OVERVIEW OF THE PRIVACY ACT OF 1974

CONDITIONS OF DISCLOSURE TO THIRD PARTIES

A. The "No Disclosure Without Consent" Rule

"No agency shall disclose any record which is contained in a system of records by any means of communication to any person, or to another agency, except pursuant to a written request by, or with the prior written consent of, the individual to whom the record pertains [subject to 12 exceptions]." 5 U.S.C. § 552a(b).

comment --

A "disclosure" can be by any means of communication--written, oral, electronic, or mechanical. See OMB Guidelines, 40 Fed. Reg. 28,948, 28,953 (1975).

A plaintiff has the burden of demonstrating that a disclosure by the agency has occurred. See, e.g., Askew v. United States, 680 F.2d 1206, 1209-11 (8th Cir. 1982); Zerilli v. Smith, 656 F.2d 705, 715-16 (D.C. Cir. 1981); cf. Meldrum v. United States Postal Serv., No. 5:97CV1482, slip op. at 11 (N.D. Ohio Jan. 21, 1999) (finding lack of evidence that disclosure occurred where plaintiff alleged that, among other things, file had been left in unsecured file cabinet).

It has frequently been held that a "disclosure" under the Privacy Act does not occur if the communication is to a person who is already aware of the information. See, e.g., Quinn v. Stone, 978 F.2d 126, 134 (3d Cir. 1992) (dictum); Kline v. HHS, 927 F.2d 522, 524 (10th Cir. 1991); Hollis v. United States Dep't of the Army, 856 F.2d 1541, 1545 (D.C. Cir. 1988); Reyes v. Supervisor of DEA, 834 F.2d 1093, 1096 n.1 (1st Cir. 1987); Schowengerdt v. General Dynamics Corp., 823 F.2d 1328, 1341 (9th Cir. 1987); Pellerin v. VA, 790 F.2d 1553, 1556 (11th Cir. 1986); FDIC v. Dye, 642 F.2d 833, 836 (5th Cir. 1981); Ash v. United States, 608 F.2d 178, 179 (5th Cir. 1979); Sullivan v. United States Postal Serv., 944 F. Supp. 191, 196 (W.D.N.Y. 1996); Viotti v. United States Air Force, 902 F. Supp. 1331, 1337 (D. Colo. 1995), aff'd, 153 F.3d 730 (10th Cir. 1998) (unpublished table decision); Abernethy v. IRS, 909 F. Supp. 1562, 1571 (N.D. Ga. 1995), aff'd per curiam, No. 95-9489 (11th Cir. Feb. 13, 1997); Kassel v. VA, 709 F. Supp. 1194, 1201 (D.N.H. 1989); Krowitz v. USDA, 641 F. Supp. 1536, 1545 (W.D. Mich. 1986), aff'd, 826 F.2d 1063 (6th Cir. 1987) (unpublished table decision); Golliher v. United States Postal Serv., 3 Gov't Disclosure Serv. ¶ 83,114, at 83,702 (N.D. Ohio June 10, 1982); King v. Califano, 471 F. Supp. 180, 181 (D.D.C. 1979); Harper v. United States, 423 F. Supp. 192, 197 (D.S.C. 1976); see also Hoffman v. Rubin, 193 F.3d 959, 966 (8th Cir. 1999) (no Privacy Act violation found where agency disclosed same information in letter to journalist that plaintiff himself had previously provided to journalist; plaintiff "waiv[ed], in effect, his protection under the Privacy Act"); Loma Linda Community Hosp. v. Shalala, 907 F. Supp. 1399, 1404-05 (C.D. Cal. 1995) (policy underlying Privacy Act of protecting confidential information from disclosure not implicated by release of information health care provider had already received through patients' California "Medi-Cal" cards); Owens v. MSPB, No. 3-83-0449-R, slip op. at 2-3 (N.D. Tex. Sept. 14, 1983) (mailing of agency decision affirming employee's removal to his former attorney held not a "disclosure" as "attorney was familiar with facts of [employee's] claim" and "no new information was disclosed to him"); cf. Pippinger v. Rubin, 129 F.3d 519, 532-33 (10th Cir. 1997) (finding no evidence that disclosure "could possibly have had 'an adverse effect'" on plaintiff where recipient "had been privy to every event described in [plaintiff's] records at the time the event occurred"); Jones v. Runyon, 32 F. Supp. 2d 873, 876 (N.D. W. Va. 1998) (although finding disclosure to credit reporting service valid under routine use exception, stating further that information disclosed was already in possession of recipient and that other courts had held that Privacy Act is not violated in such cases), aff'd, 173 F.3d 850 (4th Cir. 1999) (unpublished table decision).

