d 101, 108–09 (D.D.C. 2008))); Semrau v. ICE, No.
5:13–cv–188, 2014 WL 4626708, at *5-*6 (S.D. Miss. Sept. 12, 2014) (finding claim that agency
failed to maintain accurate records about plaintiff to extent that they supported his guilty
verdict and deportation was collateral attack on verdict and barred by law).
Several courts also have found that failure to comply with the Privacy Act is not a proper
defense to certain enforcement summons, such as a summons issued by the Internal Revenue
Service (IRS). See, e.g., United States v. McAnlis, 721 F.2d 334, 337 (11th Cir. 1983) (holding that
compliance with 5 U.S.C. § 552a(e)(3) is not prerequisite to enforcement of an IRS summons);
United States v. Berney, 713 F.2d 568, 572 (10th Cir. 1983) (stating that Privacy Act “contains its
own remedies for noncompliance”); United States v. Harris, 172 F.3d 54, at *2 (7th Cir. 1998)
(unpublished table decision) (citing McAnlis and Berney and rejecting “irrelevant argument that
. . . the Privacy Act . . . guarantee[s] [appellant] answers to his questions before he has to comply
with the IRS summons”); Reimer v. United States, 43 F. Supp. 2d 232, 237 (N.D.N.Y. 1999)
(rejecting argument to quash summons because, inter alia, “the disclosure requirements in 5
U.S.C. § 552a(e)(3) are not applicable to summons issued pursuant to 26 U.S.C. §§ 7602, 7609”);
see also Phillips v. United States, 178 F.3d 1295, at *2 (6th Cir. 1999) (unpublished table
decision) (holding Privacy Act notice requirements inapplicable to issuance of IRS summons, as
26 U.S.C. § 7852(e) “plainly states that the provisions of the Privacy Act do not apply, directly or
indirectly, to assessing the possibility of a tax liability”); cf. Huene v. Treasury, No. 11-2110, 2012
WL 3027815, at *1 (E.D. Cal. July 24, 2012) (finding court “lacks jurisdiction over plaintiff’s claim
on the basis of 26 U.S.C. § 7852(e), which renders certain provisions of the Privacy Act
inapplicable to the determination of the existence of tax-related liability”); Estate of Myers v.
United States, 842 F. Supp. 1297, 1300-02 (E.D. Wash. 1993) (recognizing applicability of
subsection (e)(3) to IRS summons, and possibility “that a summons may be judicially
enforceable yet not meet the disclosure requirements of the Privacy Act”).
Mandamus relief is not an appropriate remedy for a Privacy Act violation.
“Because the Privacy Act provides its own remedy for an agency’s improper refusal to process a
proper request for information, [plaintiff] is not entitled to mandamus relief.” Kotmair v. Netsch,
No. 93-490, 1993 U.S. Dist. LEXIS 10781, at *5 (D. Md. July 21, 1993); see also Harris v. BOP, No.
13-1144, 2013 U.S. Dist. LEXIS 106619, at *1 (D.D.C. July 23, 2013) (“Judicial review of an agency’s
failure to amend records is available exclusively under the Privacy Act.”); Christian v. Army, No.
11-0276, 2011 WL 345945, at *1 (D.D.C. Jan. 31, 2011) (rejecting plaintiff’s attempt “to correct his
military records via a writ of mandamus” on ground that Privacy Act “provides an adequate
remedy for addressing plaintiff’s claims”); Carrick v. Spencer, No. 3:02MC95-V, 2003 U.S. Dist.
LEXIS 11706, at *3-4 (W.D.N.C. June 6, 2003) (magistrate’s recommendation) (denying petition
for writ of mandamus as “the Privacy Act establishes a procedure for filing suit in federal court
if an agency refuses to comply with a request” and petitioner has not “shown, or attempted to
show, that this procedure is inadequate to obtain the relief requested”), adopted, 2003 U.S. Dist.
LEXIS 17189 (W.D.N.C. Sept. 2, 2003); cf. Graham v. Hawk, 857 F. Supp. 38, 41 (W.D. Tenn. 1994)
(“[R]emedies under the Privacy Act [for alleged inaccuracy] preclude plaintiff’s entitlement to
mandamus, even though his claim under that act is substantively meritless.”), aff’d, 59 F.3d 170
(6th Cir. 1995) (unpublished table decision).
The Privacy Act does not preclude individuals from seeking remedies under the Federal Tort
Claims Act.
On the other hand, the United States Court of Appeals for the Third Circuit considered civil
remedies for Privacy Act violations under the Federal Tort Claims Act (“FTCA”) and held that the
Privacy Act “does not limit the remedial rights of persons to pursue whatever remedies they
may have” under the FTCA for privacy violations consisting of record disclosures. O’Donnell v.
United States, 891 F.2d 1079, 1084-85 (3d Cir. 1989); see also Stephens v. United States, No.
0:16-149-BHH-PJG, 2016 WL 11200987, at *2-3 (D.S.C. Dec. 9, 2016) (magistrate’s
recommendation) (following O’Donnell), adopted in pertinent part & rev’d in other part (D.S.C.
Jan. 19, 2017); Rosado-Montes v. United States, 8 F. Supp. 3d 55, 63 (D.P.R. 2014) (quoting
O’Donnell and permitting FTCA claim against VA employees who accessed plaintiff’s medical
records to proceed notwithstanding the Privacy Act); Beaven v. DOJ, No. 03-84, 2007 WL
1032301, at *21-25 (E.D. Ky. Mar. 30, 2007) (assuming jurisdiction over claims of invasion of
privacy brought under FTCA and based on conduct held to violate Privacy Act, but determining
that plaintiffs failed to prove elements of those claims), aff’d in part, rev’d in part & remanded,
on other grounds, 622 F.3d 540 (6th Cir. 2010); cf. Alexander v. FBI, 691 F. Supp. 2d 182 (D.D.C.
2010) (implicitly recognizing that local or state common law tort and FTCA are alternative
causes of action to Privacy Act, but finding that plaintiffs had not met specific requirements to
prevail on those causes of action), aff’d on other grounds, 456 F. App’x 1 (D.C. Cir. 2011).
Alleged violations of the Privacy Act, however, cannot be the sole basis of a FTCA claim.
Coleman v. United States, 912 F.3d 824, 835-36 (5th Cir. 2019); Burroughs v. Abrahamson, 964
F. Supp. 2d 1268, 1272 (D. Or. 2013) (explaining that “[b]ecause plaintiff’s Privacy Act claim is
rooted in federal rather than state law, and because Oregon has no analogous law, plaintiff
cannot allege a claim under the FTCA for negligent violation of the Privacy Act”); Tripp v. United
States, 257 F. Supp. 2d 37, 45 (D.D.C. 2003) (dismissing plaintiff’s claim under the FTCA for
negligent disclosure of private information, as plaintiff could point to no “duty analogous to that
created by the federal Privacy Act under local law to state a claim upon which relief [could] be
granted”); Fort Hall Landowners Alliance, Inc. v. BIA, No. 99-052, 2001 U.S. Dist. LEXIS 27315,
at *20 (D. Idaho Mar. 28, 2001) (finding that “the alleged breach of a duty not to disclose
personal information” was “pre-empted by the Privacy Act”); Hager v. United States, No. 86-
3555, slip op. at 7-8 (N.D. Ohio Oct. 20, 1987) (“Because the Privacy Act does have its own
enforcement mechanism” for plaintiff’s claims relating to disclosure of confidential information,
“it preempts the FTCA.”).
The Court of Appeals for the District of Columbia Circuit has held that the Feres doctrine, which
holds that “the [g]overnment is not liable under the Federal Tort Claims Act for injuries to
servicemen where the injuries arise out of or are in the course of activity incident to service,”
does not apply to the Privacy Act. Cummings v. Navy, 279 F.3d 1051, 1053-58 (D.C. Cir. 2002)
(quoting Feres v. United States, 340 U.S. 135, 146 (1950), and concluding that “without regard to
the identity of the plaintiff or the agency she is suing, the [Privacy Act] plainly authorizes
injunctive relief . . . and monetary relief,” which remains “the best evidence of congressional
intent” that Feres doctrine “does not extend to Privacy Act lawsuits brought by military
personnel against the military departments”); see also Chang v. Navy, No. 01-5240, 2002 WL
1461859, at *1 (D.C. Cir. July 8, 2002) (citing Cummings to vacate district court opinion that held
suit barred by Feres doctrine); Colon v. United States, 320 F. Supp. 3d 733, 742 (D. Md. 2018);
Gamble v. Army, 567 F. Supp. 2d 150, 155 n.9 (D.D.C. 2008) (concluding that Feres “does not
extend to Privacy Act lawsuits brought by military personnel against the military
departments”).
In an earlier decision, however, the Court of Appeals for the Eighth Circuit had held that the
plaintiff’s Privacy Act claims were barred under the Feres doctrine. See Uhl v. Swanstrom, 79
F.3d 751, 755-56 (8th Cir. 1996); cf. Dickson v. Wojcik, 22 F. Supp. 3d 830, 839 (W.D. Mich. 2014)
(citing Uhl favorably and finding that “[w]hile there are cases finding that Feres generally does
not bar a Privacy Act claim, see, e.g., Cummings, the Sixth Circuit has not ruled on the
question”); Walsh v. United States, No. 1:05-CV-0818, 2006 WL 1617273, at *5 (M.D. Pa. June 9,
2006) (comparing, in dicta, Uhl and Cummings and noting that “[t]here is a split of authority on
whether the Feres doctrine bars Privacy Act claims”), aff’d on other grounds, 328 F. App’x 806
(3d Cir. 2009), cert. denied, 558 U.S. 996 (2009). The Cummings opinion did not reference Uhl,
the only other appellate decision on this issue.
The Privacy Act’s remedies generally preclude monetary damages for constitutional violations of
government officials under Bivens v. Six Unknown Named Agents of Federal Bureau of Narcotics.
Several courts have held that the Privacy Act’s remedies preclude an action seeking monetary
damages directly under the Constitution from individual government officials under Bivens v.
Six Unknown Named Agents of Federal Bureau of Narcotics, 403 U.S. 388 (1971). See Fazaga v.
FBI, 965 F.3d 1015, 1057-1058 (9th Cir. 2020) (holding that the Privacy Act and the Religious
Freedom Restoration Act “taken together, provide an alternative remedial scheme for some, but
not all, of Plaintiffs’ First and Fifth Amendment Bivens claims”); Liff v. Off. of Inspector Gen. for
Labor, 881 F.3d 912, 918-924 (D.C. Cir. 2018) (“The Privacy Act represents Congress’s legislative
judgment about the appropriate remedies with respect to the accuracy, fairness, and use of
government information, and the judicial system is not in a position to revise that scheme by
recognizing an additional constitutional remedy” for claims that government officials
disseminated information that harmed plaintiff’s reputation); Wilson v. Libby, 535 F.3d 697, 707
(D.C. Cir. 2008) (concluding that Privacy Act’s comprehensive remedial scheme precludes
Bivens claim even though that scheme does not necessarily provide plaintiffs with full relief);
Abuhouran v. SSA, 291 F. App’x 469, at *2 (3d Cir. Aug. 4, 2008) (per curiam) (unpublished
decision); Chung v. DOJ, 333 F.3d 273, 274 (D.C. Cir. 2003) (affirming district court’s dismissal of
plaintiff’s Bivens claims “because . . . they are encompassed within the remedial scheme of the
Privacy Act”); Downie v. City of Middleburg Hts., 301 F.3d 688, 696 (6th Cir. 2002) (agreeing
with district court that “because the Privacy Act is a comprehensive legislative scheme that
provides a meaningful remedy for the kind of wrong [plaintiff] alleges that he suffered, we
should not imply a Bivens remedy”); see also Chesser v. Chesser, 600 F. App’x 900, 901 (4th Cir.
2015) (unpublished opinion) (citing Wilson and Downie); Bloch v. Exec. Off. of the President, 164
F. Supp. 3d 841, 860 n.26 (E.D. Va. 2016); Powerturbine, Inc. v. United States, No. 3:14–cv–0435–
CAB–BLM, 2014 WL 12160753, at *7-9 (S.D. Cal. Dec. 15, 2014) (“Allowing a Bivens remedy for
Powerturbine here would effectively recognize a right for corporations that Congress explicitly
did not give individuals in the Privacy Act – the ability to sue government employees.”); Lewis v.
Parole Comm’n, 770 F. Supp. 2d 246, 251-52 (D.D.C. 2011); Hurt v. D.C. Court Servs., 612 F. Supp.
2d 54, 56 (D.D.C. 2009), aff’d in pertinent part per curiam sub nom. Hurt v. Cromer, No. 09-5224,
2010 WL 604863, at *1 (D.C. Cir. Jan. 21, 2010), rev’d in part on other grounds & remanded per
curiam, 2010 WL 8753255 (D.C. Cir. June 11, 2010); Sudnick v. DOD, 474 F. Supp. 2d 91, 100
(D.D.C. 2007); Hatfill v. Ashcroft, 404 F. Supp. 2d 104, 116-17 (D.D.C. 2005); Clark v. BOP, 407 F.
Supp. 2d 127, 131 (D.D.C. 2005); Newmark v. Principi, 262 F. Supp. 2d 509, 518-19 (E.D. Pa. 2003);
Fares v. INS, 29 F. Supp. 2d 259, 262 (W.D.N.C. 1998), aff’d per curiam, 11 F. App’x 137 (4th Cir.
2001) (unpublished decision); Sullivan v. USPS, 944 F. Supp. 191, 195-96 (W.D.N.Y. 1996); Blazy v.
Woolsey, No. 93-2424, 1996 WL 43554, at *1 (D.D.C. Jan. 31, 1996), subsequent decision sub
nom. Blazy v. Tenet, 979 F. Supp. 10, 27 (D.D.C. 1997), summary affirmance granted, No. 97-
5330, 1998 WL 315583 (D.C. Cir. May 12, 1998); Williams v. VA, 879 F. Supp. 578, 585-87 (E.D.
Va. 1995); Mittleman v. Treasury, 773 F. Supp. 442, 454 (D.D.C. 1991); cf. Royer v. BOP, No. 1:10-
cv-0146, 2010 WL 4827727, at *5 (E.D. Va. Nov. 19, 2010) (stating that plaintiff’s Bivens claims
“may simply collapse into [his] Privacy Act claims, at least insofar as they merely repeat the
allegations that the BOP has maintained inaccurate records about [his] affiliation with terrorist
groups”); Patterson v. FBI, 705 F. Supp. 1033, 1045 n.16 (D.N.J. 1989) (discussing the extent to
which First Amendment claim involves damages resulting from maintenance of records; “such
an action is apt to be foreclosed by the existence of the Privacy Act”), aff’d, 893 F.2d 595 (3d
Cir. 1990). But see Hartley v. Wilfert, 918 F. Supp. 2d 45, 55-56 (D.D.C. 2013) (allowing plaintiff’s
First Amendment claim under Bivens to move forward because “the conduct here strays so far
afield from the compass of the Privacy Act that it cannot be said that Congress ever
contemplated the sort of claim here being covered by the statute”; defendant’s “actions here did
not involve the sort of collection of information contemplated by the Act, instead, his words
were merely a threat to intimidate [plaintiff] from continuing in her speech, just as ‘I will arrest
you if you continue to protest’ or ‘I will take a picture of you for my book of crazy protesters’
would deter a person from speaking”); see also Alexander, 971 F. Supp. at 610-11 (agreeing with
outcome in Blazy and Mittleman, supra, but concluding that their logic does not extend to
prohibit recovery under local law for torts committed by individuals who, although government
employees, were acting outside scope of their employment; holding that “Privacy Act does not
preempt the common law invasion of privacy tort”).
Courts have differed as to whether plaintiffs are entitled to additional remedies beyond those
available under the Privacy Act, particularly where other statutes are also applicable.
The Supreme Court has addressed Administrative Procedure Act (“APA”) judicial review
equitable relief issues for claims governed by the Privacy Act. See 5 U.S.C. §§ 701-706 (2018).
The Court stated that “[t]he Privacy Act says nothing about standards of proof governing
equitable relief that may be open to victims of adverse determinations or effects, although it
may be that this inattention is explained by the general provisions for equitable relief within the
[APA].” Doe v. Chao, 540 U.S. 614, 619 n.1 (2004); cf. OMB 1975 Guidelines, 40 Fed. Reg. at
28,949, https://www.justice.gov/paoverview_omb-75 (stating in its Civil Remedies section that
“[a]n individual may seek judicial review under other provisions of the Administrative Procedure
Act”). Indeed, under the APA, the D.C. Circuit enjoined the Veterans Administration from
disclosing medical records about an individual pursuant to a routine use that “would permit
routine disclosure pursuant to a grand jury subpoena,” stating the disclosure would “circumvent
the mandates of the Privacy Act.” Doe v. Stephens, 851 F.2d 1457, 1466-67 (D.C. Cir. 1988)
(furthering the principle of “avoiding constitutional questions if at all possible” where the
plaintiff did “not premise his claim for equitable relief on the APA,” but the court considered the
claim under the APA rather than resolving the plaintiff’s constitutional claims); see also Fla.
Med. Ass’n v. Dep’t of Health, Edu. & Welfare, 947 F. Supp. 2d 1325, 1351-56 (M.D. 2013)
(vacating 1979 permanent injunction prohibiting public disclosure of reimbursements paid to
Medicare providers that would individually identify some providers, as no longer based on good
law under Privacy Act; noting in dicta agency’s final action to disclose information may be
reviewed under APA); Arruda & Beaudoin v. Astrue, No. 11-10254, 2013 WL 1309249, at *14-15 (D.
Mass. Mar. 27, 2013) (dismissing plaintiff’s claim alleging that SSA’s failure to timely respond to
its request for information was not an agency action to be reviewed under APA, because APA
provides no relief other than what is provided by the Privacy Act); Recticel Foam Corp. v. DOJ,
No. 98-2523, slip op. at 9 (D.D.C. Jan. 31, 2002), appeal dismissed, No. 02-5118 (D.C. Cir. Apr. 25,
2002) (holding that court had jurisdiction under APA to enjoin FBI from disclosing investigative
records in order to prevent future violation of subsection (b) of Privacy Act); Doe v. Herman, No.
97-0043, 1998 WL 34194937, at *4-7 (W.D. Va. Mar. 18, 1998) (invoking APA to issue preventative
injunction in response to Privacy Act claim); cf. Haase v. Sessions, 893 F.2d 370, 374 n.6 (D.C.
Cir. 1990) (stating in dicta that “[i]t is not at all clear to us that Congress intended to preclude
broad equitable relief (injunctions) to prevent (e)(7) violations . . . [a]nd in the absence of such an
explicit intention, by creating a general cause of action (under (g)(1)(D)) for violations of the
Privacy Act, Congress presumably intended the district court to use its inherent equitable
powers”); Rice v. United States, 245 F.R.D. 3, 7 (D.D.C. 2007) (noting that “there is some
authority for awarding [declaratory] relief under the APA” for claims arising under Privacy Act);
Doe v. Veneman, 230 F. Supp. 2d 739, 752 (W.D. Tex. 2002) (enjoining release of records in
system of records, through “reverse FOIA” action, because release would violate the FOIA and
Privacy Act), aff’d in part & rev’d in part on other grounds, 380 F.3d 807 (5th Cir. 2004).
However, courts in other cases have refused to allow claims brought under the APA where the
relief sought is expressly provided by the Privacy Act. See, e.g., Harrison v. BOP, 248 F. Supp.
3d 172, 181-182 (D.D.C. 2017); Westcott v. McHugh, 39 F. Supp. 3d 21, 33 (D.D.C. 2014) (holding
that “plaintiff cannot bring an APA claim to obtain relief for an alleged Privacy Act violation,”
and, citing Mittleman, supra, holding that plaintiff’s APA claim simply restates plaintiff’s Privacy
Act claims); Echols v. Morpho Detection, Inc., No. C 12-1581, 2013 WL 1501523, at *2-3 (N.D. Cal.
Apr. 11, 2013) (finding that “[p]laintiff does not provide any authority that demonstrates that he is
required to make a greater showing in order to achieve relief under the Privacy Act or that
adequate relief is not available under that Act” where plaintiff attempted to challenge agency’s
finding of his ineligibility to work under both Privacy Act and APA); Wilson v. McHugh, 842 F.
Supp. 2d 310, 320 (D.D.C. 2012) (“To the extent [plaintiff] relies on the Privacy Act and believes
the Privacy Act provides him a legal remedy, . . . [plaintiff] cannot seek review in this Court under
the APA.”); Tripp v. DOD, 193 F. Supp. 2d 229, 238-40 (D.D.C. 2002) (holding that “plaintiff can
not bring an independent APA claim predicated on a Privacy Act violation”); Schaeuble v. Reno,
87 F. Supp. 2d 383, 393-94 (D.N.J. 1998); Mittleman, 773 F. Supp. at 449 (finding that plaintiff’s
APA claim for failure to follow agency regulations and to provide plaintiff with hearing or other
opportunity to rebut allegations against her in various government reports “is, in part, simply a
restatement of her Privacy Act claims . . . [for which] Congress has provided plaintiff with
statutory schemes and remedies through which she may seek relief”).
In considering whether plaintiffs had a cause of action under the Declaratory Judgment Act
(“DJA”), the D.C. District Court was recently “unconvinced” that plaintiffs were precluded from
obtaining declaratory relief under the DJA “[b]ecause the Privacy Act provides for injunctive
relief in specific situations.” Morinville v. U.S. Patent and Trademark Office, 442 F. Supp. 3d 286,
295 (Feb. 26, 2020). In Morinville, the plaintiffs filed numerous claims addressing the Patent
and Trademark Office’s former “Sensitive Application Warning System” (SAWS), including a
claim under the DJA requesting that the court declare that SAWS violated the Privacy Act. Id. at
289. In assessing the defendant’s arguments in its motion to dismiss, the court found none of
the purportedly supportive cases analogous to the situation, stating that “the Declaratory
Judgment Act explicitly carves out several claims for which parties may not seek relief, and the
Privacy Act is not among those carve-outs.” Id. at 295–96; see also 28 U.S.C. § 2201. Ultimately,
the court held that “relief under the [DJA] may be unnecessary, and the Court, in its discretion,
may dismiss this claim. However, at the motion to dismiss stage, the Court is not prepared to
say that Plaintiffs’ [DJA] claim is duplicative of their Privacy Act claims or otherwise
unnecessary or inappropriate.” Morinville, 442 F. Supp. 3d at 296; cf. Schaeuble v. Reno, 87 F.
Supp. 2d at 393 (“Assuming that the Court does have discretion, because Plaintiff, in good faith,
tried to exhaust his administrative remedies, and it was Defendants’ own failure to comport with
the Privacy Act and its regulations that impeded Plaintiff’s efforts to obtain administrative relief
or exhaust his administrative remedies, the Court declines to withhold exercising its authority
under the [DJA].”).
The District Court for the District of Columbia has analyzed the relationship between the
Privacy Act and the Health Care Quality Improvement Act (“HCQIA”), Pub. L. No. 99-660, 100
Stat. 3784, which “protect[s] patients from incompetent physicians by establishing a database
to collect information related to professional competence or conduct which could adversely
affect the health or welfare of patients.” Doe v. Thompson, 332 F. Supp. 2d 124, 125 (D.D.C.
2004). In Doe, a dentist filed a subsection (g)(1)(B) claim against the Department of Health and
Human Services. Id. at 127. However, “instead of reviewing the plaintiff’s request pursuant to
the Privacy Act, the [Department] responded by informing the plaintiff that the sole
administrative remedy available to him was the procedures promulgated by the [Department]”
pursuant to HCQIA. Id. The court concluded that because the procedures promulgated by the
Department pursuant to HCQIA “provide less protection than the procedures required by the
Privacy Act,” the Department “must adhere to the requirements of the Privacy Act when
considering a dispute to a record” in the database established by HCQIA. Id. at 130, 132-33.
The D.C. District Court also has analyzed the relationship between the Privacy Act and the
Health Insurance Portability and Accountability Act (“HIPAA”), 42 U.S.C. § 1320d-1320d-8
(2018), which “prohibits both the improper disclosure of individually identifiable health
information and the improper acquisition of such information.” Cacho v. Chertoff, No. 06-00292,
2006 WL 3422548, *2 (D.D.C. Nov. 28, 2006). In Cacho, the plaintiff brought a Privacy Act claim
against the Department of Homeland Security “on the theory that [a Department employee]
improperly accessed [the plaintiff’s] medical record.” Id. at *5. The court dismissed this claim
on the ground that it “would be inconsistent with both HIPAA and the Privacy Act’s plain
language” to “recognize under the Privacy Act a private right of action that Congress has
expressly denied under HIPAA.” Id.
In addition, the District Court for the District of Columbia has dismissed a plaintiff’s Privacy Act
claim where the Attorney General invoked the State Secrets Privilege. Edmonds v. DOJ, 323 F.
Supp. 2d 65, 80-82 (D.D.C. 2004), aff’d, 161 F. App’x 6 (D.C. Cir. 2005) (unpublished opinion). The
court explained that “because the . . . documents related to the plaintiff’s employment,
termination and security review that comprise the system of records are privileged, and
because the plaintiff would be unable to depose witnesses whose identities are privileged or to
otherwise identify through discovery the individual or individuals who purportedly released the
privileged information, the plaintiff is . . . unable to proceed with her Privacy Act claims.” Id. at
81.
Courts may order expungement as equitable relief in actions under the Privacy Act or for
Constitutional violations.
Several courts, including the Unites States Court of Appeals for the District of Columbia Circuit,
have held that a court may order equitable relief in the form of the expungement of records
either in an action under the Privacy Act or in a direct action under the Constitution. See, e.g.,
Abdelfattah v. DHS, 787 F.3d 524, 284-285 (D.C. Cir. 2015); Doe v. Air Force, 812 F.2d 738, 741
(D.C. Cir. 1987); Smith v. Nixon, 807 F.2d 197, 204 (D.C. Cir. 1986); Hobson v. Wilson, 737 F.2d 1,
65-66 (D.C. Cir. 1984), overruled in part on other grounds, Leatherman v. Tarrant Cnty. Narcotics
Intel. & Coord. Unit, 507 U.S. 163 (1993); Ezenwa v. Gallen, 906 F. Supp. 978, 986 (M.D. Pa. 1995);
cf. Shearson v. Holder, 725 F.3d 588, 595 (6th Cir. 2013) (refusing to entertain plaintiff’s
argument that court should “use its equitable powers to expunge all the government records
held by the Terrorist Screening Center that supported its placement of [plaintiff] in the terrorist
databases” as court had no information about what those documents hold; affirming district
court and finding it reasonable for plaintiff to exhaust administrative remedies under Traveler
Redress Program); Dickson v. OPM, 828 F.2d 32, 41 (D.C. Cir. 1987) (suggesting that it is not
resolved “whether as a general proposition the Privacy Act defines the scope of remedies
available under the Constitution”); Clarkson v. IRS, 678 F.2d 1368, 1376 n.13 (11th Cir. 1982)
(clarifying that court “[did] not intend to suggest that the enactment of the Privacy Act in any
way precludes a plaintiff from asserting a constitutional claim for violation of his privacy or First
Amendment rights. Indeed, several courts have recognized that a plaintiff is free to assert both
Privacy Act and constitutional claims.”). See also the discussion of expungement of records
under “5 U.S.C. § 552a(g)(1)(A) - Amendment Lawsuits,” above.
Finally, the courts have split over whether to grant class certifications in Privacy Act cases. For
cases in which courts granted class certifications for claims brought under the Privacy Act, see
Calvillo Manriquez v. DeVos, Case No. 17-cv-07210-SK, 2018 WL 5316175 (N.D. Cal. Oct. 15,
2018); Rice v. United States, 211 F.R.D. 10, 14 (D.D.C. 2002); Fort Hall Landowners Alliance, Inc. v.
BIA, No. 99-052, slip op. at 10 (D. Idaho Aug. 16, 2002); Baker v. Runyon, No. 96-2619, 1997 WL
232606, at *4 (N.D. Ill. May 2, 1997); and Ingerman v. IRS, No. 89-5396, 1990 WL 10029523, at *2
(D.N.J. July 16, 1990). For cases in which courts denied class certifications for claims brought
under the Privacy Act, see Doe v. Chao, 306 F.3d 170, 184 (4th Cir. 2002), aff’d on other grounds,
540 U.S. 614 (2004); Fort Hall Landowners Alliance, Inc. v. BIA, No. 99-052, 2007 WL 2187256,
at *3 (D. Idaho July 16, 2007); Schmidt v. VA, 218 F.R.D. 619, 637 (E.D. Wis. 2003); and Lyon v.
United States, 94 F.R.D. 69, 76 (W.D. Okla. 1982). For cases involving multiple plaintiffs, see
Covert v. Harrington, 876 F.2d 751, 752 (9th Cir. 1989); Andrews v. VA, 838 F.2d 418, 419 (10th
Cir. 1988); Parks v. IRS, 618 F.2d 677, 679 (10th Cir. 1980); and Romero-Vargas v. Shalala, 907 F.
Supp. 1128, 1131 (N.D. Ohio Oct. 13, 1995).
1. Attorney Fees and Costs

