The Freedom of Information Act has many cul-de-sacs, and from my perspective one of the most difficult is where the Privacy Act intersects the Freedom of Information Act.
Here in Washington we have the same issue with state level law. People know about these laws in a generic sense. There’s RCW 42.56, Washington’s public disclosure statute, and in it we have privacy provisions. We also have RCW 9.73, which defines liability for invasions of privacy. The City of Seattle also has ordinances, like Surveillance Ordinance 125679, which incorporate privacy principles and applies them to City departments. However, combining the two is a mystery.
For now, however I want to talk about just FOIA and the Privacy Act. Half because I don’t want to talk at you about my job every newsletter and half because keeping it federal gives me an excuse to talk about one of my favorite cases (Paige v. DEA, more on that in a moment).
Part of the difficulty with the two federal laws is as it sounds. The Privacy Act is about privacy. FOIA is about disclosure. There is an inherent antagonism.
For example, one of the larger differences between FOIA and the Privacy Act is that the Privacy Act applies to some records that are not maintained by an agency whereas FOIA generally only applies to records maintained by an agency. Subsection (m) of the Privacy Act says when an agency provides by contract for the operation of a system of records on its behalf, the requirements of the Privacy Act apply to those records. If an enterprising FOIA requestor is thinking about a contracted companies’ records, they run into this doubled layer of protection where even if they could convince a judge the records really are the agency’s, the Privacy Act is waiting for them.
Conversely, plenty of personal information is not kept in a system of records — whether contracted or not. Personal information not kept in a system of records is generally not subject to the provisions of the Privacy Act, although access may be requested under the FOIA.
The other difficulty is that the Privacy Act has its own disclosure process, especially if you’re requesting documents about yourself. These access provisions overlap, but the two laws have different procedures and different exemptions. Information exempt under one law will be disclosable under the other.
For example, I want to bring readers attention to the following chart from IAPP.
Of course, in order to take maximum advantage of the laws, an individual seeking information about themselves should ordinarily cite both laws.
This, then, has some fun trickle-down effects within the federal world because generally agencies are told to treat FOIA Requests as Privacy Act request and vice versa as long as there is some “analysis” of the request under the respective statute. Only if a request is exclusively a Privacy Act request does it get excluded from FOIA tallies, which is like when you’re asking for just records of yourself (but not all of them). When agencies report on their FOIA burdens, they’re explicitly including many self-described Privacy Act requests. And that’s not just me saying it, that’s the rule promulgated by the Department of Justice.
As the reporting exemplifies, Congress doesn’t make it easy on either the requestor or the agencies. Often the question boils down to whether the record in the “system” is a record “about” the requestor in a “system.” “About” and “system” is like beauty. The definition depends on the eye of the beholder.
Sussman v. Marshall’s Serv.
1:03-cv-00610
As for a real-life example of how infinitely thin courts might slice the “about” salami, there was a great line of cases that culminated in Sussman v. Marshals Serv., 494 F.3d 1106, 1121 (D.C. Cir. 2007). Sussman lost and won based on how sufficiently “about” him records were about him and not about someone pretending to be him.
As for how this case happened, we need to go back to Sussman’s original claims. Sussman raised several claims that could be grouped into two categories. First, claims regarding records truly “about” him. Two, claims regarding records the Marshall’s Service thought were “about” him but were about the person pretending to be Sussman.
The Marshall’s Service had investigated Sussman assuming that he was an alias of a criminal called Keith Maydak (who has his own, infinitely interesting appellate record). Sussman and Maydak were occasional business partners, and the thought was Sussman had pretended to Maydak (or vice versa) and the Marshall’s Service landed on the true criminal being Sussman.
Allegedly, Maydak aka Sussman had threatened elected officials. The Marshall’s Service investigated, and as part of the investigation shared records otherwise protected by the Privacy Act with third parties, including Sussman’s other business associates.
Naturally, having uniformed officers tell your business partners and friends that you are being investigated for being a maniac with a second identity stolen from another business partner is eye opening. Importantly, Sussman’s claim that the Marshall’s Service had messed up his life began with the fact the Marshall’s Service had played fast and loose with Sussman’s actual private records during the investigation.