However, the Court of Appeals for the District of Columbia Circuit clarified that this principle does not apply to all disseminations of protected records to individuals with prior knowledge of their existence or contents. Pilon v. United States Dep't of Justice, 73 F.3d 1111, 1117-24 (D.C. Cir. 1996). In Pilon, the D.C. Circuit held that the Justice Department's transmission of a Privacy Act-protected record to a former employee of the agency constituted a "disclosure" under the Privacy Act, even though the recipient had come "into contact with the [record] in the course of his duties" while an employee. Id. The court's "review of the Privacy Act's purposes, legislative history, and integrated structure convince[d it] that Congress intended the term 'disclose' to apply in virtually all instances to an agency's unauthorized transmission of a protected record, regardless of the recipient's prior familiarity with it." Id. at 1124.

In an earlier case, Hollis v. United States Dep't of the Army, 856 F.2d 1541 (D.C. Cir. 1988), the D.C. Circuit had held that the release of a summary of individual child-support payments previously deducted from plaintiff's salary and sent directly to his ex-wife, who had requested it for use in pending litigation, was not an unlawful disclosure under the Privacy Act as she, being the designated recipient of the child-support payments, already knew what had been remitted to her. Id. at 1545. In Pilon, the D.C. Circuit reconciled its opinion in Hollis by "declin[ing] to extend Hollis beyond the limited factual circumstances that gave rise to it," 73 F.3d at 1112, 1124, and holding that:

[A]n agency's unauthorized release of a protected record does constitute a disclosure under the Privacy Act except in those rare instances, like Hollis, where the record merely reflects information that the agency has previously, and lawfully, disseminated outside the agency to the recipient, who is fully able to reconstruct its material contents.

Id. at 1124; cf. Osborne v. United States Postal Serv., No. 94-30353, slip op. at 2-4, 6-11 (N.D. Fla. May 18, 1995) (assuming without discussion that disclosure of plaintiff's injury-compensation file to retired employee who had prepared file constituted "disclosure" for purposes of Privacy Act).

A few courts, though, have extended the principle that there is no "disclosure" to rule that the release of previously published or publicly available information is not a Privacy Act "disclosure"--regardless of whether the particular persons who received the information were aware of the previous publication. See FDIC v. Dye, 642 F.2d at 836; Lee v. Dearment, No. 91-2175, 1992 WL 119855, at *2 (4th Cir. June 3, 1992); Smith v. Continental Assurance Co., No. 91-C-0963, 1991 WL 164348, at *5 (N.D. Ill. Aug. 22, 1991); Friedlander v. United States Postal Serv., No. 84-0773, slip op. at 8 (D.D.C. Oct. 16, 1984); King, 471 F. Supp. at 181. But see Quinn, 978 F.2d at 134 (holding that release of information that is "merely readily accessible" to public "is a disclosure under 552a(b)"); Gowan v. United States Dep't of the Air Force, 148 F.3d 1182, 1193 (10th Cir.) ("adopt[ing] the Third Circuit's reasoning [in Quinn] and hold[ing] that an agency may not defend a release of Privacy Act information simply by stating that the information is a matter of public record"), cert. denied, 525 U.S. 1042 (1998); cf. Doe v. Herman, No. 2:97CV00043, 1999 U.S. Dist. LEXIS 17302, at **34-35 (W.D. Va. Oct. 29, 1999) (magistrate's recommendation) (agreeing with Quinn in dictum); Pilon v. United States Dep't of Justice, 796 F. Supp. 7, 11-12 (D.D.C. 1992) (rejecting argument that information was already public and therefore could not violate Privacy Act where agency had republished statement that was previously publicly disavowed as false by agency). The D.C. Circuit had recognized in dictum that other courts had so held, and perhaps had indicated a willingness to go that far. Hollis, 856 F.2d at 1545 (holding that disclosure did not violate Privacy Act because recipient of information was already aware of it, but stating that "[o]ther courts have echoed the sentiment that when a release consists merely of information to which the general public already has access, or which the recipient of the release already knows, the Privacy Act is not violated").

