# Beaven v. United States Department of Justice > Court of Appeals for the Sixth Circuit · September 27, 2010 · 622 F.3d 540 URL: https://www.frixlaw.com/law-library/cases/9438428 ## Case - **Full name:** Mary Ellen BEAVEN Et Al., Plaintiffs-Appellees/Cross-Appellants, v. UNITED STATES DEPARTMENT OF JUSTICE Et Al., Defendants-Appellants/Cross-Appellees - **Court:** Court of Appeals for the Sixth Circuit - **Decided:** September 27, 2010 - **Citations:** 622 F.3d 540; 31 I.E.R. Cas. (BNA) 395; 2010 U.S. App. LEXIS 19927 - **Precedential status:** Published - **Opinion:** Dissent by Kennedy - **Judges:** Kennedy, Moore, White - **Cited by:** 166 later opinions in the Frix Law Library ## Citator (automated) - No negative treatment found by the automated citator. That is not the same as a confirmation that the case is good law; read the citing cases. - Full citator and citing cases: https://www.frixlaw.com/law-library/cases/9438428 ## How later opinions describe it (automated extraction) - explaining that relevance in spoliation context requires “some showing indicating that the destroyed evidence would have been relevant to the contested issue” (quotation marks and citation omitted) - stating that a party seeking an adverse inference instruction must establish, among other things, that the destruction of evidence was caused by “the party having control over the evidence” - noting that "an adverse inference is usually only permissive for the factfinder" - concluding that plaintiffs could claim damages for "lost time" spent "dealing with the disclosure" of their Bureau of Prison personnel files ## Opinion text CORNELIA G. KENNEDY, Circuit Judge, dissenting. Because I do not agree that bringing an unlabelled folder containing Plaintiffs’ Privacy Act-protected information into an unsecured workspace rose to the level of “intentional or willful” agency action under 5 U.S.C. § 552a(g)(4), I must respectfully dissent. The majority affirms the district court’s award of Privacy Act damages to Plaintiffs, upholding the district court’s conclusion that Defendants “acted in a manner which was intentional or willful” as required by § 552a(g)(4), despite that court’s finding that the final act resulting in disclosure — Jones’s leaving the folder unsecured on Moore’s desk — was inadvertent. In order to support its ruling, the majority reads the Privacy Act-to allow a court to consider “the entire course of conduct that resulted in [a violation]” when determining whether an agency acted intentionally or willfully under § 552a(g)(4). Maj. Op. at 551. While I agree with the substance of this interpretation, I would limit the “intentional or willful” inquiry to those agency actions that have a direct causal connection to the Privacy Act violation. As I read § 552a(g)(4), its application to suits brought under § 552a(g)(1)(D) implies that the agency’s relevant actions are only those that constitute a failure to comply with a provision of the Privacy Act. Otherwise I fear that too wide a range of agency conduct could be swept within the “intentional or willful” analysis. Basing a finding of “intentional or willful” conduct on agency actions that are not causally connected to a Privacy Act violation would subvert Congress’s efforts to strike a balance between providing an appropriate damage remedy to victims of Privacy Act violations and safeguarding the government from crippling liability under the Privacy Act. See Privacy Act of 1974, Pub.L. No. 93-579, § 2 (b)(5), 88 Stat. 1896 , 1896 (1974) (“The purpose of this Act is to provide certain safeguards for an individual against an invasion of personal privacy by requiring Federal agencies ... to ... be subject to civil suit for any damages which occur as a result of willful or intentional action which violates any individual’s rights under this Act.” (emphasis added)). This balance is evident in Congress’s decision to select “intentional or willful” conduct as the standard of recovery for Privacy Act damages, instead of the stricter “willful, arbitrary or capricious” standard originally favored by the House of Representatives or the more lenient negligence standard proposed by the Senate. See Analysis of House and Senate Compromise Amendments to the Federal Privacy Act, reprinted in 120 Cong. Rec. 40,405, 40,406 (1974). It has also served as a guiding principle