“The court may assess against the United States reasonable attorney fees and other litigation
costs reasonably incurred in any case under this paragraph in which the complainant has
substantially prevailed.” 5 U.S.C. § 552a(g)(2)(B), (g)(3)(B).
“[T]he United States shall be liable to the individual . . .[for] reasonable attorney fees as
determined by the court.” 5 U.S.C. § 552a(g)(4)(B).
Comment:
The Privacy Act is one of many federal statutes containing a “fee-shifting” provision allowing a
prevailing plaintiff to recover attorney fees and costs from the government. It allows for such
fees in both amendment and access suits. 5 U.S.C. §§ 552a(g)(2)(B) (amendment), (g)(3)(B)
(access). The Privacy Act also allows for costs and attorney fees to be recovered in damages
lawsuits, in addition to actual damages. 5 U.S.C. § 552a(g)(4)(B).
“Judgments, costs, and attorney’s fees assessed against the United States under [subsection (g)
of the Privacy Act] would appear to be payable from the public funds rather than from agency
funds.” OMB 1975 Guidelines, 40 Fed. Reg. at 28,949,
https://www.justice.gov/paoverview_omb-75 (citing 28 U.S.C. § 2414 (2018); 31 U.S.C. § 724a
(later replaced during enactment of revised Title 31, but see 31 U.S.C. § 1304 (2018) (first
sentence of former § 724a) and 39 U.S.C. § 409(e) (2018) (last sentence of former § 724a); and
28 U.S.C. § 1924 (2018)).
“5 U.S.C. § 552a(g)(1)(A) - Amendment Lawsuits,” “5 U.S.C. § 552a(g)(1)(B) - Access Lawsuits,” “5

