Privacy Act

The Privacy Act of 1974, codified at 5 U.S.C. § 552a, is a federal law that protects individuals against misuse by government of their personal information, and also confers a special right for every individual to obtain a copy of the information being held in government files about him:

“

The Privacy Act provides an individual with access to government records that pertain to her which are contained in a system of records and allows the individual to review and have a copy made of all or any portion of the records. 5 U.S.C. § 552a(d).

”

The Privacy Act also prohibits a federal agency from disclosing any record which is contained in a system of records to any other agency or person without permission from the individual to whom the record pertains. See 5 U.S.C. § 552a(b).

The Privacy Act generally prohibits the federal government from maintaining a record against someone that consists of his exercise of his First Amendment right of free speech, unless it pertains to and within the scope of an authorized law enforcement activity. See 5 U.S.C. § 552a(e)(7). Section § 552a(a)(3) defines to "maintain" as to "collect, maintain, use [or] disseminate."

The Privacy Act creates private rights to sue the federal government both for damages and for injunctive relief, such as correcting information in, or removing it from, federal databases. More than 10,000 federal court decisions, and more than 1,000 state court decisions, discuss or decide issues relating to the Privacy Act.

The Privacy Act applies exclusively against federal agencies. See Schmitt v. City of Detroit, 395 F.3d 327, 328 (6th Cir. 2005). There is no right of action against a municipal or state agency under the Privacy Act. See Pennyfeather v. Tessler, 431 F.3d 54, 56 (2d Cir. 2005). Courts are exempt from the Privacy Act also. See 5 U.S.C. § 551(1)(B) (excluding federal courts of the United States from the definition of "agency")

Many states have their own independent privacy acts, subjecting state government to obligations to protect privacy. See, e.g., Washington Privacy Act (Act), Wash. Rev. Code § 9.73; Minnesota Government Data Practices Act, Minn. Stat. § 13.01 et seq.

Disclosure

The Privacy Act typically prohibits disclosure by a federal agency of information contained in a system of records and relating to an individual, unless the individual has either requested the information himself, or has consented in writing to its disclosure. But there are eleven exceptions to this protection against disclosure of personal information. Id. at § 552a(b)(1)-(11).

Remedies

5 USCS § 552a(g) sets forth the "Civil remedies," including a two-year statute of limitations:

(1) Whenever any agency--

(A) makes a determination under subsection (d)(3) of this section not to amend an individual's record in accordance with his request, or fails to make such review in conformity with that subsection;

(B) refuses to comply with an individual request under subsection (d)(1) of this section [which gives individuals the right to obtain a copy of a record about them, subject to limited exemptions];

(C) fails to maintain any record concerning any individual with such accuracy, relevance, timeliness, and completeness as is necessary to assure fairness in any determination relating to the qualifications, character, rights, or opportunities of, or benefits to the individual that may be made on the basis of such record, and consequently a determination is made which is adverse to the individual; or

(D) fails to comply with any other provision of this section, or any rule promulgated thereunder, in such a way as to have an adverse effect on an individual,

the individual may bring a civil action against the agency, and the district courts of the United States shall have jurisdiction in the matters under the provisions of this subsection.

(2) (A) In any suit brought under the provisions of subsection (g)(1)(A) of this section, the court may order the agency to amend the individual's record in accordance with his request or in such other way as the court may direct. In such a case the court shall determine the matter de novo.

(B) The court may assess against the United States reasonable attorney fees and other litigation costs reasonably incurred in any case under this paragraph in which the complainant has substantially prevailed.

(3) (A) In any suit brought under the provisions of subsection (g)(1)(B) of this section, the court may enjoin the agency from withholding the records and order the production to the complainant of any agency records improperly withheld from him. In such a case the court shall determine the matter de novo, and may examine the contents of any agency records in camera to determine whether the records or any portion thereof may be withheld under any of the exemptions set forth in subsection (k) of this section, and the burden is on the agency to sustain its action.

(B) The court may assess against the United States reasonable attorney fees and other litigation costs reasonably incurred in any case under this paragraph in which the complainant has substantially prevailed.

(4) In any suit brought under the provisions of subsection (g)(1)(C) or (D) of this section in which the court determines that the agency acted in a manner which was intentional or willful, the United States shall be liable to the individual in an amount equal to the sum of--

(A) actual damages sustained by the individual as a result of the refusal or failure, but in no case shall a person entitled to recovery receive less than the sum of $ 1,000; and

(B) the costs of the action together with reasonable attorney fees as determined by the court.