for several courts construing § 552a(g)(4). See, e.g., Albright v. United States, 732 F.2d 181, 189 (D.C.Cir.1984) (“[T]he ‘intentional or willful’ action requirement of Section 552a(g)(4) refers only to the intentional or willful failure of the agency to abide by the Act, and not to all voluntary actions which might otherwise inadvertently contravene one of the Act’s strictures.” (emphasis added)), abrogated on other grounds by Doe v. Chao, 540 U.S. 614 , 124 S.Ct. 1204 , 157 L.Ed.2d 1122 (2004). Applying this principle to Plaintiffs’ claim, when determining whether Defendants acted intentionally or willfully we should consider only those acts of Defendants that played a part in causing the unauthorized disclosure of Plaintiffs’ protected information. “An agency acts intentionally or willfully ‘either by committing the act without grounds for believing it to be lawful, or flagrantly disregarding *561 others’ rights under the [Privacy] Act.’ ” Mount v. U.S. Postal Serv., 79 F.3d 531 , 533 (6th Cir.1996) (alteration in original) (quoting Wilborn v. Dep’t of Health & Human Servs., 49 F.3d 597, 602 (9th Cir.1995)). As the majority notes, Defendants’ actions were not “intentional” since the district court concluded that “leaving the folder unsecured on Moore’s desk was inadvertent.” Beaven v. U.S. Dep’t of Justice, No. 03-84-JBC, 2007 WL 1032301 , at *17 (E.D.Ky.2007). Therefore, Plaintiffs must prove that Defendants acted willfully by showing that Defendants flagrantly disregarded their rights under the Privacy Act through actions that made a prohibited disclosure unreasonably likely to occur. Based on the district court’s factual findings in this case, I do not believe Plaintiffs satisfied their burden. The district court determined that “Jones’s conscious decision to ignore the risks associated with bringing unmarked confidential information into an area to which inmates have access” qualified as “willful” conduct under § 552a(g)(4). Id. 1 The district court’s opinion did not explain what acts prior to leaving the documents on Moore’s desk were relevant to its determination; it relied only on the eonclusory testimony of Plaintiffs’ expert that “the information was handled in reckless disregard of the Privacy Act and relevant guidelines.” Id. However, I do not see how Jones’s actions evidenced a “reckless disregard” of the danger that unauthorized persons would access the file. Jones carried the folder into an area where no one was present except himself and two experts from Washington, D.C. sent by the BOP to audit staff and prisoners’ computer use. Inmates and other prison personnel did not have access to this workspace during the night-time hours Jones would be working; they were to return to the area the next day, 2 a time when, except for Jones’ inadvertence, the folder would have been returned to his secure office. Jones’s decision to bring into an unsecured workspace more information than necessary to complete the investigation and his failure to properly label the information as “LOU-Sensitive” are clearly negligent. Nevertheless, since Jones fully intended to return the folder to the security of his office once he had completed his work and his failure to do so was merely inadvertent, I cannot view this as an “extraordinary departure from standards of reasonable conduct.” Kostyu v. United States, 742 F.Supp. 413, 417 (E.D.Mich.1990). 3 Though I believe that Jones’s ac *562 tions might rise to the level of “willful” if his or other FMC employees’ conduct established a pattern of mishandling sensitive information, the evidence does not support such a finding; instead, it indicates that Jones did not ordinarily take the file out of his secure office, and prior exchanges of this information between employees were made by hand without mishap. For these reasons, I would reverse the district court’s award of Privacy Act damages to the Plaintiffs based on a violation of § 552a(b). This ruling requires me to consider Plaintiffs’ cross-appeals for alternative grounds of relief. Plaintiffs first contest the district court’s summary judgment ruling denying its claim for Privacy Act damages based on Defendants’ failure to follow BOP rules governing security procedures for sensitive information. Section 552a(g)(1)(D) provides a damage remedy for an agency’s “fail[ure] to comply with any