Individuals suing the government for violations of the Privacy Act (5 U.S.C. §552(a)) can recover at least $1,000 in statutory damages if they can prove, among other things, that they suffered "actual damages" as a result of the Privacy Act violations. In late February, the Ninth Circuit Court of Appeals joined the Fifth and Tenth Circuits in holding that a plaintiff who suffers emotional distress or other nonpecuniary harm can recover for such injuries as "actual damages" in a Privacy Act case. Such holdings stand in sharp contrast to decisions of the Eleventh and Sixth Circuits, which do not allow recovery for Privacy Act violations that result only in "generalized mental injuries, loss of reputation, embarrassment" or similar injuries. On March 8, the Supreme Court declined to review an Eleventh Circuit ruling that emotional distress did not constitute Privacy Act damages, leaving the courts of appeals split on this issue.

Privacy Act Background

The Privacy Act establishes requirements regarding the collection, maintenance, use and dissemination of personally identifiable information maintained as part of a "system of records" by federal agencies. Congress passed the Privacy Act in 1974 in order to "protect the privacy of individuals identified in information systems maintained by Federal agencies." The Act specifically authorizes private civil actions to enforce its terms, and permits recovery of actual damages (with a statutory minimum of $1,000). Over 170 agencies are subject to the Privacy Act.

In order to obtain monetary relief in a Privacy Act case, a plaintiff must show that an agency violated the Act; that the violation had an adverse effect on him/her; that the violation was "intentional or willful"; and that he/she has suffered "actual damages a result of" the violation. The "actual damages" requirement is based on a 2004 Supreme Court case, Doe v. Chao, 540 U.S. 614, 624-25 (2004), in which the court held that a showing of actual damages is a necessary element of "a complete cause of action" in a Privacy Act case (see March 2004 Privacy In Focus). Unfortunately, the Privacy Act does not define "actual damages," and federal district courts and courts of appeals disagree regarding the proper meaning of this term.

Ninth Circuit-Emotional Distress as Actual Damages

The Ninth Circuit recently held in Cooper v. Federal Aviation Administration, No. 08-17074 (February 22, 2010), that "actual damages" under the Act encompass both pecuniary and nonpecuniary damages. Cooper was an HIV positive pilot who applied for and received medical certificates from the Federal Aviation Administration (FAA) without disclosing that he had HIV or was taking antiretroviral medications. Cooper asserted that he withheld that information because of the "social stigma" associated with HIV and his sexual orientation. Although Cooper did not disclose his medical condition to the FAA, he disclosed this information to the Social Security Administration (SSA) as part of his application for long-term disability benefits. In 2002, Cooper's HIV status-and false information provided to the FAA-came to light as part of "Operation Safe Pilot," a joint criminal investigation conducted by the Department of Transportation (DOT) and the SSA that sought to reveal medically unfit individuals who had obtained FAA certifications to fly. The FAA ultimately revoked Cooper's pilot certificate due to his misrepresentations to the FAA, and Cooper later was indicted on three counts of making false statements to a government agency.

Cooper filed suit against the government, asserting that the FAA, DOT and SSA willfully or intentionally violated the Privacy Act by conducting their interagency exchange of his records as part of Operation Safe Pilot. Cooper claimed that the disclosure of his personal information caused him "to suffer humiliation, embarrassment, mental anguish, fear of social ostracism and other severe emotional injuries." The district court, finding the term "actual damages" in the Act to be ambiguous, construed the waiver of sovereign immunity strictly in favor of the government and held that Cooper did not suffer actual damages under the Act due to the nonpecuniary nature of his damages. The Ninth Circuit reversed, holding that the Privacy Act includes a damages remedy for nonpecuniary injuries.

In reaching its ultimate conclusion, the Cooper court examined many factors, including the language and purposes of the Privacy Act. The court noted that nonpecuniary injuries are the typical outcome from invasions of privacy, and reasoned that "[g]iven the nature of the injuries that most frequently flow from privacy violations, it is difficult to see how Congress's stated goal of subjecting federal agencies to civil suit for any damages resulting from a willful or intentional violation of the Act could be fully realized unless the Act encompasses both pecuniary and nonpecuniary injuries." The court further noted that the Act provides for actual damages for intentional or willful violations that have an adverse effect on an individual, and that at least eight other circuits have construed the term "adverse effect" to include nonpecuniary harm. The court reasoned that "[t]o recognize that the Act entitles one to actual damages for an adverse effect related to one's mental or emotional well-being, or one's character, as we and other circuits have previously done, while holding that one injured under the Act cannot recover actual damages for nonpecuniary injuries, would be an unreasonable construction of the Act."

The Ninth Circuit also looked to the Fair Credit Reporting Act (FCRA), 15 U.S.C. 1681, to ascertain the meaning of "actual damages." Congress enacted the FCRA to ensure that "consumer reporting agencies exercised their grave responsibilities with fairness, impartiality, and a respect for the consumer's right to privacy." The court noted that Congress passed the FCRA and the Privacy Act within a few months of each other with "the purpose of protecting an individual's right of privacy from being violated by the disclosure of private information," and provided for similar remedies in the two laws. The court noted that the FCRA creates a private right of action for recovery of "actual damages" caused by a negligent or willful violation of that law, and that courts have held that "actual damages" under the FCRA encompass damages for emotional distress. Noting the presumption that Congress intends identical text in similar statutes to have the same meaning, the court reasoned that this FCRA interpretation of "actual damages" supported its construction of the Privacy Act to mean that actual damages under the Act include both pecuniary and nonpecuniary damages.

Finally, the Ninth Circuit rejected the district court's application of the sovereign immunity canon in the government's favor, construing actual damages narrowly to encompass only pecuniary damages. The court noted that "[i]n light of the inherently noneconomic interests central to the Act, we cannot plausibly construe actual damages under the Act to exclude nonpecuniary damages."

Disagreement among the Circuits

In Chao, the Supreme Court case holding that actual damages are a necessary component of a Privacy Act claim, the Court noted the disagreement among the courts of appeals on "the precise definition of actual damages," but did not specifically address that issue.

The Fifth Circuit, like the Ninth Circuit in Cooper, embraces a broad view of what constitutes "actual damages" for purposes of a Privacy Act claim. Specifically, that court has held that "the term 'actual damages' under the Privacy Act does indeed include damages for physical and mental injury for which there is competent evidence in the record, as well as damages for out-of-pocket expenses" Johnson v. Treasury Department, 700 F.2d 971 (5th Cir. 1983). The Tenth Circuit has reached a similar conclusion. The Eleventh Circuit, by contrast, has held that the Privacy Act does not allow recovery for mental injuries and other nonpecuniary losses. The Sixth Circuit has reached a similar conclusion.

The Supreme Court Declines to Shed Light on the Issue

The Supreme Court recently denied certiorari in Perkins v. U.S. Dept. of Veterans Affairs, No. 09-513, a putative class action in which the Eleventh Circuit held that plaintiffs whose personal information was compromised as part of the theft of a safe from the Department of Veterans Administration could only recover monetary damages under the Privacy Act for "proven pecuniary losses"-not for generalized mental injuries, loss of reputation, embarrassment or other nonquantifiable injuries. This decision to deny review maintains the circuit split regarding whether nonpecuniary damages such as emotional distress are sufficient to establish "actual damages" for purposes of a Privacy Act recovery. Accordingly, plaintiffs in Privacy Act cases who suffer only nonpecuniary damages can face markedly different outcomes depending on their choice of forum.