From there, Sussman’s position was that not only should Sussman be compensated for the Marshall’s Service disclosing Sussman’s actual records, but Sussman was also the right person the court should compensate for the disclosure of records purportedly pertaining to him vis-a-vis Maydak.
Not to be too reductive, but in a word fake-Sussman records were still “about” Sussman.
What Sussman ran into with proving this second group of claims is, as the court reasoned, "[i]f an individual is named in a record about someone else . . . and the agency only retrieves the portion pertaining to him by reference to the other person's name . . ., the agency is not required to grant him access.” In other words, now that the Marshall’s Service realized their mistake, they weren’t letting Sussman into the fake-Sussman files.
Ultimately, this made Sussman’s second category of claims fail.
However, as the reasoning implies, it’s both a sword and shield. If Sussman can’t get access to Maydak-pretending-to-be-Sussman records, then the Marshall’s Service shouldn’t have been handing out access for records “about” Maydak under the theory that Sussman records were “about” Maydak. So, Sussman received money for the records that were explicitly about Sussman.
One of the molehills I’d die on is that the district judge who first adjudicated in favor of the Marshall’s Service, and against Sussman, who was then partially overruled by the D.C. Circuit in the cite above, and then found in favor of Sussman on remand, came to two opposite albeit justifiable conclusions about whether Sussman deserved money. The salami of “about” can be sliced very finely.
Paige v. Drug Enforcement Administration
1:06-cv-00644-JDS
To begin with, this is one of my favorite cases. The facts are great, and legally I can’t imagine a better example of how fact specific courts can take “system of records.”
Paige, a DEA agent, was speaking at a high school about the dangers of drugs and guns. During the presentation, Paige displayed his DEA-issued firearm while discussing gun safety. While telling the audience that firearms should be handled only by professionals like himself his firearm accidentally discharged, and he shot himself in the thigh.
One of the parents in attendance video-recorded Paige's demonstration including the accidental discharge on a Mini-DV cassette tape. The cassette tape is handed over to the DEA, who investigate all officer involved shootings, and so that chapter of the case ends.
However, the video eventually reaches the internet. Paige is furious. His theory is that when the DEA investigated the shooting someone leaked it from the DEA. He argued that the video was copied from a record contained in a system of records, that is, the Mini-DV.
The court, however, stopped Paige right there. Even if Paige was right it wouldn’t matter. The court reasoned that even if the DEA had copied the record (which they probably had) the Mini-DV was not a covered record at the time the video of him shooting himself was copied from it because the information on the Mini-DV was not retrievable by Paige's name or anyone else’s. The Mini-DV was simply there, as evidence, and someone made a copy of it.
Paige argued that the DEA’s evidence file itself (which was called an “IN” file), was a "system of records” because it was created automatically when IN was notified of Paige's accidental discharge.
Again, not so fast the court reasoned. Retrieval capability is not sufficient to create a system of records.
The court further reasoned that even if Paige was right, his timing was all off.
At some point between April 19 and April 21, Gruden gave the Mini-DV to the IN inspectors who then placed the Mini-DV in the IN file. Upon its inclusion in the IN file, the Mini-DV was then contained in a system of records because the IN file was both "retrievable by personal identifier and actually retrieved by personal identifier." Id. (emphasis in original; internal quotation marks omitted). By then, however, the 4:09 video had already been copied from the Mini-DV. And disclosure of the 4:09 video was not prohibited under the Privacy Act simply because the Mini-DV subsequently became a "record which is contained in a system of records."
In other words, there’s this Mini-DV. It’s not a part of a system of records when it is made. The Mini-DV is placed in this file. It’s still not a part of a system of records because there was no retrieval capability, it was simply a file like a redwall. And even if it was a system of records, the system of records was not applicable to him because it was not retrievable by his name when the copy happened.
Relevant here would be a copy of the transcript of the argument on the issue. Note here the DEA’s attorney is speaking.
And that’s that for today! I hope you enjoyed.
(edit: I edited this newsletter again minutes after publishing, finding two or three unforgivable typos.)
Many thanks. Although I’m not in the US, it’s always interesting to hear your take on what’s going on across the pond. Some fascinating cases and backstories.
Freaking hysterical: Paige v. Drug Enforcement Administration 🤣🤣 starting with unprofessionally taking a loaded firearm into a school, and end with the lecture about firearms should be handled by a professional 🤣🤣