other provision of this section, or any rule promulgated-thereunder, in such a way as to have an adverse effect on an individual.” § 552a(g)(1)(D). Plaintiffs claim that the BOP Program Statements Jones disobeyed by failing to mark the folder and its contents as “LOU-Sensitive” before transporting it to an unsecured area constitute “rule[s] promulgated” under the Privacy Act, making Jones’s violation actionable under § 552a(g)(1)(D). The plain meaning and construction of § 552a suggests that “rule promulgated” as used in § 552a(g)(1)(D) refers only to an agency rule promulgated under the notice- and-comment procedures of the Administrative Procedure Act, 5 U.S.C. § 553 . “Promulgate” appears in three other subsections of § 552a, all of which explicitly reference § 553; for example, § 552a(f), entitled “Agency rules,” requires that “[i]n order to carry out the provisions of this section, each agency that maintains a system of records shall promulgate rules, in accordance with the requirements (including general notice) of section 553 of this title.” § 552a(f); see also § 552a(j) (“The head of any agency may promulgate rules, in accordance with the requirements (including general notice) of sections 553(b)(1), (2), and (3), (c), and (e) of this title .... ”); § 552a(k) (same). In contrast, the BOP Program Statement that forms the basis of Plaintiffs’ claim was created under § 552a(e), which requires an agency to “establish rules of conduct for persons involved in ... maintaining any record,” § 552a(e)(9) (emphasis added), and to “establish appropriate administrative, technical, and physical safeguards to insure the security and confidentiality of records,” § 552a(e)(10) (emphasis added). The difference in language between § 552a(f) and (g)(4) on the one hand, and § 552a(e)(9) and (10) on the other, suggests that “rules of conduct” or “safeguards” “established” under § 552a(e)(9) and (10) are not within the damage remedy provided in § 552a(g)(4) for an agency’s failure to comply with “rules promulgated.” See also Office of Mgmt. & Budget, Privacy Act Guidelines — July 1, 1975, 40 Fed.Reg. 28,949, 28,969 (July 9, 1975) (“In addition to the grounds specified in subsections (g)(1)(A) through (C) above, an individual may bring an action for any other alleged failure by an agency to comply with the requirements of the Act or failure to comply with any rule published by the agency to implement the Act (subsection (f)).... ”). Because a BOP Program Statement is not a rule promulgated through the notice-and-eomment process, see Reno v. Koray, 515 U.S. 50, 61 , 115 S.Ct. 2021 , 132 L.Ed.2d 46 (1995) (describing a BOP Program Statement as an “internal agency guideline” that is “akin to an ‘interpretive rule’ that ‘do[es] not require *563 notice and comment’ ” (alteration in original) (quoting Shalala v. Guernsey Mem’l Hosp., 514 U.S. 87, 99 , 115 S.Ct. 1232 , 131 L.Ed.2d 106 (1995))), the district court correctly concluded that its violation is not actionable under the Privacy Act, and I would affirm the grant of summary judgment to Defendants on this claim. Plaintiffs have two remaining cross-appeals 4 based on the district court’s dismissal of their Federal Tort Claims Act (“FTCA”) claim for outrageous conduct and its denial of their motion for sanctions against Defendants. Plaintiffs’ FTCA claim alleges that Defendants committed the tort of outrage through “Jones’s improper access to the information in the folder, the failure to properly mark the documents or folder, the transportation of the folder without taking appropriate security precautions, leaving the folder unsecured in UNICOR, and FMC’s fail[ure] to timely report to OIA the result of FMC’s inquiry into Jones’s handing of the Marion Johnson incident.” Beaven, 2007 WL 1032301 , at *26. 