However, the D.C. Circuit's more recent holding in Pilon v. United States Dep't of Justice, 73 F.3d 1111 (D.C. Cir. 1996), discussed above, seems to foreclose such a possibility. In Pilon, the D.C. Circuit further held that even under the narrow Hollis interpretation of "disclose," the agency would not be entitled to summary judgment because it had "failed to adduce sufficient evidence that [the recipient of the record] remembered and could reconstruct the document's material contents in detail at the time he received it." 73 F.3d at 1124-26. Nevertheless, the D.C. Circuit in Pilon noted that "[t]his case does not present the question of whether an agency may . . . release a document that has already been fully aired in the public domain through the press or some other means" but that "the Privacy Act approves those disclosures that are 'required' under the [FOIA] . . . and that under various FOIA exemptions, prior publication is a factor to be considered in determining whether a document properly is to be released." Id. at 1123 n.10; see also Barry v. United States Dep't of Justice, 63 F. Supp. 2d 25, 27-28 (D.D.C. 1999) (distinguishing Pilon and finding no disclosure where agency posted Inspector General report on Internet Web site, after report had already been fully released to media by Congress and had been discussed in public congressional hearing, even though some Internet users might encounter report for first time on Web site). Furthermore, though, and consistent with the D.C. Circuit's note in Pilon, one might argue that to say that no "disclosure" occurs for previously published or public information is at least somewhat inconsistent with the Supreme Court's decision in United States Department of Justice v. Reporters Committee for Freedom of the Press, 489 U.S 749, 762-71 (1989), which held that a privacy interest can exist, under the FOIA, in publicly available--but "practically obscure"--information, such as a criminal history record. Cf. Finley v. National Endowment for the Arts, 795 F. Supp. 1457, 1468 (C.D. Cal. 1992) (alleged disclosure of publicly available information states claim for relief under Privacy Act; recognizing Reporters Committee).

The Act's legislative history indicates that a court is not a "person" or "agency" within the meaning of subsection (b), and that the Act was "not designed to interfere with access to information by the courts." 120 Cong. Rec. 36,967 (1974), reprinted in Source Book at 958-59. However, the public filing of records with a court, during the course of litigation, does constitute a subsection (b) disclosure. See Laningham v. United States Navy, No. 83-3238, slip op. at 2-3 (D.D.C. Sept. 25, 1984), summary judgment granted (D.D.C. Jan. 7, 1985), aff'd per curiam, 813 F.2d 1236 (D.C. Cir. 1987); Citizens Bureau of Investigation v. FBI, No. 78-60, slip op. at 2-3 (N.D. Ohio Dec. 14, 1979). Accordingly, any such public filing must be undertaken with written consent or in accordance with either the subsection (b)(3) routine use exception or the subsection (b)(11) court order exception, both discussed below. See generally Krohn v. United States Dep't of Justice, No. 78-1536, slip op. at 3-11 (D.D.C. Mar. 19, 1984) (finding violation of Privacy Act where agency's disclosure of records as attachments to affidavit in FOIA lawsuit "did not fall within any of the exceptions listed in Section 552a"), reconsideration granted & vacated in nonpertinent part (D.D.C. Nov. 29, 1984) (discussed below).