U.S.C. § 552a(g)(1)(C) - Damages Lawsuits for Failure to Assure Fairness in Agency
Determination,” “5 U.S.C. § 552a(g)(1)(D) - Damages Lawsuits for Failure to Comply with Other
Privacy Act Provisions” are discussed in detail in separate sections above.
Pro se litigants, whether or not they are also attorneys, are not entitled to attorney fees for
representing themselves.
The Supreme Court held that a pro se litigant who was also an attorney was not entitled to
recover attorney fees under the fee-shifting provision of the statute authorizing attorney fees in
civil rights suits against the government, 42 U.S.C. § 1988 (2018). Kay v. Ehrler, 499 U.S. 432,
437 (1991); see also Gahagan v. USCIS, 911 F.3d 298, 305 (5th Cir. 2018) (overruling Cazalas v.
DOJ, 709 F.2d 1051 (5th Cir. 1983), and recognizing and applying Kay when ruling that “pro se
attorneys are ineligible for fee awards under FOIA”). Although the Supreme Court in Kay did not
expressly rule on the issue of the award of attorney fees to non-attorney pro se litigants, the
Court recognized that “the Circuits are in agreement . . . that a pro se litigant who is not a lawyer
is not entitled to attorney’s fees” and was “satisfied that [those cases so holding] were correctly
decided.” 499 U.S. at 435.
The Court’s rationale in Kay would seem to preclude an award of fees to any pro se Privacy Act
litigant, as the Court observed that “awards of counsel fees to pro se litigants – even if limited to
those who are members of the bar – would create a disincentive to employ counsel” and that
“[t]he statutory policy of furthering the successful prosecution of meritorious claims is better
served by a rule that creates an incentive to retain counsel in every such case.” Id. at 438; see
also Wilborn v. HHS, No. 91-538, slip op. at 14-16 (D. Or. Mar. 5, 1996) (rejecting argument that
rationale in Kay should be construed as applying only to district court stage of litigation; “policy
of the Privacy Act . . . would be better served by a rule that creates an incentive to retain counsel
at all stages of the litigation, including appeals”), appeal voluntarily dismissed, No. 96-35569
(9th Cir. June 3, 1996); but cf. Smith v. O’Brien, No. 94-41371, 1995 WL 413052, at *2 (5th Cir.
June 19, 1995) (per curiam) (citing Barrett v. Customs, infra, and stating: “Pro se litigants are not
entitled to attorney fees under either the FOIA or the Privacy Act unless the litigant is also an
attorney”).
Indeed, the Court of Appeals for the District of Columbia Circuit summarily affirmed a district
court decision which held that a “nonattorney pro se litigant cannot recover attorney’s fees
under the Privacy Act.” Sellers v. BOP, No. 87-2048, 1993 U.S. Dist. LEXIS 787, at *1 (D.D.C. Jan.
26, 1993), summary affirmance granted, No. 93-5090, 1993 WL 301032 (D.C. Cir. July 27, 1993).
See also Smith v. O’Brien, 1995 WL 413052, at *2 (“Pro se litigants are not entitled to attorney
fees under either the FOIA or the Privacy Act unless the litigant is also an attorney.”); Barrett v.
Customs, 651 F.2d 1087, 1089 (5th Cir. 1981) (denying a non-attorney pro se litigant fees); Riser v.
State, No. 09-3273, 2010 WL 4284925, at *8 (S.D. Tex. Oct. 22, 2010) (citing Barrett and Smith
and denying non-attorney pro se plaintiff’s request for attorney fees); Westendorf v. IRS, No.
3:92-cv-761WS, 1994 WL 714011, at *2 (S.D. Miss. July 7, 1994) (citing Barrett and holding that
non-attorney pro se plaintiff is not entitled to attorney fees because there was no evidence pro
se plaintiff was an attorney), appeal dismissed, No. 94-60503, slip op. at 2-3 (5th Cir. Nov. 17,
1994) (stating that district court’s holding is correct under Barrett).
The D.C. Circuit has further ruled, however, that a plaintiff’s pro se status does not preclude the
recovery of fees for “consultations” with outside counsel. Blazy v. Tenet, 194 F.3d 90, 94 (D.C.
Cir. 1999); see also id. at 98-99 (Sentelle, J., concurring but “writ[ing] separately only to distance
[him]self from the majority’s determination that a pro se litigant is entitled to recover counsel
fees for consultations with attorneys not appearing or connected with appearances in the pro se
litigation”).
The courts are split as to whether courts considering Privacy Act fee claims should consult FOIA
cases.
The subsection (g)(2)(B) and (g)(3)(B) attorney fees provisions for amendment and access suits
under the Privacy Act are similar to 5 U.S.C. § 552(a)(4)(E), the FOIA’s attorney fees provision.
Courts are split regarding whether a court may consult FOIA decisions concerning a plaintiff’s
eligibility for attorney fees when assessing a plaintiff’s eligibility for attorney fees under the
Privacy Act. The D.C. Circuit has expressly ruled that the FOIA’s criteria for determining a
plaintiff’s entitlement to attorney fees are inapplicable to a claim for fees under the Privacy
Act. Blazy, 194 F.3d at 95-97 (“Even a cursory examination of these factors makes it clear that
they have little or no relevance in the context of the Privacy Act.”); see also Herring v. VA, No.
94-55955, 1996 WL 32147, at *5-6 (9th Cir. Jan. 26, 1996) (finding plaintiff to be “prevailing
party” on access claim for her medical record with no mention or application of FOIA criteria);
but see Sweatt v. Navy, 683 F.2d 420, 423 (D.C. Cir. 1982) (stating in dicta that cases construing
whether plaintiffs had “substantially prevailed” for purposes of attorney fee provision in FOIA
are apposite in Privacy Act context, although Blazy court distanced itself from this language).
On the other hand, the Fourth, Fifth, and Tenth Circuit Courts of Appeals have held that the
FOIA’s fee entitlement criteria apply to Privacy Act claims for attorney fees. See Gowan v. Air
Force, 148 F.3d 1182, 1194-95 (10th Cir. 1998) (applying the FOIA’s criteria and determining that
plaintiff was not entitled to fees because his “suit was for his personal benefit rather than for
the benefit of the public interest”); see also Reinbold v. Evers, 187 F.3d 348, 362 (4th Cir. 1999)
(citing Gowan and stating in dicta that if determination is made that plaintiff substantially
prevailed, court must evaluate FOIA factors to determine entitlement); Barrett v. Customs, 651
F.2d at 1088 (stating that FOIA’s guidelines apply to claims for attorney fees under Privacy Act).
Despite the evolution of the “catalyst” theory under the FOIA, the courts have not definitively ruled
on its applicability in Privacy Act cases.
In the FOIA context, the Supreme Court held in 2001 that “the ‘catalyst theory’ is not a
permissible basis for the award of attorney’s fees.” Buckhannon Bd. & Care Home, Inc. v. W. Va.
Dep’t of Health & Human Resources, 532 U.S. 598, 610 (2001). In 2002, the D.C. Circuit followed
that approach, holding that “in order for plaintiffs in FOIA actions to become eligible for an
award of attorney’s fees, they must have ‘been awarded some relief by [a] court,’ either in a
judgment on the merits or in a court-ordered consent decree.” Oil, Chem. & Atomic Workers Int’l
Union v. Energy, 288 F.3d 452, 455-56 (D.C. Cir. 2002) (quoting and applying Buckhannon). This
interpretation of Buckhannon was widely followed for years, with the result that plaintiffs were
denied attorney fees in FOIA cases in which the agency voluntarily disclosed the records at
issue. See, e.g., Union of Needletrades, Indus. & Textile Employees v. INS, 336 F.3d 200, 206 (2d
Cir. 2003); McBride v. Army, No. 06-4082, 2007 WL 1017328, at *3-4 (E.D. La. Mar. 30, 2007);
Poulsen v. Customs & Border Prot., No. 06-1743, 2007 WL 160945, at *1 (N.D. Cal. Jan. 17, 2007);
Landers v. Air Force, 257 F. Supp. 2d 1011, 1012 (S.D. Ohio 2003).
However, Congress amended the FOIA in 2007 to explicitly provide for attorney fees under a
“catalyst theory.” See OPEN Government Act of 2007, Pub. L. No. 110-175, 121 Stat. 2524. The
FOIA now provides that a plaintiff is eligible to obtain attorney fees if records are obtained as a
result of “(I) a judicial order, or an enforceable written agreement or consent decree; or (II) a
voluntary or unilateral change in position by the agency, if the complainant’s claim is not
insubstantial.” 5 U.S.C. § 552(a)(4)(E)(ii), as amended; see also Brayton v. Office of the U.S. Trade
Representative, 641 F.3d 521, 525 (D.C. Cir. 2011) (“The purpose and effect of this law, which
remains in effect today, was to change the ‘eligibility’ prong back to its pre-Buckhannon form.”);
Davis v. DOJ, 610 F.3d 750, 752 (D.C. Cir. 2010) (“Congress enacted the OPEN Government Act of
2007 to establish that the catalyst theory applied in FOIA cases.”).
Although there has not been significant litigation regarding the “catalyst theory” in Privacy Act
fee cases, at least one case arising in the Fourth Circuit, which, as noted above, has explicitly
adopted the FOIA criteria for determinations of entitlement to fees, applied the catalyst theory
in the Privacy Act context. Crockett v. VA, No. 7:17-CV-186, 2018 WL 1684284, at *4 (W.D. Va.
Jan. 19, 2018), report and recommendation adopted Crockett v. VA, No. 7:17-CV-00186, 2018 WL
4550449 (W.D. Va. Sept. 21, 2018) (applying catalyst theory but ultimately concluding that
plaintiff had “not produced evidence that his lawsuit was a catalyst for the VA’s production of
his records” and, therefore, was not eligible to recover attorneys’ fees); cf. Reinbold v. Evers, 187
F.3d at 363 (recognizing without discussing catalyst theory in pre-OPEN Government Act case
but upholding denial of fees where evidence showed that delay was result of staffing shortage
rather than “that [plaintiff’s] lawsuit was a catalyst for the [agency’s] action”); Jacobs v. Reno,
No. 3:97-CV-2698-D, 1999 WL 155708, at *4-5 (N.D. Tex. Mar. 11, 1999) (denying plaintiff’s
request for attorney fees and costs, and stating without using “catalyst theory” terminology
that plaintiff’s argument that his lawsuit caused agency “to comply with the Privacy Act when it
would not otherwise have done so” was “too slim a reed on which to rest” his claim), aff’d, 208
F.3d 1006 (5th Cir. 2000) (unpublished table decision).
The impact of the OPEN Government Act in courts that have not tied the Privacy Act fee
analysis to the FOIA is less clear, given that not many cases have addressed the issue. The D.C.
District Court applied the “catalyst theory” in a case in which the plaintiff sought fees under the
FOIA along with the Privacy Act but ultimately concluded that the plaintiffs had not
“substantially prevailed.” Mobley v. DHS, 908 F. Supp. 2d 42, 45 (D.D.C. 2012); but see Sterrett v.
Navy, No. 09-CV-2083-IEG POR, 2010 WL 330086, at *6 (S.D. Cal. Jan. 20, 2010) (applying
different standards to Privacy Act and FOIA fee claims).
Although not explicitly addressed in the Privacy Act context, enhanced fees to compensate for risk
in contingency fee arrangements generally are not permitted.
Under the FOIA, the D.C. Circuit had previously held that a fee enhancement as compensation
for the risk in a contingency fee arrangement might be available in limited circumstances. See,
e.g., Weisberg v. DOJ, 848 F.2d 1265, 1272 (D.C. Cir. 1988). The Supreme Court has clarified,
however, that such enhancements are not available under statutes authorizing an award of
reasonable attorney fees to a prevailing or substantially prevailing party. City of Burlington v.
Dague, 505 U.S. 557, 561-66 (1992) (prohibiting contingency enhancement in environmental
fee-shifting statutes). The Court further observed that case law “construing what is a
‘reasonable’ fee applies uniformly to all [federal fee-shifting statutes].” Id. In light of this
observation, there seems to be little doubt that the same principle also prohibits fee
enhancements under the Privacy Act. Id. at 562; see also King v. Palmer, 950 F.2d 771, 775 (D.C.
Cir. 1991) (en banc) (Silberman, C.J., concurring).
Courts appear to differ as to whether attorney fees and costs can be recovered even without a
showing of “actual damages.”
The Fourth Circuit held in a damages lawsuit brought under the Privacy Act, that “[t]he face of
[subsection (g)(4)] leaves no room for confusion on this point” and “does not require a showing
of actual damages . . . in order to receive costs and reasonable attorney fees.” Doe v. Chao, 435
F.3d 492, 495-96 (4th Cir. 2006). The Fourth Circuit further explained that “the word ‘sum’ – as
it is used in [subsection (g)(4)] – requires a court to fulfill the simple act of adding actual
damages and fees and costs once the preceding elements of the statute are satisfied,” and
therefore, plaintiff who establishes violation but does not recover damages is eligible for
attorney fees. Id. In reaching its decision, the Fourth Circuit rejected the government’s
argument that the Supreme Court had reached a contrary conclusion. Id. at 497, citing Doe v.
Chao, 540 U.S. at 625 n.9. The Fourth Circuit Court of Appeals analyzed the Supreme Court’s
footnote in Doe v. Chao and concluded that “in no place did the [Supreme Court] purport to
interpret § 552a(g)(4)(B)”; instead, “The Supreme Court’s phrase . . . means nothing more than
the obvious fact that the Government cannot be liable for actual damages if there are no actual
damages.” 435 F.3d at 497.
Although a subsequent decision of the District Court of the District of Columbia questioned the
Court Circuit’s conclusion, it did so in dicta. Rice v. United States, 245 F.R.D. 3, 7 n.6 (D.D.C.
2007) (“There is some question as to whether plaintiffs could recover costs and reasonable
attorney fees under section 552a(g)(4) even without showing actual damages. . . As Judge
Michael’s dissent in [Doe v. Chao, 435 F.3d at 507] points out, however, the Supreme Court’s
[opinion in Doe v. Chao, 540 U.S. at 625 n.9] appears to foreclose such a recovery.”).
Attorney fees are only available in amendment cases if the plaintiff has exhausted administrative
remedies; attorney fees are not available for administrative representation.
The D.C. Circuit has held that attorney fees are not available in a subsection (g)(1)(A)
amendment case unless the plaintiff has exhausted his administrative remedies. See Haase v.
Sessions, 893 F.2d 370, 373-75 (D.C. Cir. 1990); Sterrett v. Navy, 2010 WL 330086, at *6 (relying
on Haase in subsection (g)(1)(B) access case and concluding that “a fee award would be
improper because Plaintiff failed to exhaust her administrative remedies”).
Attorney fees are not recoverable for services rendered at the administrative level. See
Kennedy v. Andrus, 459 F. Supp. 240, 244 (D.D.C. 1978), aff’d, 612 F.2d 586 (D.C. Cir. 1980)
(unpublished table decision).
In addition to attorney fees, prevailing plaintiffs can also recover the costs of litigation.
Litigation costs (if reasonably incurred) can be recovered by all plaintiffs who substantially
prevail. See Parkinson v. Comm’r, No. 87-3219, 1988 WL 12121, at *3 (6th Cir. Feb. 17, 1988);
Walker v. DOJ, No. 00-0106, slip op. at 5-6 (D.D.C. July 14, 2000); Young v. CIA, No. 91-527-A, slip
op. at 2 (E.D. Va. Nov. 30, 1992), aff’d, 1 F.3d 1235 (4th Cir. 1993) (unpublished table decision).
Compare Herring, No. 94-55955, 1996 WL 32147, at *5-6 (finding that plaintiff was “a prevailing
party with respect to her access claim” because “the VA did not provide her access to all her
records until she filed her lawsuit”), with Abernethy v. IRS, 909 F. Supp. 1562, 1567-69 (N.D. Ga.
1995) (“[T]he fact that records were released after the lawsuit was filed, in and of itself, is
insufficient to establish Plaintiff’s eligibility for an award of attorneys’ fees.”), aff’d per curiam,
108 F.3d 343 (11th Cir. Feb. 13, 1997) (unpublished table decision). Further, the D.C. Circuit held
that a pro se plaintiff’s claim for litigation costs under the Privacy Act is not limited by 28 U.S.C.
§ 1920 (governing litigation costs generally). Blazy, 194 F.3d at 94-95 (following reasoning of
Kuzma v. IRS, 821 F.2d 930 (2d Cir. 1987) (FOIA case)).
2. Jurisdiction and Venue