5 The district court dismissed this claim as moot, finding that “plaintiffs’ damages are adequately compensated by the award under the Privacy Act.” Id. at *27 . Because I would make Plaintiffs’ FTCA claim no longer moot by overturning their damage award, I would remand this claim to the district court. Plaintiffs’ motion for sanctions against Defendant for its destruction of the folder and for misrepresentations related to the folder made during discovery was denied by the district court on similar grounds. Because it had already imposed the non-monetary sanction of the adverse inference of disclosure, which was dispositive of Plaintiffs’ Privacy Act claim, and because Plaintiffs were entitled to move for attorneys’ fees as a prevailing party under the Privacy Act, the district court concluded that further sanctions would be unjust under the circumstances and were not necessary to deter similar future abuses. Reversing the district court’s ruling for Plaintiff on their Privacy Act claim takes the substance out of the district court’s adverse inference and forecloses Plaintiffs from receiving attorneys’ fees under the Privacy Act, so I would therefore remand Plaintiffs’ motion for sanctions to the district court. In summary, the record in this case does not support a determination that Defendants acted intentionally or willfully as required by the Privacy Act in order for Plaintiffs to recover damages from Defendants’ inadvertent disclosure of protected information; I find unavailing the majority’s attempt to use Defendants’ negligent acts — namely, the failure to label the folder containing the prison employees’ protected information. as “LOU-Sensitive,” and Jones’s transferring of the entire folder, rather than only the information needed to perform the investigation of the computers, to an area that, though unsecured, was closed to prison employees and inmates during the night — to transform Jones’s inadvertent failure to take the folder back to his secure office into an “intentional or willful” disclosure. For this reason, I respectfully dissent. I would reverse the district court’s judgment holding Defendants liable for Plaintiffs’ Privacy Act claim premised on unauthorized disclosure. On Plaintiffs’ cross appeals, I would affirm the district court’s grant of sum *564 mary judgment to Defendants on Plaintiffs’ Privacy Act claim premised on Defendants’ violation of internal BOP policies. I would reverse the district court’s dismissal of Plaintiffs’ FTCA claim and its denial of Plaintiffs’ motion for sanctions and remand both issues to the district court for reconsideration. . The record indicates that all of the agency’s acts relating to the disclosure were Jones’ acts, except the initial failure to place the “LOU-Sensitive” label on the information lists he carried in the folder before they were turned over to Jones for his use every quarter. Since I do not think that a failure to label the lists could be a cause of the disclosure — it had been the practice for years without incident— I do not consider this action pertinent to the willfulness inquiry. . While the office was not occupied after 7:00 PM by either staff or inmates, inmates' access began at 7:00 AM, a time at which only a skeleton staff was present in the area. The employee on whose desk Jones left the folder started work at 9:00 AM, though evidence indicates it would take her at least twenty minutes to reach her desk after entering the prison complex. Therefore, at most there was only a two-hour-and-twenty-minute window during which the folder sat unsecured and capable of being read by inmates. .The majority points out that Jones violated BOP Program Statements by transporting the unlabelled folder into an unsecured area, and that “[a] plain failure to comply with established [agency] policy might constitute 'willful' or 'intentional' conduct actionable under § 552a(g)(4).” White v. Office of Pers. Mgmt., 840 F.2d 85, 87 (D.C.Cir.1988). However, given that Jones was aware of the sensitive nature of the information contained in .the folder and he intended to return it to his office once he had completed his work, I do not think his violation of BOP policy has a sufficiently direct causal connection to the *562 disclosure to support a finding that he acted willfully. . I need not consider the fourth issue Plaintiffs assert on cross appeal- — whether the Privacy Act allows recovery for “lost time” and "future protected measures” as “actual damages” — because I do not think Plaintiffs have stated a valid Privacy Act claim. . In their original complaint, Plaintiffs included more of Defendants' actions as the basis of their outrage claim. However, the district court dismissed several of these counts for lack of jurisdiction, and Plaintiffs do not appeal this ruling. --- Source: Frix Law Library, https://www.frixlaw.com/law-library/cases/9438428. Public record. Not legal advice.