(5) An action to enforce any liability created under this section may be brought in the district court of the United States in the district in which the complainant resides, or has his principal place of business, or in which the agency records are situated, or in the District of Columbia, without regard to the amount in controversy, within two years from the date on which the cause of action arises, except that where an agency has materially and willfully misrepresented any information required under this section to be disclosed to an individual and the information so misrepresented is material to establishment of the liability of the agency to the individual under this section, the action may be brought at any time within two years after discovery by the individual of the misrepresentation. Nothing in this section shall be construed to authorize any civil action by reason of any injury sustained as the result of a disclosure of a record prior to September 27, 1975.

Some Circuits, such as the D.C. Circuit and Eleventh Circuit, have expanded the remedies available under the Privacy to provisions that do not expressly establish a remedy. See Smith v. Nixon, 807 F.2d 197, 204 (D.C.Cir. 1986); Hobson v. Wilson, 737 F.2d 1, 64-65 (D.C.Cir. 1984); Clarkson v. IRS, 678 F.2d 1368, 1376 (11th Cir. 1982), aff'd, 811 F.2d 1396 (11th Cir.).

Statute of Limitations

The federal district court in D.C., where many Privacy Act claims are brought, explained the two-year statute of limitations under the Privacy Act as follows:

The defendants allege that the plaintiff's Privacy Act claims are barred by the Act's statute of limitations. For claims arising under the Privacy Act, "[a]n action to enforce any liability ... may be brought ... within two years from the date on which the cause of action arises." 5 U.S.C. § 552a(g)(5). A cause of action arises under the Privacy Act when "(1) an error was made in maintaining the plaintiff's records; (2) the plaintiff was harmed by the error; and (3) the plaintiff either knew or had reason to know of the error." Conklin v. U.S. Bureau of Prisons, 514 F. Supp. 2d 1, 4 (D.D.C. 2007) (Walton, J.) (citations omitted); see also Tijerina v. Walters, 821 F.2d 789, 798, 261 U.S. App. D.C. 301 (D.C. Cir. 1987) ("[I]n a normal Privacy Act claim, the cause of action does not arise and the statute of limitation does not begin to run until the plaintiff knows or should know of the alleged violation."). Additionally, a "new cause of action does not arise each time an adverse determination is made based on the allegedly erroneous records." Conklin, 514 F. Supp. 2d at 4; see also Doe v. Thompson, 332 F. Supp. 2d 124, 133 (D.D.C. 2004) (Walton, J.). In the complaint here, Kursar alleges various violations of the Privacy Act in Counts One through Four, see Am. Compl. PP 32, 42, 54, 66, and thus, the time limitation imposed by Section 552a(g)(5) applies to these Counts.

To be sure, the statute of limitations period set forth in 5 U.S.C. § 552a(g)(5) is not a jurisdictional bar, Chung v. U.S. Dep't of Justice, 333 F.3d 273, 278 n.*, 357 U.S. App. D.C. 152 (D.C. Cir. 2003), and thus the appropriate "procedural mechanism for considering [the defendant's] statute of limitations argument at this stage of the proceedings is Rule 12(b)(6)," Williams v. Chu, 641 F. Supp. 2d 31, 34 (D.D.C. 2009) (Walton, J.). And, in accordance with the standard of review applicable to Rule 12(b)(6) motions, a court should assess when a plaintiff knew or should have known of an alleged error from the facts pled, and only grant a motion to dismiss "if the complaint on its face is conclusively time-barred." Firestone, 76 F.3d at 1209; see also Ramirez v. Dep't of Justice, 594 F. Supp. 2d 58, 63 (D.D.C. 2009) (Roberts, J.) (finding a prisoner's Privacy Act suit in 2007 untimely after noting that the plaintiff's "own complaint establishes that he knew of inaccuracies . . . on July 22, 2004, if not earlier"); Bernard v. U.S. Dep't of Defense, 362 F. Supp. 2d 272, 279 (D.D.C. 2005) (Lamberth, J.) (finding the plaintiff's Privacy Act claims untimely where it was "clear from the administrative record that the plaintiff knew or should have known about his ability to request his medical records"); cf. Conklin, 514 F. Supp. 2d at 5 (denying the defendant's motion to dismiss as untimely because the "date on which plaintiff knew or had reason to know of the alleged Privacy Act violations [was] unclear"). Applying these standards here, the Court concludes that only Count Two is barred by the Privacy Act's statute of limitations.

Kursar v. Transp. Sec. Admin., 751 F. Supp. 2d 154, 165-66 (D.D.C. 2010).

See also

• Right to Privacy
• Electronic Communications Privacy Act of 1986
• Privacy Act litigation