“An action to enforce any liability created under this section may be brought in the district court
of the United States in the district in which the complainant resides, or has his principal place of
business, or in which the agency records are situated, or in the District of Columbia. . .” 5 U.S.C.
§ 552a(g)(5).
Comment:
Federal district courts have exclusive jurisdiction over Privacy Act suits.
By its very terms, this section limits jurisdiction over Privacy Act matters to the federal district
courts. 5 U.S.C. § 552a(g)(5). Accordingly, the U.S. Court of Federal Claims does not have
jurisdiction over Privacy Act claims. See, e.g., Parker v. United States, 280 F. App’x 957, 958
(Fed. Cir. 2008) (affirming Court of Federal Claims’ determination that “the Court of Federal
Claims is not the proper forum for such action. . . . district courts have jurisdiction in matters
under the Privacy Act”); Braun v. United States, 144 Fed. Cl. 560, 571 (2019) (“Any claims that
plaintiff wishes to pursue under the Privacy Act can only be brought in a District Court, and
cannot be brought in this court.”); Frazier v. United States, No. 16-1287C, 2016 WL 6583715, at *2
(Fed. Cl. Nov. 1, 2016), aff’d, 683 F. App’x 938 (Fed. Cir. 2017); Madison v. United States, 98 Fed.
Cl. 393, 395 (Fed Cl. 2011); Treece v. United States, 96 Fed. Cl. 226, 232 (Fed. Cl. 2010);
Addington v. United States, 94 Fed. Cl. 779, 784 (Fed. Cl. 2010); Stephanatos v. United States, 81
Fed. Cl. 440, 444 (Fed. Cl. 2008); Agee v. United States, 72 Fed. Cl. 284, 290 (Fed. Cl. 2006); Doe
v. United States, 74 Fed. Cl. 794, 798 (Fed. Cl. 2006). Likewise, neither the Merit Systems
Protection Board nor the U.S. Tax Court has jurisdiction over Privacy Act claims. See, e.g., Carell
v. MSPB, 131 F. App’x 296, 299 (Fed. Cir. 2005); Martin v. Army, No. 00-3302, 2000 WL 1807419,
at *2 (Fed. Cir. Dec. 8, 2000) (per curiam) (MSPB); Minnich v. MSPB, No. 94-3587, 1995 U.S. App.
LEXIS 5768, at *3 (Fed. Cir. Mar. 21, 1995) (per curiam) (MSPB); Strickland v. Comm’r, No. 9799-
95, 2000 WL 274077, at *1 (T.C. Mar. 14, 2000) (U.S. Tax Court). Note, however, that final orders
of the National Transportation Safety Board (NTSB) are reviewed in U.S. courts of appeals
rather than district courts, even where the case in question involves the Privacy Act. See Creed
v. NTSB, 758 F. Supp. 2d 1, 4-8 (D.D.C. 2011) (holding that judicial review provision of
Independent Safety Board Act, 49 U.S.C. § 1153(a), operates to give exclusive jurisdiction to
appropriate U.S. Court of Appeals or Court of Appeals for the District of Columbia Circuit to
review final orders of NTSB).
D.C. Circuit decisions carry great weight in Privacy Act matters.
Because the Privacy Act specifically provides for venue in the District of Columbia, the Privacy
Act decisions of the Court of Appeals for the District of Columbia Circuit are of great
importance. Tyler v. U.S. BOP, 315 F. Supp. 3d 313, 315 n.1 (D.D.C. 2018), aff'd sub nom. Tyler v.
BOP, No. 18-5187, 2019 WL 1752626 (D.C. Cir. Mar. 28, 2019) (“The venue provisions of both
the Privacy Act and the FOIA identify the federal district court in the District of Columbia as a
proper venue for such claims.”)
The text of the Privacy Act specifies the factors courts consider in making venue determinations.
Courts considering venue have weighed the factors specified in the statute: the plaintiff’s place
of residence, the plaintiff’s principal place of business, or the place where agency records are
located. See, e.g., Akutowicz v. United States, 859 F.2d 1122, 1126 (2d Cir. 1988) (finding “only
proper venue for this action is the District of Columbia” where plaintiff resided and worked
continuously in France and agency records were in D.C.); Shallow v. FBI, No. 1:19-CV-229, 2019
WL 2718493, at *2 (E.D. Va. June 27, 2019), aff'd, 788 F. App’x 189 (4th Cir. 2019) (transferring
venue to District of Columbia where plaintiff’s mailing address was there and complaint made
“no mention of Plaintiff having another residential address, a principal place of business, nor
where the alleged agency records may be located”); Schneider v. Brennan, No. 15-CV-263-JDP,
2016 WL 29642, at *3 (W.D. Wis. Jan. 4, 2016) (transferring venue to district in which “relevant
agency records” and employees involved in case were located); Doe v. Army, 99 F. Supp. 3d 159,
161 (D.D.C. 2015) (“Privacy Act cases may be brought where the plaintiff ‘resides, or has his
principal place of business, or [where] the agency records are situated, or in the District of
Columbia.’”); Echols v. Morpho Detection, Inc., No. C 12-1581, 2013 WL 1501523, at *6 (N.D. Cal.
Apr. 11, 2013) (finding venue was improper because plaintiff resided and was employed in
another district and records were in Washington, D.C. or Virginia, and finding that doctrine of
pendent jurisdiction does not apply to special venue statutes like Privacy Act that specify
proper venue); Budik v. United States, No. 09-3079, 2011 U.S. Dist. LEXIS 74655, at *4 (D. Md.
July 11, 2011) (transferring Privacy Act claim to District of Columbia, where plaintiff resided and
“where the records at issue were created and stored”; adding that “the United States District
Court for the District of Columbia is surely more thoroughly vested in the complex issues
surrounding suits brought against the United States under the Privacy Act than is this Court”);
In re Dep’t of VA Data Theft Litig. v. Nicholson, 461 F. Supp. 2d 1367, 1368-69 (E.D. Ky. 2006)
(explaining that District of Columbia “is a preferable transferee forum for this litigation”
because it is “where likely relevant documents and witnesses may be found, inasmuch as many
of the defendants are located in this district and the theft occurred in the Washington, D.C.,
metropolitan area”); Roberts v. DOT, No. 02-829, 2002 U.S. Dist. LEXIS 14116, at *1-2 (E.D. Pa. July
3, 2003) (transferring venue to Eastern District of New York, as “both plaintiff and the records
are located within [that district]”); Troupe v. O’Neill, No. 02-4157, 2003 WL 21289977, at *3 (D.
Kan. May 9, 2003) (transferring case to Northern District of Georgia as “agency records would
be situated there”); Warg v. Reno, 19 F. Supp. 2d 776, 785 (N.D. Ohio 1998) (transferring case to
District of Columbia in interest of justice where plaintiff resided in Maryland and records were
located in Washington, D.C.); Finley v. NEA, 795 F. Supp. 1457, 1467 (C.D. Cal. 1992) (“[I]n a multi-
plaintiff Privacy Act action, if any plaintiff satisfies the venue requirement of 5 U.S.C. § 552a(g)
(5), the venue requirement is satisfied as to the remaining plaintiffs.”).
Although the Act specifies the D.C. District Court as an appropriate venue, that court at times has
transferred cases elsewhere.
The District Court for the District of Columbia is always a proper venue, but the courts in the
District of Columbia have transferred venue elsewhere when “private and public interest
factors” make another jurisdiction “the more appropriate venue.” See Doe v. Army, 99 F. Supp.
3d at 162; see also Hooker v. NASA, 961 F. Supp. 2d 295, 297 (D.D.C. 2013) (transferring venue
to Maryland where plaintiff lived there, agency was headquartered there, and “other potential
sources of proof, including records” and witnesses were in Maryland).
Similarly, in cases in which the plaintiff filed other claims in addition to a Privacy Act claim, the
courts in the District of Columbia have often concluded that for purposes of judicial economy,
the Privacy Act claim should be heard in the same jurisdiction as the other claims. See, e.g.,
Valerino v. Holder, 20 F. Supp. 3d 203, 206 (D.D.C. 2013) (concluding that Privacy Act claim was
appropriately heard with Title VII claim in the Eastern District of Virginia “in the interests of
justice” because that is where “the relevant conduct occurred,” and “most of the witnesses are
located”); Tildon v. Alexander, 587 F. Supp. 2d 242, 243 n.1 (D.D.C. 2008) (transferring multi-
claim cause of action to Maryland, even though Privacy Act allowed venue in District of
Columbia, because venue for other claims was Maryland and “judicial economy . . . will be
served by transferring this action in its entirety”); Dehaemers v. Wynne, 522 F. Supp. 2d 240,
248-49 (D.D.C. 2007) (concluding that appropriate venue for plaintiff’s Title VII and
Rehabilitation Act claims was Virginia and, although plaintiff’s Privacy Act claims were properly
in District of Columbia, court would not assume pendant jurisdiction over other claims, and
plaintiff could “pursue a single action in [Virginia] either by seeking a dismissal without
prejudice of his Privacy Act claim, or by moving this Court to transfer his Privacy Act claim”);
Boers v. United States, 133 F. Supp. 2d 64, 65 (D.D.C. 2001) (transferring case under 28 U.S.C. §
1404(a) to plaintiff’s “home forum,” even though “venue is proper” in District of Columbia, given
that “[a]ll the operative facts occurred in Arizona” and “it cannot be said that forcing a plaintiff
to litigate in his home district will prejudice or burden the plaintiff in any way”), mandamus
denied per curiam sub nom. In re Howard L. Boers, No. 01-5192 (D.C. Cir. Aug. 28, 2001).
Generally, for plaintiffs who are in prison, the jurisdiction where the plaintiff is incarcerated is the
appropriate venue.
When the plaintiff is incarcerated, most courts have held that the appropriate venue under the
Privacy Act is the jurisdiction where the plaintiff is incarcerated rather than the jurisdiction of
his or her previous domicile. See, e.g., Pinson v. DOJ, 74 F. Supp. 3d 283, 294 (D.D.C. 2014)
(finding that because plaintiff “is currently incarcerated in Colorado, a large portion of the
records and witnesses at issue are located in the state, and . . . because of possible
transportation difficulties,” Privacy Act claim is more appropriately litigated in District of
Colorado); United States v. Barrenechea, No. 94-0206, 2013 WL 3014141, at *2 (N.D. Cal. June 17,
2013) (“Given that Barrenechea is incarcerated in USP-Victorville, coupled with the fact that the
challenged records are alleged to be located there, the Court notes that the Central District of
California, not the Northern District, appears to be the appropriate venue for Barrenechea’s
Privacy Act claims.”); United States v. Cornejo, No. 94-0206, 2013 WL 3052913, at *2 (N.D. Cal.
June 17, 2013) (following Barrenechea); Royer v. BOP, No. 1:10-cv-0146, 2010 WL 4827727, at *4
(E.D. Va. Nov. 19, 2010) (“Royer’s domicile may well be in the Eastern District of Virginia.
However, in light of the fact that he is presently serving a 20-year sentence and is confined in a
federal facility in Colorado, Royer has failed to set forth sufficient information establishing that
he resides in this District for FOIA and Privacy Act purposes.”); Harton v. BOP, No. 97-0638, slip
op. at 3, 6-7 (D.D.C. Nov. 12, 1997) (stating that “the fact that the Privacy Act provides for venue
in the District of Columbia does not, by itself, establish that each and every Privacy Act claim
involves issues of national policy,” and granting agency’s motion to transfer to the jurisdiction
where plaintiff was incarcerated, as complaint focused primarily on issues specific to plaintiff);
but see Pickard v. DOJ, No. C 10-05253, 2011 WL 2199297, at *2-3 (N.D. Cal. June 7, 2011)
(acknowledging that some courts have interpreted comparable venue language under FOIA to
“conclude that residence is where the now-incarcerated defendant was last domiciled” and
“find[ing] more persuasive the cases holding that an individual resides where he is incarcerated,
at least for purposes of FOIA and the Privacy Act,” but transferring case to jurisdiction where
records were located).
One court has concluded that venue should be evaluated at the time the suit is filed.
Although apparently only one court has addressed the issue of whether venue should be
considered at the time the suit was filed or at the time the cause of action arose, that court
concluded that it would follow the general rule that “courts determine venue based on the facts
at the time the suit was filed, not when the cause of action arose.” Schneider v. Brennan, 2016
WL 29642, at *2 (indicating that court “has not found any decision specifically addressing this
question in the context of a Privacy Act claim, but the general rule is widely followed,” and
referencing Daughetee v. CHR Hansen, Inc., No. 09-cv-41, 2011 WL 1113868, at *4 (N.D. Iowa Mar.
25, 2011) (collecting cases)).
3. Statute of Limitations
“An action to enforce any liability created under this section may be brought . . . within two years
from the date on which the cause of action arises, except that where an agency has materially
and willfully misrepresented any information required under this section to be disclosed to an
individual and the information so misrepresented is material to establishment of the liability of
the agency to the individual under this section, the action may be brought at any time within
two years after discovery by the individual of the misrepresentation. Nothing in this section
shall be construed to authorize any civil action by reason of any injury sustained as the result of
a disclosure of a record prior to September 27, 1975.” 5 U.S.C. § 552a(g)(5).
Comment:
Courts have split over whether the Privacy Act’s statement that suits “may be brought . . . within
two years” is jurisdictional.
The Second, Third, Sixth, Seventh, and Tenth Circuit Courts of Appeals and some district courts
have held that the statute of limitations is jurisdictional in nature and have strictly construed it
to be an “‘integral condition of the sovereign’s consent to be sued under the Privacy Act.’”
Bowyer v. Air Force, 875 F.2d 632, 635 (7th Cir. 1989) (quoting Diliberti v. United States, 817
F.2d 1259, 1262 (7th Cir. 1987)); accord Harrell v. Fleming, 285 F.3d 1292, 1293-94 (10th Cir.
2002); Weber v. Henderson, 33 F. App’x 610, 611 (3d Cir. 2002) (per curiam); Davis v. DOJ, 204
F.3d 723, 726 (7th Cir. 2000) (per curiam); Akutowicz v. United States, 859 F.2d 1122, 1126 (2d
Cir. 1988); Davis v. Gross, No. 83-5223, 1984 U.S. App. LEXIS 14279, at *3-4 (6th Cir. May 10,
1984); Hussein v. Sessions, No. 16-cv-780, 2017 WL 1954767, at *4 (D. Minn. May 10, 2017), aff’d
per curiam, 715 F. App’x 585 (8th Cir. 2018); Jagun v. Rodriguez, No. 15-2230, 2016 WL 4124225,
at *8 (D. Md. Aug. 3, 2016); Doe v. FDIC, No. 11 Civ. 307, 2012 WL 612461, at *4 (S.D.N.Y. Feb. 27,
2012); Mauldin v. Napolitano, No. 10-12826, 2011 WL 3113104, at *2 (E.D. Mich. July 26, 2011);
Bassiouni v. FBI, No. 02-8918, 2003 WL 22227189, at *2 (N.D. Ill. Sept. 26, 2003), aff’d on other
grounds, 436 F.3d 712 (7th Cir. 2006); Logan v. United States, 272 F. Supp. 2d 1182, 1187 (D. Kan.
2003); Mangino v. Army, 818 F. Supp. 1432, 1437-38 (D. Kan. 1993), aff’d, 17 F.3d 1437 (10th Cir.
1994) (unpublished table decision). Consequently, a plaintiff’s failure to file suit within the
specified time period has been held to “[deprive] the federal courts of subject matter
jurisdiction over the action.” Diliberti, 817 F.2d at 1262.
However, the courts of appeals “have not unanimously adhered to the view that the Privacy
Act’s statute of limitations is jurisdictional, such that a plaintiff’s failure to file a Privacy Act
claim within the Privacy Act’s limitations period deprives a federal court of subject-matter
jurisdiction over the claim.” Carter v. DOD, No. 16-0786, 2017 WL 2271416, at *8 (D.N.M. Feb. 28,
2017). The Courts of Appeals for the District of Columbia and Ninth Circuits, as well as other
district courts, have concluded that there is a “rebuttable presumption” in favor of equitable
tolling in Privacy Act cases. The D.C. Circuit held that the “‘rebuttable presumption’ in favor of
equitable tolling” in suits against the United States—the general rule announced in Irwin v. VA,
498 U.S. 89, 95 (1990)—applies to the Privacy Act. Chung v. DOJ, 333 F.3d 273, 277 (D.C. Cir.
2003) (overruling Griffin v. Parole Comm’n, 192 F.3d 1081, 1082 (D.C. Cir. 1999) (per curiam)). The
D.C. Circuit concluded that “a Privacy Act claim for unlawful disclosure of personal information