Often during the course of litigation, an agency will be asked to produce Privacy Act-protected information pursuant to a discovery request by an opposing party. An agency in receipt of such a request must object on the ground that the Privacy Act prohibits disclosure. Although courts have unanimously held that the Privacy Act does not create a discovery privilege, see Laxalt v. McClatchy, 809 F.2d 885, 888-90 (D.C. Cir. 1987); Weahkee v. Norton, 621 F.2d 1080, 1082 (10th Cir. 1980); Forrest v. United States, No. 95-3889, 1996 WL 171539, at *2 (E.D. Pa. Apr. 11, 1996); Ford Motor Co. v. United States, 825 F. Supp. 1081, 1083 (Ct. Int'l Trade 1993); Clavir v. United States, 84 F.R.D. 612, 614 (S.D.N.Y. 1979); cf. Baldrige v. Shapiro, 455 U.S. 345, 360-62 (1982) (Census Act confidentiality provisions constitute privilege because they "embody explicit congressional intent to preclude all disclosure"), an agency can disclose Privacy Act-protected records only as permitted by the Act. The most appropriate method of disclosure in this situation is pursuant to a (b)(11) court order. See generally Doe v. DiGenova, 779 F.2d 74 (D.C. Cir. 1985); Doe v. Stephens, 851 F.2d 1457 (D.C. Cir. 1988) (both discussed below under subsection (b)(11)); see also Boudreaux v. United States, No. 97-1592, 1999 WL 499911, at **1-2 (E.D. La. July 14, 1999) (recognizing relevancy of subsection (b)(11) to court's resolution of dispute over motion to compel responses to production of documents subject to Privacy Act, but ordering in camera review of documents so that legitimacy of agency objections may be determined "in the considered and cautious manner contemplated by the Privacy Act"). Indeed, the courts that have rejected the Privacy Act as a discovery privilege have pointed to subsection (b)(11)'s allowance for court-ordered disclosures in support of their holdings. See Laxalt, 809 F.2d at 888-89; Weahkee, 621 F.2d at 1082; Hernandez v. United States, No. 97-3367, 1998 WL 230200, at **2-3 (E.D. La. May 6, 1998); Forrest, 1996 WL 171539, at *2; Ford Motor Co., 825 F. Supp. at 1082-83; Clavir, 84 F.R.D. at 614; cf. Alford v. Todco, No. CIV-88-731E, slip op. at 4-5 (W.D.N.Y. June 12, 1990) ("Even assuming the Privacy Act supplies a statutory privilege . . . the plaintiff has waived any such privilege by placing his physical condition at issue"; ordering production of records); Tootle v. Seaboard Coast Line R.R., 468 So. 2d 237, 239 (Fla. Dist. Ct. App. 1984) (recognizing that privacy interests in that case "must give way to the function of the discovery of facts" and that subsection (b)(11) provides the mechanism for disclosure).

On the other hand, when an agency wishes to make an affirmative disclosure of information during litigation it may either rely on a routine use permitting such disclosure or seek a court order. Because the Privacy Act does not constitute a statutory privilege, agencies need not worry about breaching or waiving such a privilege when disclosing information pursuant to subsections (b)(3) or (b)(11). Cf. Mangino v. Department of the Army, No. 94-2067, 1994 WL 477260, at **5-6 (D. Kan. Aug. 24, 1994) (finding that disclosure to court was appropriate pursuant to agency routine use and stating that to extent Privacy Act created privilege, such privilege was waived by plaintiff when he placed his records at issue through litigation); Lemasters v. Thomson, No. 92 C 6158, 1993 U.S. Dist. LEXIS 7513, at **3-8 (N.D. Ill. June 3, 1993) (same finding as in Mangino, despite fact that "court ha[d] not located" applicable routine use). For further discussions of disclosures during litigation, see the discussions of subsections (b)(3) and (b)(11), below.

By its own terms, subsection (b) does not prohibit an agency from releasing to an individual his own record, contained in a system of records retrieved by his name or personal identifier, in response to his "first-party" access request under subsection (d)(1). However, as is discussed below under "Individual's Right of Access," one exception to this point could conceivably arise in the first-party access context where a record is also about another individual and is "dually retrieved." Such a position has been rejected, though, by the only court to consider it. See Topuridze v. USIA, 772 F. Supp. 662, 665-66 (D.D.C. 1991).