is sufficiently similar to a traditional tort claim for invasion of privacy to render the Irwin
presumption applicable.” Chung, 333 F.3d at 276-77.
Although the D.C. Circuit appeared to limit its holding in Chung to “claim[s] for unlawful
disclosure of personal information,” 333 F.3d at 277, the District Court for the District of
Columbia has relied on Chung in considering equitable tolling in other types of Privacy Act
claims without conducting the “similarity inquiry” articulated in Chung, 333 F.3d at 277, with
respect to the individual claims. See, e.g., Earle v. Holder, 815 F. Supp. 2d 176, 180 (D.D.C. 2011)
(considering apparent (g)(1)(A) and (g)(1)(C) claim, and applying principle that statute of
limitations is subject to equitable tolling “when the plaintiff ‘despite all due diligence . . . is
unable to obtain vital information bearing on the existence of his claim’” (quoting Chung, 333
F.3d at 278)), aff’d per curiam, No. 11-5280, 2012 WL 1450574 (D.C. Cir. Apr. 20, 2012); Bailey v.
Fulwood, 780 F. Supp. 2d 20, 23, 27-28 (D.D.C. 2011) (citing Kursar and Chung for proposition
that Privacy Act statute of limitations “is not a jurisdictional bar,” but ultimately dismissing
apparent (g)(1)(C) claim because “there is no reason in this case to toll the running of the statute
of limitations”); Kursar v. TSA, 751 F. Supp. 2d 154, 165-69 (D.D.C. 2010) (finding (g)(1)(C) claim
not equitably tolled by plaintiff’s MSPB action challenging employment termination), aff’d per
curiam, 442 F. App’x 565 (D.C. Cir. 2011).
The Ninth Circuit also has adopted the Supreme Court’s rebuttable presumption approach from
Irwin and held that Privacy Act claims brought under subsection (g)(1)(D) and based on alleged
violations of subsections (e)(5) and (e)(6) “are sufficiently similar to traditional tort actions such
as misrepresentation and false light to warrant the application of Irwin’s rebuttable
presumption.” Rouse v. State, 567 F.3d 408, 416 (9th Cir. 2009) (amended opinion) (citing
Chung, 333 F.3d at 277). Because the Ninth Circuit agreed with Chung that no aspect of the
Privacy Act “militate[s] against tolling,” the court concluded that “the Irwin presumption has not
been rebutted.” Rouse, 567 F.3d at 416-17. However, the court “decline[d] to decide whether
equitable tolling is warranted on the facts of this case.” Id. at 417. See also Boyd v. United
States, 932 F. Supp. 2d 830, 838 (S.D. Ohio 2013) (interpreting Irwin, the court held that “[i]n the
absence of specific Congressional intent to the contrary, and considering the Privacy Act’s
similarity to privacy actions in tort . . . the Privacy Act’s statute of limitations is a traditional
statute of limitations”); Shearson v. Holder, 865 F. Supp. 2d 850, 867-68 (N.D. Ohio 2011) (noting
the “split in the circuits as to whether the Privacy Act’s statute of limitations is jurisdictional in
nature” but “agree[ing] with the courts that have adopted the Irwin approach and have held that
Privacy Act claims are sufficiently similar to privacy tort claims to trigger the application of the
Irwin rule”); Fort Hall Landowners All., Inc. v. BIA, No. 99-052, slip op. at 6-7 (D. Idaho Mar. 17,
2003) (citing Irwin and finding that the Privacy Act “does not use such language [of jurisdiction],
and therefore does not present a jurisdictional bar”). But see Gonzalez v. United States, No. 18-
cv-21789, 2018 WL 7825025, at *4-5 & n.5 (S.D. Fla. Oct. 11, 2018) (noting circuit split and that
Eleventh Circuit “has not spoken” on jurisdictional issue, and finding no need to decide the
issue); Carter, 2017 WL 2271416, at *12 (stating that “in light of [Irwin], the Court agrees with the
Ninth Circuit’s and the D.C. Circuit’s reasoning that it does not make sense to treat the Privacy
Act’s statute of limitations as a jurisdictional bar” but dismissing claims for lack of subject-
matter jurisdiction because “bound to follow faithfully” Tenth Circuit precedent).
a. Statute of Limitations in Amendment suits
For Privacy Act amendment suits, the statute of limitations period begins when the agency denies
the plaintiff’s request to amend.
In a subsection (g)(1)(A) amendment suits, the limitations period begins when the agency denies
the plaintiff’s request to amend. See Englerius v. VA, 837 F.2d 895, 897-98 (9th Cir. 1988)
(holding that the statute of limitations “commences at the time that a person knows or has
reason to know that the request has been denied,” rather than as of the date of the request
letter); see also Djenasevic v. EOUSA, 319 F. Supp. 3d 474, 482-83 (D.D.C. 2018) (dismissing
amendment claims filed in 2016 on statute of limitations grounds because agency notified
plaintiff of denial of request to amend records in 2011), aff’d per curiam, No. 18-5262, 2019 WL
5390964, at *1 (D.C. Cir. Oct. 3, 2019); Otero v. DOJ, 292 F. Supp. 3d 245, 253 (D.D.C. 2018)
(holding that limitations period began when agency affirmed FBI’s decision to deny amendment
of records), aff’d per curiam, No. 18-5080, 2019 WL 4565497 (D.C. Cir. Sept. 4, 2019); Kursar, 751
F. Supp. 2d at 167 (finding that “the statute of limitations for this claim began running when the
TSA denied [plaintiff’s] amendment request”); Bassiouni, 2003 WL 22227189, at *3-4
(acknowledging distinction as to when claim arises among four distinct Privacy Act causes of
actions and finding that in an amendment cause of action, a claim arises “when an individual
knows or has reason to know that his request to amend has been denied”); Blazy v. Tenet, 979 F.
Supp. 10, 18 (D.D.C. 1997) (citing Englerius and finding that claim for amendment of sexual
harassment allegations in personnel file did not begin to run until employee discovered that FBI,
where plaintiff had applied for employment, never received corrective letter from CIA, prior to
which time plaintiff did not and could not have known of CIA’s failure to amend), summary
affirmance granted, No. 97-5330, 1998 WL 315583, at *1 (D.C. Cir. May 12, 1998). But see
Campeau v. SSA, 575 F. App’x 35 (3d Cir. 2014) (per curiam) (finding that plaintiff was aware of
his alleged injury after knowing SSA received his request and failed to acknowledge receipt
“not later than 10 days (excluding [weekends and holidays]) after receipt,” as required by §
552a(d)(2)(A)); Wills v. OPM, No. 93-2079, slip op. at 2-3 (4th Cir. Jan. 28, 1994) (per curiam)
(holding that cause of action triggers statute of limitations when plaintiff knows or should have
known of alleged violation, which in this case was when plaintiff sent his first letter requesting
amendment); Lee v. FBI, 172 F. Supp. 3d 304, 306-07 (D.D.C. 2016) (“Presumably Plaintiff knew
or had reason to know that the Electronic Communication contained false or inaccurate
information upon receipt of records from the FBI in response to his FOIA request.”); Alexander v.
Mich. Adjutant Gen., 860 F. Supp. 2d 448, 456-57 (W.D. Mich. 2012) (ruling that limitations
period began when plaintiff was terminated “approximately fifteen years prior to filing this
action,” or “[g]iving plaintiff every benefit of the doubt” considering several “other dates that
plaintiff could have claimed to have first ‘known,’” under any of which “plaintiff’s complaint
would have been untimely”); cf. Foulke v. Potter, No. 10-CV-4061, 2011 WL 127119, at *3 n.4
(E.D.N.Y. Jan. 10, 2011) (holding plaintiff must amend complaint to plead Privacy Act amendment
claim, but noting that claim would likely fail “[s]ince the documents which plaintiff seeks to
have corrected were created in 2008, and plaintiff was clearly aware of the purported
inaccuracies in such documents in 2008” where plaintiff never submitted an amendment
request); Reitz v. USDA, No. 08-4131, 2010 WL 786586, at *9-10 (D. Kan. Mar. 4, 2010) (dismissing
amendment claim where plaintiffs had not “specifie[d] any date for the alleged Privacy Act
violations,” and working back from date of court filing, finding that plaintiffs had “not raised a
material question of fact that any Privacy Act violation occurred” within two years prior); Evans
v. United States, No. 99-1268, 2000 WL 1595748, at *2 (D. Kan. Oct. 16, 2000) (finding that
“plaintiff neither knew nor had reason to know of the alleged error in his records until the
receipt of information provided by those witnesses who claimed the [Equal Opportunity]
Complaint Summary inaccurately reported their testimony,” which prompted him to request
“reconsideration and reinvestigation” of information). One district court “f[ound] it troubling
that [a plaintiff] was aware of the existence of allegedly incorrect records in 2002, but waited
until 2009 to request amendment of his records.” Kursar, 751 F. Supp. 2d at 167 n.11.
“Nonetheless, the [c]ourt [was] not aware of any limitations period for seeking an amendment in
a statute or otherwise compelled by binding case authority.” Id. (adding that “an equitable
defense such as laches may be applicable in this instance” but declining to “consider the
defense as it was not raised by” defendant).
Courts generally have held that the agency’s initial denial begins the limitations period, rather than
the date of an agency’s administrative appeal determination.
In determining what constitutes the agency’s denial, it has been held that the agency’s initial
denial should govern, rather than the date of the agency’s administrative appeal determination.
See Quarry v. DOJ, 3 Gov’t Disclosure Serv. (P-H) ¶ 82,407, at 83,020-21 (D.D.C. Feb. 2, 1982); see
also Singer v. OPM, No. 83-1095, slip op. at 2 (D.N.J. Mar. 8, 1984) (rejecting claim that
limitations period began on date plaintiff’s appeal was dismissed as time-barred under agency
regulation); cf. Shannon v. Gen. Elec. Co., 812 F. Supp. 308, 320 & n.10 (N.D.N.Y. 1993) (finding
that cause of action for damages claim arose when plaintiff’s amendment request was partially
denied and noting that “no caselaw can be found to support a finding that the pendency of the
appeal has any affect upon the running of the statute of limitations”).
In cases “[w]here the agency has not issued an express denial of the request, the question [of]
when a person learns of the denial requires a factual inquiry and cannot ordinarily be decided
on a motion to dismiss.” Englerius, 837 F.2d at 897; see also Jarrell v. USPS, 753 F.2d 1088,
1092 (D.C. Cir. 1985) (holding that issue of material fact existed and therefore summary
judgment was inappropriate where agency contended that cause of action arose when it issued
final denial of expungement request but requester argued that due to agency’s excision of
certain parts of documents, he was unaware of information until later point in time); Conklin v.
BOP, 514 F. Supp. 2d 1, 5 (D.D.C. 2007) (denying motion to dismiss as “the date on which plaintiff
knew or had reason to know of the alleged Privacy Act violations is unclear”); Lechliter v. Army,
No. 04-814, 2006 WL 462750, at *3-4 (D. Del. Feb. 27, 2006) (denying motion to dismiss because
“[t]here does not appear to have been a final denial of [plaintiff’s] request” and “there [was],
rather, some question regarding what was said” during a telephone call concerning status of
request); cf. Bowles v. BOP, No. 08 CV 9591, 2010 WL 23326, at *3 (S.D.N.Y. Jan. 5, 2010) (stating
that where “BOP failed to notify the Plaintiff one way or the other” of action on his
administrative appeal, “[t]he troubling failure of the BOP to do their job and respond to
Plaintiff’s claim, as well as the Plaintiff’s right to be made aware of these deadlines by those
that maintain complete control over him are serious, factual questions that would need to be
addressed before the statute of limitations issue could be resolved” but dismissing claim on
other grounds without reaching these considerations).
b. Statute of Limitations in Access suits
For Privacy Act access suits, the statute of limitations period begins when the plaintiff knew, or
should have known, of an agency’s failure to comply with the Privacy Act’s access provision.
Courts have enforced the statute of limitations against plaintiffs in subsection (g)(1)(B) access
lawsuits where the plaintiff did not timely file after he or she knew or should have known of the
violation. See Melvin v. SSA, 126 F. Supp. 3d 584, 603 (E.D.N.C. 2015) (finding plaintiff’s access
claim untimely because plaintiff was aware of violation, at the latest, when she filed response in
prior action stating that agency failed to provide her medical records), aff’d per curiam, 686 F.
App’x 230 (4th Cir. 2017); Zied v. Barnhart, 418 F. App’x 109, 113-14 (3d Cir. 2011) (per curiam)
(concluding that plaintiff “knew of the agency’s alleged errors when defendant . . . sent her a
letter that was unresponsive to her Privacy Act requests and she responded”); Willis v. DOJ, 581
F. Supp. 2d 57, 69 (D.D.C. 2008) (ruling that “[a]pplication of the tolling doctrine is inappropriate
in this case” because plaintiff “had sufficient knowledge” to bring action within limitations
period); Levant v. Roche, 384 F. Supp. 2d 262, 270 (D.D.C. 2005) (concluding that plaintiff knew
or should have known that his access request was denied when Air Force issued final decision
on his Privacy Act and FOIA requests for documents); Bernard v. DOD, 362 F. Supp. 2d 272, 278-
79 (D.D.C. 2005) (determining that it was “clear from the administrative record that the plaintiff
knew or should have known about his ability to request his medical records . . . when he alleged
he was denied them in the hospital at that time”); Logan v. United States, 272 F. Supp. 2d 1182,
1187 (D. Kan. 2003) (finding that plaintiff’s access claim was untimely as claim arose “when [the
agency] disclosed the records to Plaintiff”); McClain v. DOJ, No. 97-0385, 1999 WL 759505, at
*4 (N.D. Ill. Sept. 1, 1999) (finding that action “would have accrued when [plaintiff] knew or
should have known that his request for access to his IRS records had been denied,” which was
more than nine years before he filed suit), aff’d on other grounds, 17 F. App’x 471 (7th Cir. 2001);
Biondo v. Navy, 928 F. Supp. 626, 632, 634-35 (D.S.C. 1995) (stating that 1987 request “cannot
serve as a basis for relief for a suit brought in 1992 because the Privacy Act has a two-year
statute of limitations,” and making similar statements as to undocumented requests for
information made in mid-80s and in 1976-77), aff’d, 86 F.3d 1148 (4th Cir. 1996) (unpublished
table decision); Burkins v. United States, 865 F. Supp. 1480, 1496 (D. Colo. 1994) (holding cause
of action “should not be time-barred” because it would have accrued when plaintiff knew his
request for access had been denied); Mittleman v. Treasury, 773 F. Supp. 442, 448, 450-51 n.7
(D.D.C. 1991) (holding that plaintiff “cannot attempt to resurrect” claims barred by statute of
limitations by making subsequent request more than three years after she had first received
information and almost six months after complaint had been filed).
The only judicial discussion of the Supreme Court’s Irwin presumption of equitable tolling in the
context of an access lawsuit is found in Rouse v. State, 548 F.3d 871, 876-77 (9th Cir. 2008),
amended and superseded by 567 F.3d 408 (9th Cir. 2009). Although the opinion was
superseded (apparently on mootness grounds, see id. at 411 & n.1), the Ninth Circuit determined
that the Irwin rebuttable presumption did not apply to an access claim because it “has no
analog in private litigation.” 548 F.3d at 877-78.
Although the Privacy Act’s two-year statute of limitations applies in subsection (g)(1)(B) access
lawsuits, the FOIA’s 6-year statute of limitations applies to the same access requests processed
under FOIA. See Spannaus v. DOJ, 824 F.2d 52, 55-56 (D.C. Cir. 1987) (concluding that 28 U.S.C.
§ 2401(a)’s six-year statute of limitations applies to FOIA actions), overruled on other grounds by
Jackson v. Modly, 949 F.3d 763, 778 (D.C. Cir. 2020) (holding “that § 2401(a)’s time bar is
nonjurisdictional and . . . [o]ur decisions to the contrary, see, e.g., Spannaus, 824 F.2d at 55, are
thus overruled.”), petition for cert. filed (July 10, 2020) (No. 20-19); FOIA Guide, Litigation
Considerations at 13, https://www.justice.gov/oip/doj-guide-freedom-information-act-0

(recognizing six-year statute of limitations); see also H.R. Rep. No. 98-726, pt. 2, at 16-17 (1984),
reprinted in 1984 U.S.C.C.A.N. 3741, 3790-91 (noting amendment of Privacy Act in 1984 to
include subsection (t)(2) and stating: “Agencies that had made it a practice to treat a request
made under either [the Privacy Act or the FOIA] as if the request were made under both laws
should continue to do so.”).
c. Statute of Limitations in Damages claims
For Privacy Act damages suits, the statute of limitations period begins when the plaintiff knew, or
should have known, of an agency’s violation of the Privacy Act.
In damages claims, courts have deemed the statute of limitations to begin running at the time
the plaintiff knew or should have known of the agencies Privacy Act violation. See, e.g.,
Chichakli v. Tillerson, 882 F.3d 229, 234 (D.C. Cir. 2018); Powell v. Donahoe, 519 F. App’x 21, 23
(2d Cir. 2013) (finding cause of action accrued when plaintiff “had actual knowledge of the
release of his records”); Jackson v. Shinseki, 526 F. App’x 814, 816 (10th Cir. 2013) (holding
improper disclosure claims were untimely as “Plaintiff was admittedly aware of these
disclosures when his wife ‘filed his military psychiatric records in a state divorce action’”);
Burnam v. Marberry, 313 F. App’x 455, 456 (3d Cir. 2009) (per curiam) (“cause of action under
the Privacy Act arises when the individual either knew or had reason to know of the alleged
error in maintaining the individual’s records and the individual was harmed by the alleged
error.”); Shehee v. DEA, No. 05-5276, 2006 U.S. App. LEXIS 15586, at *2 (D.C. Cir. June 14, 2006)
(per curiam); Duncan v. EPA, 89 F. App’x 635, 635 (9th Cir. 2004); Williams v. Reno, No. 95-5155,
1996 WL 460093, at *1 (D.C. Cir. Aug. 7, 1996) (per curiam); Tijerina v. Walters, 821 F.2d 789, 797-
98 (D.C. Cir. 1987); Smith v. United States, 142 F. App’x 209, 210 (5th Cir. 2005) (per curiam)
(affirming that “under section 552a(g)(5) of the Privacy Act, . . . a cause of action accrues when
the plaintiff knew or should have known of the alleged violation”); Green v. Westphal, 94 F.
App’x 902, 904 (3d Cir. 2004) (“A cause of action arises under the Privacy Act when the
individual knows or has reason to know of the alleged error in the individual’s record and the
individual is harmed by the alleged error.”); Bergman v. United States, 751 F.2d 314, 316-17 (10th
Cir. 1984) (holding that limitations period for damages action under subsection (g)(1)(C)
commences at time three conditions are met: (1) an error was made in maintaining plaintiff’s
records; (2) plaintiff was wronged by such error; and (3) plaintiff either knew or had reason to
know of such error); Gonzalez, 2018 WL 7825025, at *5 (finding that plaintiff “pled with
adequate plausibility that due to the Agencies’ improper management of records and
misleading communications to third parties, Plaintiff was denied credit in December 2016 in
violation of the Privacy Act, well within the Act’s two-year limitations period”); Conway v.
Pompeo, No. 1:16-cv-1087, 2018 WL 8800525, at *6-7 (E.D. Va. Sept. 17, 2018) (finding plaintiff’s
claim untimely because she knew of alleged violation, at the latest, when she filed second EEO
grievance concerning “purported misprocessing of her retirement”), aff’d per curiam sub nom.
Conway v. Haspel, 773 F. App’x 693 (4th Cir. 2019); Ashbourne v. Hansberry, 302 F. Supp. 3d
338, 347-48 (D.D.C. 2018) (denying motion to dismiss on statute of limitations grounds where
defendants failed to “point to any specific allegation in the complaint that is timebarred”); Ricks
v. United States, No. 17-cv-1016, 2018 WL 454455, at *5 (S.D. Cal. Jan. 17, 2018) (finding that
plaintiff became aware of agency’s disclosure of his medical and private information outside of
the limitations period); Sabatini v. Price, No. 17-cv-1597, 2018 WL 1449416, at *3 (S.D. Cal. Jan. 16,
2018) (inferring that plaintiff knew of the alleged violations in early 2013 because February
2013 letter indicated that plaintiff retained counsel regarding request for removal of report);
Carter, 2017 WL 2271416, at *11 (holding statute of limitations began to run when plaintiff
discovered entry of allegedly false entry in his medical history); Jagun v. Rodriguez, 2016 WL
4124225, at *8; Gonzalez-Lora v. DOJ, 169 F. Supp. 3d 46, 53 (D.D.C. 2016) (stating that “even if
res judicata and collateral estoppel do not bar plaintiff’s claim, . . . allege[d] violations of . . . the
Privacy Act arising from the DEA’s response to the 2000 FOIA request” are outside the two-year
statute of limitations); Agelli v. Burwell, 164 F. Supp. 3d 69, 75-76 (D.D.C. 2016) (finding that
limitations period began when plaintiff received email from agency on October 2, 2014, the date
of inquiry notice, rather than on the date she claimed to have first read the email); Marley v.
Donahue, 133 F. Supp. 3d 706, 718 (D.N.J. 2015) (finding that, although complaint did not provide
basis for Privacy Act claim or identify improperly disclosed record, Privacy Act claim was
untimely even if agency disclosed record on date of plaintiff’s resignation); Melvin, 126 F. Supp.
3d at 603 (finding plaintiff’s claims regarding false statements in evaluation accrued when she
received a copy of the evaluation); Jarrell v. McDonald, No. 3:15-cv-187, 2015 WL 4720607, at *3-
4 (S.D. Ohio Aug. 7, 2015) (finding plaintiff knew of errors in his military personnel file more than
two years before filing where plaintiff had previously filed lawsuits relating to the records);
Gibson v. Holder, No. 3:14cv641, 2015 WL 5635125, at *7 (magistrate’s recommendation) (finding
that Privacy Act claims filed in 2014 were time-barred based on allegations in complaint that, in
1999, plaintiff obtained documents in his security investigation file that he described as “‘full of
outright lies, blatant distortions of facts, . . . and a host of other irregularities’”), adopted, 2015
WL 5634596 (N.D. Fla. Sept. 23, 2015); Green v. Probation Office, No. 1:14 CV 2265, 2015 WL
2129521, at *2-3 (N.D. Ohio May 5, 2015) (finding “clearly plaintiff knew or had reason to know of
the alleged violation as of 1995” when plaintiff sent letters and received response stating that
presentence report could not be amended after the final version was filed with the court);
Atkins v. Mabus, No. 12CV1390, 2014 WL 2705204, at *3-5 (S.D. Cal. June 13, 2014) (discussing
statute of limitations for various claims of “inappropriate safeguards” to protect confidentiality
of plaintiff’s medical condition and improper disclosure), rev’d and remanded on other grounds,
654 F. App’x 878 (9th Cir. 2016); Jarrell v. Nat’l Pers. Recs. Ctr., No. 3:11cv00434, 2013 WL
5346483, at *8-9 (recommending defendant’s summary judgment motion be granted as
plaintiff’s claims were time-barred; “Because [plaintiff] raised his record-tampering allegations
and claims in his June 1994 Complaint, there is no genuine dispute that by June 1994, [plaintiff]
knew, or had reason to know, about the alleged records tampering of which he now complains.”)
(magistrate’s recommendation), adopted, 2013 WL 5773930 (S.D. Ohio Oct. 24, 2013); Brockway
v. VA Conn. Healthcare Sys., No. 3:10-CV-719, 2012 WL 2154263, at *13-14 (D. Conn. June 13,
2012) (dismissing claim as time-barred as plaintiff “was [] on notice that a possible disclosure of
his VA medical records had occurred” when “a non-VA doctor” called “asking if [plaintiff] would
like to receive psychotherapy from him” “well outside the requisite two-year statute of
limitations”); Toolasprashad v. BOP, No. 09-0317, 2009 WL 3163068, at *2 (D.D.C. Sept. 29, 2009)
(finding Privacy Act claim time-barred because plaintiff filed it more than two years after final
agency action); cf. Bowyer v. Air Force, 875 F.2d 632, 636 (7th Cir. 1989) (applying stricter
standard and holding that the limitations period begins to run when “‘plaintiff first knew or had
reason to know that the private records were being maintained’” (quoting Diliberti v. United
States, 817 F.2d 1259, 1262-64 (7th Cir. 1987)); Brunotte v. Johnson, 892 F. Supp. 2d 199, 206
(D.D.C. 2012) (explaining that because “Plaintiff became aware of the email disclosure [on March
10, 2006]; and, regardless of whether she knew or should have known that the email was
disseminated to [others] in addition to the [individuals she was aware of], Plaintiff attained the
necessary knowledge of an alleged Privacy Act violation on that date”); Leibenguth v. United
States, No. 08-CV-6008, 2009 WL 3165846, at *3 (W.D.N.Y. Sept. 29, 2009) (concluding that
plaintiff’s claim for damages “based on the VA’s failure to disclose his medical records in a
timely fashion” was time-barred because he filed it more than two years after he became aware
of denial of his claim for disability benefits).
Some courts have held that once the plaintiff knows or has reason to know of a record’s
existence, even if based upon hearsay or rumors, the plaintiff has a “duty to inquire” into the
matter – i.e., “two years from that time to investigate whether sufficient factual and legal bases
existed for bringing suit.” See Bowyer, 875 F.2d at 637; see also Diliberti, 817 F.2d at 1263-64
(stating that “[t]he hearsay and rumors which the plaintiff described in his affidavit were enough
to put him on notice . . . and to impose upon him a duty to inquire into the veracity of those
rumors”); Mangino, 818 F. Supp. at 1438 (quoting Diliberti).
Generally, the plaintiff knows or has reason to know of records in violation of the Privacy Act
when the plaintiff suspects there is a violation rather than when the plaintiff actually possesses
those records or when the government creates those records. See Diliberti, 817 F.2d at 1262
(stating that “relevant fact is not when the plaintiff first had physical possession of the
particular records, but rather when he first knew of the existence of the records”); see also
Duncan, 89 F. App’x at 636 (reasoning that “a certainty, or testimony under oath, is not required
to begin the running of the limitations period, but rather ‘what a reasonable person should have
known’” (quoting Rose v. United States, 905 F.2d 1257, 1259 (9th Cir. 1990))).
Generally, constructive notice of the possible violation triggers the statute of limitations for
damages claims.
If the plaintiff has constructive notice of the possible violation, the statute of limitations is
triggered. See Diliberti, at 1262-63; see also Bowyer, 875 F. 2d at 636 (stating that when
agency employee confirmed that agency maintained private records on plaintiff relating to
previous conflict with his supervisor, he had sufficient notice of possibly erroneous records). In
the context of a damages action for wrongful disclosure, the D.C. Circuit rejected the
government’s argument that the limitations period commenced when the contested disclosure
occurred, and observed that such an unauthorized disclosure “is unlikely to come to the
subject’s attention until it affects him adversely, if then.” Tijerina, 821 F.2d at 797. But cf. Hill v.
N.Y. Post, No. 08 Civ. 5777, 2010 WL 2985906, at *3 (S.D.N.Y. July 29, 2010) (explaining that
claim brought “against the unnamed BOP staff for revealing private information regarding
[plaintiff] contained in his records . . . accrued . . . upon the publication of the articles describing
[plaintiff’s] affair”).
Consistent with the constructive notice theory, other courts have similarly found that the
statute of limitations began to run where the evidence or circumstances indicated that the
plaintiff knew of the violation or had been affected by it. See Jackson v. Shinseki, 526 F. App’x
at 817 (holding that plaintiff was put “on notice of his … claim, that Defendants failed to
maintain his medical records in a way to ensure the fairness of his discharge” when defendant
informed him that agency did not “‘have a copy of [the] psychiatric evaluation’ from his private
psychiatrist that led to his ability to return to work”); Zied, 418 F. App’x at 113-14 (ruling that
plaintiff “knew of the harm caused by” alleged inaccuracies in her SSA records, at the very
latest, “when her eligible child benefits were stopped”); Lockett v. Potter, 259 F. App’x 784, 787
(6th Cir. 2008) (“EEOC hearings that took place in March 2002 and April 2003, which addressed
[plaintiff’s] complaints that the Postal Service’s manner of storing and disseminating his records
violated the Privacy Act . . . demonstrate that he knew about the alleged Privacy Act violation
more than two years before his March 2006 filing of his complaint.”); Harrell, 285 F.3d at 1293-
94 (finding that the “limitations period began to run when [plaintiff] first became aware of the
alleged errors in his presentence investigation reports” and that it was not “extended either by
the government’s subsequent actions or by his receipt of documents allegedly corroborating his
assertions of error”); Weber v. Henderson, 33 F. App’x at 612 (finding plaintiff “knew that the
entire file had been lost . . . when he was informed by the defendants in writing that the record
had been misplaced”); Seldowitz v. OIG of State, 238 F.3d 414, at *3 (4th Cir. 2000) (per curiam)
(unpublished table case) (following Tijerina and finding that statute of limitations began to run
when plaintiff “had actual knowledge of the alleged error,” even though he did not possess copy
of them to make side-by-side comparison with annotated ones); Todd v. Holder, 872 F. Supp. 2d
1284, 1291 (N.D. Ala. 2012) (stating that [plaintiff] filed this action . . . approximately three and a
half years after” alleged claims of wrongful disclosures to Office of Inspector General); Doe v.
FDIC, No. 11 Civ. 307, 2012 WL 612461, at *5 (S.D.N.Y. Feb. 27, 2012) (dismissing claims for
unlawful disclosure as time-barred where plaintiff had sent e-mail to her supervisor more than
two years before filing suit in which she stated that agency had disclosed her medical
information in possible violation of Privacy Act); Shearson, 865 F. Supp. 2d at 869 (concluding
that “filings in [that case] demonstrate that Plaintiff should have known of alleged violations” at
that time where plaintiff had submitted brief in prior case); Bailey v. Fulwood, 780 F. Supp. 2d
20, 27-28 (D.D.C. 2011) (concluding that plaintiff knew or should have known that agency had
relied on a “subsequently dismissed” warrant in determining whether to grant him parole when
plaintiff received “denial notice” that “specifically informed Plaintiff that [the agency’s] decision
was partially based on” that warrant); Jones v. BOP, No. 5:09-cv-216, 2011 WL 554080, at *2 (S.D.
Miss. Feb. 7, 2011) (reasoning that federal prisoner “must have known no later than 2006 that his
[presentence investigation report] included the [disputed] charge” because “he began pursuing
his administrative remedies with respect to the [report] in 2006”); Ramey v. USMS, 755 F. Supp.
2d 88, 97-98 (D.D.C. 2010) (dismissing as time-barred claim alleging violation of subsection (e)
(7) “to the extent [it] encompasses the Defendant’s collection and maintenance of information
regarding [contractor’s] 2003 investigation” of plaintiff, during which plaintiff was interviewed
by contractor); Kursar, 751 F. Supp. 2d at 167-68 (“[P]laintiff knew, or should have known, of the
purported inaccuracies by as early as April 25, 2002,” because he “received notification on April
25, 2002, that the TSA intended to terminate him for ‘submitting false or incorrect information
on his employment application and Standard Form 86’” and because he “acknowledged receipt
of this [notification]”); Reitz v. USDA, No. 08-4131, 2010 WL 786586, at *9, *11 (D. Kan. Mar. 4,
2010) (dismissing claims filed in 2008 because “[m]ost of the plaintiffs’ letters in the record
allege continuing ill effects from [Privacy Act] violations occurring in 1997 or other dates before
2006”); Gard v. Dep’t of Educ., 691 F. Supp. 2d 93, 99 (D.D.C. 2010) (finding that plaintiff
“became aware of the alleged violation” when he “expressed his belief that his . . . records had
been destroyed in a declaration to the U.S. Office of Special Counsel”), summary affirmance
granted per curiam, No. 11-5020, 2011 WL 2148585 (D.C. Cir. May 25, 2011); Ramirez v. DOJ, 594
F. Supp. 2d 58, 62-64 (D.D.C. 2009) (dismissing complaint filed in 2007 as time-barred because
in 2004 plaintiff “notified the prosecutors, the probation officer, and the presiding judge at
sentencing of inaccuracies in the [presentence investigation report]”), aff’d per curiam on other
grounds, No. 10-5016, 2010 WL 4340408 (D.C. Cir. Oct. 19, 2010); Sims v. New, No. 08-cv-00794,
2009 WL 3234225, at *4 (D. Colo. Sept. 30, 2009) (concluding that clock began in April 2002
even though plaintiff did not receive letter containing inaccuracy until December 2005, where
plaintiff learned of inaccuracy in April 2002 and was informed shortly thereafter that the
inaccuracy was the basis for adverse determination); Joseph v. Cole, No. 5:07-CV-225, 2007 WL
2480171, at *2 (M.D. Ga. Aug. 27, 2007) (barring accuracy lawsuit where plaintiff inmate
admitted that he knew of errors in his presentence report when it was adopted by court thirteen
years prior to filing of suit); Ingram v. Gonzales, 501 F. Supp. 2d 180, 184-85 (D.D.C. 2007)
(finding that prisoner’s claim accrued “when he discovered that the erroneous career offender
finding [in his presentence report] was being used by BOP to determine his custody
classification,” not at time of his sentencing); Counce v. Nicholson, No. 3:06cv00171, 2007 WL
1191013, at *14-15 (M.D. Tenn. Apr. 18, 2007) (barring subsection (b)/(g)(1)(D) claim where plaintiff
first complained of Privacy Act violations to EEO counselor in November 2003 but did not file
suit until February 2006); Kenney v. Barnhart, No. 05-426, 2006 WL 2092607, at *11-12 (C.D. Cal.
July 26, 2006) (finding claim untimely because plaintiff filed it more than two years after he
complained to SSA of inaccuracies in his credit reports, which were allegedly based on
inaccuracies in SSA records); Peterson v. Tomaselli, No. 02 Civ. 6325, 2003 WL 22213125, at *8
(S.D.N.Y. Sept. 29, 2003) (finding that plaintiff’s claim arose when he “knew that the false
documents existed”); Fort Hall Landowners All., Inc., No. 99-052, slip op. at 5 (finding that
plaintiffs’ “claim accrued as soon as Plaintiffs either were aware, or should have been aware, of
the existence of and source of injury, not when the Plaintiffs knew or should have known that
the injury constituted a legal wrong”); Farrero, 180 F. Supp. 2d at 97 (finding that plaintiff
should have known of potential violation when agency specifically informed him that it was
maintaining certain documents regarding his alleged misconduct); Walker v. Ashcroft, No. 99-
2385, 2001 U.S. Dist. LEXIS 27213, at *17 (D.D.C. Apr. 30, 2001) (“Contrary to Plaintiffs’
contention, the record establishes that Plaintiffs were aware of the FBI’s actions well before
they received this report.”), summary affirmance granted per curiam, No. 01-5222, 2002 U.S.
App. LEXIS 2485 (D.C. Cir. Jan. 25, 2002); Villescas v. Richardson, 124 F. Supp. 2d 647, 659 (D.
Colo. 2000) (finding the statute of limitations began to run when plaintiff received declaration in
another lawsuit describing disclosure of records, even though he did not receive actual
documents); Armstrong v. BOP, 976 F. Supp. 17, 21-22 (D.D.C. 1997) (following Tijerina and
finding plaintiff’s claim barred by statute of limitations where plaintiff had written letter more
than two and one-half years earlier indicating that her prison file was lacking favorable
information), summary affirmance granted per curiam, No. 97-5208, 1998 WL 65543 (D.C. Cir.
Jan. 30. 1998); Nwangoro v. Army, 952 F. Supp. 394, 397-98 (N.D. Tex. 1996) (“[T]he limitations
period commences not when the plaintiff first obtains possession of the particular records at
issue, but rather when he first knew of their existence.”); Brown v. VA, No. 94-1119, 1996 WL
263636, at *1-2 (D.D.C. May 15, 1996) (holding Privacy Act claim barred by statute of limitations
because plaintiff “knew or should have known that the Privacy Act may have been violated”
when he submitted federal tort claim to VA concerning same matter “over two and a half years”
before suit filed); Gordon v. DOJ, No. 94-2636, 1995 WL 472360, at *2 (D.D.C. Aug. 3, 1995)
(finding statute of limitations ran from time of plaintiff’s receipt of letter from sentencing judge
rejecting information contained in presentencing report, at which point plaintiff “knew or . . .
should have known what became inaccuracies in his presentencing report”); Rice v. Quinlan, No.
94-1519, slip op. at 2-3 & n.1 (D.D.C. Dec. 30, 1994) (holding plaintiff knew of contents of
presentence report at time he filed “Objection to Presentence Investigation Report,” at which
time statute of limitations began to run), summary affirmance granted per curiam sub nom. Rice
v. Hawk, No. 95-5027, 1995 WL 551148 (D.C. Cir. Aug. 2, 1995); Szymanski, 870 F. Supp. at 378-
79 (citing Bergman and Tijerina, and stating that “[b]ecause plaintiff was given the opportunity
to review the documents he now maintains contain incorrect information and waived that
opportunity, the Court finds that he should have known about any errors at the time of this
waiver” but that, additionally, plaintiff had complained about same information in his appeal to
Parole Commission more than two years previously); Malewich v. USPS, No. 91-4871, slip op. at
21-22 (D.N.J. Apr. 14, 1993) (finding statute began to run when plaintiff was aware that file was
being used in investigation of plaintiff and when he was notified of proposed termination of
employment), aff’d, 27 F.3d 557 (3d Cir. 1994) (unpublished table decision); Mangino, 818 F.
Supp. at 1437-38 (applying Bergman, Bowyer, and Diliberti, and finding that cause of action
accrued on date of letter in which plaintiff indicated knowledge of records being used by
agency as basis for revoking his security clearance, rather than upon his receipt of records);
Ertell v. Army, 626 F. Supp. 903, 908 (C.D. Ill. 1986) (finding limitations period commenced when
plaintiff “knew . . . that there had been negative evaluations in his file which ‘may explain why he
is not being selected;’” rather than upon actual discovery of such records); cf. Doe v. NSA, No.
97-2650, 1998 WL 743665, at *1-3 (4th Cir. Oct. 23, 1998) (per curiam) (citing Rose and Diliberti,
and holding that appellant’s wrongful disclosure claim was time-barred because in accordance
with principles of agency law, Privacy Act action accrued from time her attorney received her
records).
Some courts, however, have construed the beginning of the statute of limitations period from other
points, including when an individual discovers the inaccuracy or mishandling of the record,
receives a Privacy Act notice, or becomes aware that an apparently untimely complaint “relates
back” to a timely one.
In contrast to the constructive notice theory adopted by many courts, some courts have
suggested that the limitations period for a subsection (g)(1)(C) damages action would
commence when a plaintiff actually receives his record – i.e., when he actually discovers the
inaccuracy. See Akutowicz v. United States, 859 F.2d 1122, 1126 (2d Cir. 1988) (noting that “the
latest possible time before which [plaintiff] could commence his suit was . . . two years after his
discovery of the alleged misrepresentation in his record (i.e., the date when he received a copy
of his record from the Department of State”)); see also Rose v. United States, 905 F.2d 1257,
1259 (9th Cir. 1990) (holding that subsection (g)(1)(C) action accrued when plaintiff “became
aware of the alleged mishandling of her records on . . . the date she received copy of her
compensation file”); Lepkowski v. Treasury, 804 F.2d 1310, 1322-23 (D.C. Cir. 1986) (Robinson, J.,
concurring) (holding that subsection (g)(1)(C) action “accrued no later than the date upon which
[plaintiff] received IRS’ letter . . . apprising him of destruction of the photographs and associated