Additionally, although it may seem self-evident, the factual pattern in one case caused a court to explicitly hold that an agency cannot be sued for disclosures which an individual makes himself. Abernethy, 909 F. Supp. at 1571 (plaintiff had informed employees that he was being removed from his position as their supervisor and reason for his removal).

The Act does not define "written consent." Implied consent has been held to be insufficient. See Taylor v. Orr, No. 83-0389, 1983 U.S. Dist. LEXIS 20334, at *6 n.6 (D.D.C. Dec. 5, 1983) ("Implied consent is never enough" as the Act's protections "would be seriously eroded if plaintiff's written submission of [someone's] name were construed as a voluntary written consent to the disclosure of her [medical] records to him."). But see OMB Guidelines, 40 Fed. Reg. 56,741, 56,742 (1975) (consent may be implied when responding to inquiry from Member of Congress acting on basis of written request for assistance from constituent); Pellerin, 790 F.2d at 1556 (applying doctrine of "equitable estoppel" to bar individual from complaining of disclosure of his record to congressmen "when he requested their assistance in gathering such information") (distinguished in Swenson v. United States Postal Serv., 890 F.2d 1075, 1077-78 (9th Cir. 1989)); cf. Baitey v. VA, No. 8:CV89-706, slip op. at 5 (D. Neb. June 21, 1995) (concluding that "at a minimum, the phrase 'written consent' necessarily requires either (1) a medical authorization signed by [plaintiff] or (2) conduct which, coupled with the unsigned authorization, supplied the necessary written consent for the disclosure").

The scope of express consent, however, cannot be "so vague or general that it is questionable whether [the individual] knew what he was authorizing or whether the [agency] knew what documents it could lawfully release." Perry v. FBI, 759 F.2d 1271, 1276 (7th Cir. 1985), rev'd en banc on other grounds, 781 F.2d 1294 (7th Cir. 1986); see also AFGE v. United States R.R. Retirement Bd., 742 F. Supp. 450, 457 (N.D. Ill. 1990) (SF-86 "release form" held overbroad and contrary to subsection (b)); Taylor, No. 83-0389, 1983 U.S. Dist. LEXIS 20334, at *6 n.6 (D.D.C. Dec. 5, 1983) ("It is not unreasonable to require that a written consent to disclosure address the issue of such disclosure and refer specifically to the records permitted to be disclosed."); Thomas v. VA, 467 F. Supp. 458, 460 n.4 (D. Conn. 1979) (consent held adequate as it was both agency- and record-specific); cf. Doe v. Herman, No. 2:97CV00043, 1999 U.S. Dist. LEXIS 17302, at **30-31 (W.D. Va. Oct. 29, 1999) (magistrate's recommendation) (rejecting argument that when plaintiffs provided their social security numbers for purpose of determining eligibility for and amount of benefits payable, they consented to use of those numbers as identifiers on multi-captioned hearing notices sent to numerous other individuals and companies as well as to publication of numbers in compilations of opinions); Doe v. GSA, 544 F. Supp. 530, 539-41 (D. Md. 1982) (authorization which was neither record- nor entity-specific was insufficient under GSA's own internal interpretation of Privacy Act). The OMB Guidelines caution that "the consent provision was not intended to permit a blanket or open-ended consent clause, i.e., one which would permit the agency to disclose a record without limit," and that, "[a]t a minimum, the consent clause should state the general purposes for, or types of recipients[ to,] which disclosure may be made." 40 Fed. Reg. at 28,954.

In light of the D.C. Circuit's decision in Summers v. United States Dep't of Justice, 999 F.2d 570, 572-73 (D.C. Cir. 1993), agencies whose regulations require that privacy waivers be notarized to verify identity must also accept declarations in accordance with 28 U.S.C. § 1746 (1994) (i.e., an unsworn declaration subscribed to as true under penalty of perjury). See, e.g., 28 C.F.R. § 16.41(d) (1999) (Department of Justice regulation regarding verification of identity).


Go to Table of Contents || Previous Section Definitions: E. System of Records: 3. Other Aspects || Next Section Twelve Exceptions to the "No Disclosure Without Consent" Rule