workpapers”); Middlebrooks v. Mabus, No. 1:11cv46, 2011 WL 4478686, at *4-5 (E.D. Va. Sept. 23,
2011) (finding that plaintiff “first learned of the alleged inaccuracies in her personnel record on .
. . the date she received the Notice of her termination,” which “contained extensive factual
recitals of the specific grounds for plaintiff’s termination”); Ciralsky v. CIA, 689 F. Supp. 2d 141,
158 (D.D.C. 2010) (concluding that statute of limitations “was triggered . . . when the CIA passed
the [memorandum] and investigative file to Plaintiff” where claim was “based in whole or in part
on the information contained in those documents”); Off v. U.S. Gov’ts, No. 2:09-CV-01525, 2010
WL 3862097, at *3 (D. Nev. Sept. 27, 2010) (“Because Plaintiff attached the SF-50 to at least one
of the complaints he filed on November 12, 1998, Plaintiff knew or had reason to know of the
allegedly incorrect SF-50 at that time.”), aff’d 472 F. App’x 789 (9th Cir. 2012); Brooks v. BOP,
No. 04-0055, 2005 WL 623229, at *2 (D.D.C. Mar. 17, 2005) (barring claim where plaintiff inmate
“has known of incorrect information in BOP records pertaining to him” since he received
response from regional director, which “incorrectly stated that plaintiff had been found to have
committed the more serious offense,” but plaintiff did not file suit until four years later); Harry v.
USPS, 867 F. Supp. 1199, 1205 (M.D. Pa. 1994) (finding that although exact date when plaintiff
should have known about alleged improper file maintenance was unclear, date of actual
discovery was “sterling clear” – when plaintiff physically reviewed his files), aff’d, 60 F.3d 815
(3d Cir. 1995) (unpublished table decision); Shannon, 812 F. Supp. at 319-20 (finding causes of
action arose when plaintiff learned of wrongs allegedly committed against him which was when
he received documents that were allegedly inaccurate or wrongfully maintained); cf. Steele v.
Cochran, No. 95-35373, 1996 WL 285651, at *1 (9th Cir. May 29, 1996) (citing Rose and holding
that Privacy Act claim filed in 1994 was time-barred because plaintiff wrote letter to agency
questioning validity of information disclosed to State Bar in 1991 and was formally informed by
State Bar that he was denied admission in 1991).
One district court decision has also considered the statute of limitations in connection with a
Privacy Act claim under subsection (e)(3) concerning the collection of information from
individuals. Darby v. Jensen, No. 94-S-569, 1995 U.S. Dist. LEXIS 7007, at *7-8 (D. Colo. May 15,
1995), aff’d 78 F.3d 597 (10th Cir. 1996) (unpublished table decision). In that case, the court
determined that the claim was time-barred, as more than two years had passed since the date
upon which the plaintiff had received the request for information. Id.
Several courts have considered whether a Privacy Act claim not apparently raised in the initial
complaint filed within the limitations period could be found to “relate back” to the date of that
earlier complaint under Rule 15(c) of the Federal Rules of Civil Procedure. See Oja v. Army
Corps of Eng’rs, 440 F.3d 1122, 1134-35 (9th Cir. 2006) (holding that amended complaint did not
relate back to filing date of initial complaint because “[t]he fact that the language in the two
disclosures is identical is inapposite because [plaintiff’s] claims . . . are based on the acts of
disclosure themselves, each of which is distinct in time and place” where agency posted
information pertaining to plaintiff on website in November 2000 and posted same information
on second website in December 2000); Freeman v. EPA, No. 02-0387, 2004 WL 2451409, at *8-9
(D.D.C. Oct. 25, 2004) (concluding that even though “the new claim is similar in that it also
involves disclosure of information . . . it is hardly conceivable that the defendants would have
had notice regarding the new” claim, nor “does the new claim build on facts the plaintiffs
previously alleged other than the very general factual context of the case,” and therefore, the
claim fails to relate back); Fort Hall Landowners All., Inc., No. 99-052, slip op. at 13-15 (finding
that Privacy Act wrongful disclosure claims first brought in amended and second amended
complaints related back to original complaint); Tripp v. DOD, 219 F. Supp. 2d 85, 91-92 (D.D.C.
2002) (holding that plaintiff’s subsequent Privacy Act accounting claim was not barred by two-
year statute of limitations because claim arose “out of the same conduct and occurrences
alleged in the initial Complaint,” which dealt with improper disclosures of Privacy Act-protected
records); cf. Yee v. Solis, No. C 08-4259, 2009 WL 5064980, at *2 (N.D. Cal. Dec. 23, 2009)
(rejecting argument that motion for leave to amend complaint to add Privacy Act claim “should
be denied because the proposed claim does not ‘relate [ ] back’ to plaintiff’s original claims” on
ground that defendant “does not contend, let alone demonstrate, such additional claim is, in the
absence of relation back, time-barred”), aff’d on other grounds, 472 F. App’x 471 (9th Cir. 2012).
d. Equitable Tolling of and Exceptions to Statute of Limitations
Equitable tolling applies in damages claims.
As discussed above, the D.C. Circuit has held that the rebuttable presumption in favor of
equitable tolling that was established in Irwin applies to the Privacy Act’s statute of limitations
for a damages claim for unlawful disclosure. Chung v. DOJ, 333 F.3d 273, 276-77 (D.C. Cir.
2003). Further, because the D.C. Circuit could find no reason to think that Congress did not
intend to equitably toll the Privacy Act’s statute of limitations, it held that the government did
not overcome this presumption. Id. at 278.
For other cases involving equitable tolling, see Hammoud v. U.S. Att’y, No. 14-14398, 2015 WL
4756582, at *5 (E.D. Mich. Aug. 12, 2015 (holding equitable tolling not appropriate when statute
of limitations ran in 2009 and plaintiff’s equitable tolling argument was based on attempts to
contact agencies no earlier than 2012); Grethen v. Clarke, No. 2:13cv416, 2015 WL 3452020, at
*2 (E.D. Va. March 13, 2015) (finding that plaintiff’s Privacy Act claim should not be tolled
because pendency of plaintiff’s habeas action did not impact plaintiff’s Privacy Act claim); Boyd,
932 F. Supp. 2d at 838-840 (stating Sixth Circuit’s five factors for determining whether
equitable tolling applies: “(1) lack of notice of the filing requirement; (2) lack of constructive
knowledge of the filing requirement; (3) diligence in pursuing one’s rights; (4) absence of
prejudice to the defendant; and (5) the plaintiff’s reasonableness in remaining ignorant of the
particular legal requirement”; finding “[t]here is no question that [plaintiff’s] claim in this Court
was brought outside the Privacy Act statute of limitations. Since the Court finds four of the five
equitable tolling factors favor equitable tolling . . . and that the fifth does not weigh significantly
against it, [plaintiff’s] suit is not barred by the statute of limitations”); Padilla-Ruiz v. United
States, 893 F. Supp. 2d 301, 306-09 (D.P.R. 2012) (finding equitable tolling “not a proper remedy
to be employed in this case” as plaintiff “makes no connection . . . between his request of
documents and the requirement that he needed to file suit [within time period]”), aff’d in part,
vacated in part, & remanded on other grounds, 593 F. App’x 1 (5th Cir. 2015); Doe v. Winter, No.
1:04-CV-2170, 2007 WL 1074206, at *10-11 (M.D. Pa. Apr. 5, 2007) (noting that equitable tolling
doctrine has been recognized by Third Circuit but finding that plaintiff failed to provide
evidence for its application); Cannon-Harper v. U.S. Postmaster Gen., No. 06-10520, 2006 WL
2975492, at *1 (E.D. Mich. Oct. 17, 2006) (declining to apply equitable tolling to statute of
limitations for subsection (b)/(g)(1)(C) claim where plaintiff had initially filed claim in state
court); Cooper v. BOP, No. 02-1844, 2006 WL 751341, at *3 (D.D.C. Mar. 23, 2006) (applying
equitable tolling where court had sealed inmate’s presentence report because he “was unable
to obtain vital information on the existence of his claim until he could review the [report]”);
Freeman v. EPA, 2004 WL 2451409, at *9 (concluding that plaintiffs’ argument that they needed
additional discovery to support their claim was “insufficient justification for this court to
countenance any equitable adjustment to the statute of limitations”); Fort Hall Landowners All.,
Inc., No. 99-052, slip op. at 7 (holding that statute of limitations was not tolled based on facts
before court).
An exception to the two-year statute of limitations rule occurs when there is a material and willful
misrepresentation by an agency.
In addition, the statute’s own terms provide an exception to the requirement that an action be
brought within two years from when the cause of action arose. 5 U.S.C. § 552a(g)(5). When an
agency materially and willfully misrepresents information required by the statute to be
disclosed to an individual, and the information so represented is material to establishing the
liability of the agency, then the limitations period runs from the date upon which the plaintiff
discovers the misrepresentation. Id.; see also Ciralsky, 689 F. Supp. 2d at 154 (finding where
plaintiff argued that “by allegedly denying [the plaintiff’s] request . . . for pertinent information
confirming his suspicion . . . the CIA committed a material and willful misrepresentation of
information required to be disclosed to Plaintiff and material to establishing the liability of the
Agency to him. . . . Taking the factual allegations of the complaint as true, such
misrepresentation delays the start of the limitations period.”); Lacey v. United States, 74 F. Supp.
2d 13, 15-16 (D.D.C. 1999) (concluding that defendants made material and willful
misrepresentations to plaintiffs by telling them that they lacked evidence and should wait for
agency to finish its own investigation of claim before bringing suit, which tolled statute of
limitations until agency “confirmed that there was substance to plaintiffs’ claim of violations”);
Burkins, 865 F. Supp. at 1496 (“Accepting Plaintiff’s claims of agency misrepresentation as true,
the statute may have been tolled.”); Pope v. Bond, 641 F. Supp. 489, 500 (D.D.C. 1986) (holding
that FAA’s actions constituted willful and material representation because of its repeated
denials of plaintiff’s request for access, which “prevents the statute of limitations from running
until the misrepresentation is discovered”); cf. Sabatini v. Price, No. 17-cv-01597, 2018 WL
1638258, at *4 (S.D. Cal. April 5, 2018) (finding no “exceptional circumstances” existed for
exception for material and willful misrepresentations), aff’d sub nom. Sabatini v. Azar, 749 F.
App’x 588 (9th Cir. 2019); United States v. Swecker, No. 4:09-cv-00013, 2015 WL 13309238, at
*3-4 (S.D. Iowa Dec. 15, 2015) (finding defendants’ counterclaims of material and willful
misrepresentation were undermined by the fact that the record contains forms signed by one of
the defendants, and such defendant “cannot now claim that [she] was uninformed, or misled,
about her Privacy Act Rights, when the form containing a statement of the agency's Privacy Act
policy was signed by [her] three separate times”); Weber, 33 F. App’x at 612 (finding that even if
court were to consider claim not properly raised on appeal, “[t]here is no evidence in the record
to show that the failure to disclose [a memorandum that plaintiff claims would have avoided
much of the pending litigation] was the result of willful misrepresentation”); Boyd, 932 F. Supp.
2d at 836 (“Even accepting. . . that [agency] did ‘willfully and materially misrepresent’ facts
regarding the statute of limitations for [plaintiff’s] Privacy Act claim, such a claim remains
outside the Privacy Act’s statute of limitations exception”; “In order for the exception to apply,
the undisclosed information must be material to the establishment of liability under the Act.”);
Sims v. New, 2009 WL 3234225, at *4-5 (concluding that “[e]ven if Defendants concealed the
actual contents of the [letter at issue] from Plaintiffs [for more than three years], Defendants did
not fraudulently conceal the facts giving rise to Plaintiffs’ claims” because plaintiff knew of
inaccuracy contained in letter when he requested it); Leibenguth, 2009 WL 3165846, at *3
(“Because the alleged misrepresentation was made with respect to when a rehearing would be
held, and did not pertain to information required to be disclosed under the Privacy Act, plaintiffs
have failed to establish that the alternative statute of limitations period applies.”); Mudd v. Army,
No. 2:05-cv-137, 2007 WL 4358262, at *7 (M.D. Fla. Dec. 10, 2007) (concluding that plaintiff
failed to establish that “information allegedly undermining the accuracy of the [record] was
materially and willfully misrepresented by the [agency], or that it was information required
under the Privacy Act to be disclosed to plaintiff, or that the allegedly misrepresented
information was material to establishment of the liability”); Doe v. Thompson, 332 F. Supp. 2d
124, 134 (D.D.C. 2004) (finding no material and willful misrepresentation where agency “notified
the plaintiff about the record and its contents . . . when the record was first created” and
“changed the record twice [at plaintiff’s request] in an effort to produce an accurate record”);
Marin v. DOD, No. 95-2175, 1998 WL 779101, at *1-2 (D.D.C. Oct. 23, 1998) (denying defendants’
motion to dismiss on ground that claim was time-barred and accepting plaintiff’s claim
regarding timing of agency misrepresentation), summary affirmance granted, No. 99-5102,
1999 WL 1006404 (D.C. Cir. Oct. 8, 1999) (per curiam); Munson, No. 96-CV-70920-DT, slip op. at
4-5 (E.D. Mich. July 2, 1996) (finding statement that agency could find no record of disclosure of
report to state police but that it would check further “does not provide any evidence of a willful
and material misrepresentation”).
Note that the Seventh Circuit has stated that this special relief provision is necessarily
incorporated into tests, such as the one set forth in Bergman, which focus on when a plaintiff
first knew or had reason to know of an error in maintaining the plaintiff’s records. Diliberti, 817
F.2d at 1262 n.1; see also Malewich, No. 91-4871, slip op. at 25-27 (D.N.J. Apr. 14, 1993) (following
Diliberti and precluding “the plaintiff from utilizing the discovery rule as a basis for extending
the permissible filing date”). The government argued to the D.C. Circuit in Tijerina v. Walters
that subsection (g)(5) “makes sense only if Congress intended the normal statutory period to
commence at the time of the alleged violation, regardless of whether the potential plaintiff is or
should be aware of the agency’s action.” See 821 F.2d at 797-98. The D.C. Circuit, however,
rejected that argument and stated:
[T]he clause providing for a more liberal limitations period in cases of willful
misrepresentation of material information . . . extends the normal limitations period in order
to ensure that the government cannot escape liability by purposefully misrepresenting
information . . . In such cases, the Act allows the period to commence upon actual discovery
of the misrepresentation, whereas . . . for other actions under the Act, the period begins
when the plaintiff knew or should have known of the violation. . . . [This] in no way affects
the special treatment Congress provided for the particularly egregious cases of
government misconduct singled out in the Act’s statute of limitations.
Id. at 798.
Continuing violations generally do not toll the statute of limitations period.
Additionally, it has been held that “[a] Privacy Act claim is not tolled by continuing violations.”
Davis v. DOJ, 204 F.3d 723, 726 (7th Cir. 2000); see also Bowyer, 875 F.2d at 638 (citing
Bergman and Diliberti, and rejecting argument that continuing violation doctrine should toll
statute of limitations); Diliberti, 817 F.2d at 1264 (citing Bergman for same proposition);
Bergman, 751 F.2d at 316-17 (ruling that limitations period commenced when agency first
notified plaintiff in writing that it would not reconsider his discharge or correct his job
classification records and rejecting argument “that a new cause of action arose upon each and
every subsequent adverse determination based on erroneous records”); Reitz, 2010 WL 786586,
at *9-10 (dismissing as time-barred claims filed in 2008 “alleg[ing] continuing ill effects from
violations occurring in 1997 or other dates before 2006” because “[a] new cause of action does
not arise ‘upon each and every subsequent adverse determination based on erroneous records’”
(quoting Harrell, 285 F.3d at 1293)); Blaylock v. Snow, No. 4:06-CV-142-A, 2006 WL 3751308, at
*7 (N.D. Tex. Dec. 21, 2006) (ruling that “continuing violations do not toll the limitations period” in
case involving several allegedly improper disclosures over course of three years); Thompson,
332 F. Supp. 2d at 132-33 (rejecting argument that “a new cause of action was created each
time [the agency] disseminated [plaintiff’s] revised Report after [the agency] had been placed
on notice of a potential problem and before it reviewed the revised Report for accuracy,
relevance, completeness, and timeliness”); Jarrett v. White, No. 01-800, 2002 WL 1348304, at *6
(D. Del. June 17, 2002) (rejecting argument that continuing violation doctrine should toll statute
of limitations), aff’d per curiam sub nom. Jarrett v. Brownlee, 80 F. App’x 107 (Fed. Cir. 2003);
Malewich, No. 91-4871, slip op. at 23-25 (D.N.J. Apr. 14, 1993) (same); Shannon, 812 F. Supp. at
319-20 (stating that plaintiff “cannot revive a potential cause of action simply because the
violation continued to occur; he can allege subsequent violations only if there are subsequent
events that occurred in violation of the Privacy Act”); cf. Baker v. United States, 943 F. Supp.
270, 273 (W.D.N.Y. 1996) (citing Shannon with approval). But cf. Burkins v. United States, 865 F.
Supp. 1480, 1496 (D. Colo. 1994) (citing Bergman and viewing plaintiff’s harm as “continuing
transaction”).
The Court of Appeals for the Ninth Circuit, in Oja v. Army Corps of Engineers, applied the single
publication rule in a case involving a subsection (b) claim based on multiple postings to two
agency websites of information pertaining to the plaintiff. 440 F.3d at 1130-33. Under that rule,
“the aggregate communication can give rise to only one cause of action . . . and result in only
one statute of limitations period that runs from the point at which the original dissemination
occurred.” Id. at 1130. The court rejected the argument that “the continuous hosting of private
information on an Internet website [is] a series of discrete and ongoing acts of publication, each
giving rise to a cause of action with its own statute of limitations.” Id. at 1132. Instead, the court
held that the claim was time-barred because the plaintiff filed it more than two years from
when plaintiff became aware of the first posting. Id. at 1133.
Moreover, a plaintiff’s voluntary pursuit of administrative procedures should not toll the running
of the statute of limitations, because no administrative exhaustion requirement exists before a
damages action can be brought. See Uhl v. Swanstrom, 876 F. Supp. 1545, 1560-61 (N.D. Iowa
1995), aff’d on other grounds, 79 F.3d 751 (8th Cir. 1996); see also Majied v. United States, No.
7:05CV00077, 2007 WL 1170628, at *3 (W.D. Va. Apr. 18, 2007); Molzen v. BOP, No. 05-2360,
2007 WL 779059, at *3 (D.D.C. Mar. 8, 2007); Mitchell v. BOP, No. 05-0443, 2005 WL 3275803,
at *3 (D.D.C. Sept. 30, 2005); cf. Kursar, 751 F. Supp. 2d at 168-69 (holding that statute of
limitations was not tolled by MSPB litigation regarding plaintiff’s termination); Christensen v.
Interior, 109 F. App’x 373, 375 (10th Cir. 2004) (“[T]here is no basis for tolling the limitations
period while Plaintiff pursued his administrative claim [under the Federal Tort Claims Act],
because there is no administrative exhaustion requirement when a plaintiff seeks damages
under the Privacy Act.”); Grethen v. Clarke, No. 2:13cv416, 2015 WL 3452020, at *2 (E.D. Va. Mar.
13, 2015) (dismissing Privacy Act claims as time-barred, noting that “pendency of the habeas
action does not impact Plaintiff’s claims under the Privacy Act”).
Finally, one district court has applied a provision of the Servicemembers Civil Relief Act to toll
the statute of limitations for a Privacy Act claim brought by an active duty member of the U.S.
Marine Corps. See Baker v. England, 397 F. Supp. 2d 18, 23-24 (D.D.C. 2005), aff’d on other
grounds, 210 F. App’x 16 (D.C. Cir. 2006). Under that statute, “[t]he period of a servicemember’s
military service may not be included in computing any period limited by law, regulation, or order
for the bringing of any action or proceeding in a court.” 50 U.S.C. § 3936 (formerly codified at
50 U.S.C. app. § 526(a)).
4. Jury Trial
There is no right to a jury trial under the Privacy Act.
Generally, the Seventh Amendment does not grant a plaintiff the right to trial by jury in actions
against the federal government. U.S. Const. amend. VII. Under sovereign immunity principles,
“the United States, as sovereign, ‘is immune from suit save as it consents to be sued … and the
terms of its consent to be sued in any court define that court’s jurisdiction to entertain the
suit.’” Lehman v. Nakshian, 453 U.S. 156, 160 (1981) (citations omitted). Further, a plaintiff has a
right to a jury trial only when the right has been “unequivocally expressed” by Congress. Id.
The Privacy Act is silent on the right to a jury trial and, therefore, there is no right to a jury trial
under the statute. Every court to have considered the issue has ruled accordingly. See e.g.,
Payne v. EEOC, No. 00-2021, 2000 WL 1862659, at *2 (10th Cir. Dec. 20, 2000) (holding that
Privacy Act authorizes suit only against agencies, and even where United States “consents,”
general rule is that Seventh Amendment does not grant plaintiff right to trial by jury); Harris v.
USDA, No. 96-5783, 1997 WL 528498, at *3 (6th Cir. Aug. 26, 1997) (same); Buckles v. Indian
Health Serv./Belcourt Serv. Unit, 268 F. Supp. 2d 1101, 1102-03 (D.N.D. 2003) (neither Privacy Act
nor Freedom of Information Act permit suits against individuals and any tort claims against
them are deemed actions against United States, and neither of these statutes provide right to
jury trial); Stewart v. FBI, No. 97-1595, 1999 U.S. Dist. LEXIS 18773, at *7-9 (D. Or. Sept. 29, 1999)
(plaintiff not entitled to jury trial on Privacy Act claims because “Privacy Act nowhere mentions
the word ‘jury’”) (magistrate’s recommendation), adopted, No. 97-1595, 1999 U.S. Dist. LEXIS
18785 (D. Or. Nov. 24, 1999); Clarkson v. IRS, No. 8:88-3036-3K, 1990 U.S. Dist. LEXIS 6887, at
*10 (D.S.C. May 10, 1990) (denying plaintiff’s demand for jury trial, “[u]nder settled principles of
sovereign immunity,” plaintiff has this right only where Congress expressly grants it by statute),
aff’d, 935 F.2d 1285 (4th Cir. 1991) (unpublished table decision); Calhoun v. Wells, No. 79-2337-
2, 1980 WL 1638, at *1 n.2 (D.S.C. July 30, 1980) (considering request for damages under Privacy
Act as “nonjury matters,” following district court’s order striking demand for jury trial, as “no
such right exists under the Privacy Act”); Henson v. Army, No. 76-45-C5, 1977 U.S. Dist. LEXIS
16868, at *1 (D. Kan. Mar. 16, 1977) (agreeing with defendants that Privacy Act does not
explicitly provide for jury trial and finding no such legislative intent). But cf. Tomasello v. Rubin,
No. 93-1326, slip op. at 3-5, 19 (D.D.C. Aug. 19, 1997) (noting that court was “guided by” advisory
jury verdict in awarding Privacy Act damages in case also involving non-Privacy Act claims),
aff’d, 167 F.3d 612, 616-17 (D.C. Cir. 1999) (recounting fact of advisory jury verdict as to Privacy
Act claims).
Next Section: Criminal Penalties
Updated October 22, 2022
U.S. Department of Justice

950 Pennsylvania Avenue NW
Washington DC 20530
Contact the Department

Phone: 202-514-2000
TTY/ASCII/TDD: 800-877-8339

Office of Privacy and Civil Liberties - Overview of The Privacy Act - 2020 Edition

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Office of Privacy and Civil Liberties - Overview of The Privacy Act - 2020 Edition

Uploaded by

Copyright:

Available Formats

3/1/24, 4:53 PM Office of Privacy and Civil Liberties | Overview of the Privacy Act: 2020 Edition

Overview of the Privacy Act: 2020

A. 5 U.S.C. § 552a(g)(1)(A) - Amendment Lawsuits

1. Exhaustion of Administrative Remedies

In amendment suits, exhaustion of administrative processes generally includes exhaustion of

Although subsection (d)(2)(A) requires an agency to “acknowledge in writing such receipt” of an

In contrast to subsection (d)(2)(B), subsection (d)(3) requires an agency to make a final

2. Standard and Scope of Review

After an individual exhausts his or her administrative remedies by making an amendment

Amendment suits are reviewed in the federal courts de novo.

Once records have been amended, the amendment claim is moot.

B. 5 U.S.C. § 552a(g)(1)(B) - Access Lawsuits

1. Exhaustion of Administrative Remedies

2. Standard and Scope of Review

C. 5 U.S. § 552a(g)(1)(C) - Damages Lawsuits for Failure to Assure Fairness

1. Exhaustion of Administrative Remedies

2. Elements of a Damages Claim

a. First Element: Aggrieved by Adverse Determination

c. Third element: Proximate Cause

—namely, whether VA personnel acted intentionally or willfully in maintaining allegedly

d. Fourth Element: Intentional or Willful Conduct

3. Standard and Scope of Review

Just as in the amendment context (see “5 U.S.C. § 552a(g)(1)(A) - Amendment Lawsuits”

D. 5 U.S.C. § 552a(g)(1)(D) - Damages Lawsuits For Failure to Comply with

In addition to damages under subsection (g)(1)(C)’s “accuracy, relevance, timeliness, and

1. Exhaustion of Administrative Remedy

2. Elements of a Subsection (g)(1)(D) Claim

a. First Element: Information Covered by Privacy Act

Information is generally covered by the Privacy Act if it is a “record” maintained in a “system of

b. Second Element: Catch-All Remedy Provision

c. Third Element: Adverse Effect had Causal Nexus to Violation

“Adverse effect” is a separate element from “actual damages.”

d. Fourth Element: Intentional or Willful Standard

3. Standard and Scope of Review

Subsection (g)(1)(D) suits cannot be used to collaterally attack agency determinations.

E. Principles Applicable to Damages Lawsuits

1. Intentional or Willful Standard

Negligence violations are insufficient to meet the “intentional or willful” standard.

3. Limits on Injunctive Relief for Damages Claims

4. Additional Considerations for Damages Claims

F. Principles Applicable to All Privacy Act Civil Actions

Mandamus relief is not an appropriate remedy for a Privacy Act violation.

1. Attorney Fees and Costs

“5 U.S.C. § 552a(g)(1)(A) - Amendment Lawsuits,” “5 U.S.C. § 552a(g)(1)(B) - Access Lawsuits,” “5

2. Jurisdiction and Venue

D.C. Circuit decisions carry great weight in Privacy Act matters.

a. Statute of Limitations in Amendment suits

b. Statute of Limitations in Access suits

Considerations at 13, https://www.justice.gov/oip/doj-guide-freedom-information-act-0

c. Statute of Limitations in Damages claims

d. Equitable Tolling of and Exceptions to Statute of Limitations

Equitable tolling applies in damages claims.

Continuing violations generally do not toll the statute of limitations period.

Next Section: Criminal Penalties

Updated October 22, 2022

U.S. Department of Justice

Contact the Department

You might also like