Oral argument — Richard Chichakli v. Rex Tillerson

16-5258 Richard A. Chichakli, Appellant v. Rex W. Tillerson, U.S. Secretary of State, and his official capacity et al. Ms. Turner for the amicus curiae, Ms. Murren for the appellees Thank you. May it please the Court, my name is Kimball Turner and I am arguing as Court-appointed amicus in support of Appellant Richard Chichakli I'd like to reserve two minutes of my time for rebuttal Simply put, the defendants cannot rely on the routine use exception to justify broadcasting an individual's Social Security and driver's license numbers to the general public via the Internet Such disclosures are anything but routine The driver's license was Australian, right? That's correct Does Australia protect the privacy of driver's license numbers? And if so, where's the allegation to that effect? For all we know, that's public information I don't know about Australian law, Your Honor Well, then if the claim fails on that ground alone Your Honor, even if you believe that the driver's license number was not protected, the Social Security number certainly should be protected Well, that's a different story if you're focusing on the driver's license Yes, I don't know about Australian law I would be happy to submit a supplemental brief on that matter As to the Social Security number, we have been unable to locate and the government has not pointed to any Privacy Act decision upholding broad public disclosure of those numbers And that's for good reason These identifiers are uniquely sensitive and their public availability renders someone particularly vulnerable to identity fraud which is exactly what happened here On these facts, and given that Mr. Tachakli filed his complaint pro se he has adequately pled a violation of the Privacy Act and we ask that this Court reverse the District Court's dismissal of his complaint As to the routine use exception, which the government relies so heavily on this cannot fall within that exception for two reasons The disclosure was not compatible with the purposes for which the information was collected and it is not consistent with the purposes of the Privacy Act This Court, as Judge Kavanaugh knows from Ames and Judge Randolph knows from Letter Carriers has not resolved the meaning of compatible and it need not do so here Under either definition of that term, whether it's Judge Silverman's view that it has to meaningfully converge with the purpose for which the information was collected or whether it's Judge Williams' view that there can be simply no conflict between the collection and the disclosure the appellant would prevail Under the meaningfully converge standard, he would prevail because the general public does not meaningfully require Social Security members to effectuate law enforcement or sanctions enforcement objectives Aren't banks part of the general public? They are Financial institutions Yes, and we concede that the defendants could disclose Mr. Tkachakli's Social Security number to financial and governmental institutions My understanding, and it's not in the record and this is exactly why we would like a remand for factual development is that agencies within the Treasury Department already routinely send information securely to banks and other financial institutions on a bi-weekly basis And if this court were to adopt Judge Williams' view that there simply can be no conflict between the purpose for which the information was collected and the disclosure we submit that there is a conflict between the purpose of collection and the purpose of disclosure here What's the conflict? Because although the agency has collected the information in order to effectuate the sanctions regime and it has reports that it has released that information to effectuate the sanctions regime public availability of Social Security number actually undermines identification of individuals on that list because it allows people to impersonate them and it increases the likelihood that people will conduct transactions in their name which is exactly what Mr. Tkachakli alleges happened here That sounds like a good policy argument, but isn't the government in a better position to know whether what you just said is accurate, whether it's really going to undermine the purposes of the program? Well, I'm certainly not asking you to second-guess the judgment of the agency but just as a common-sense principle, individuals don't ask for Social Security numbers routinely in engaging in small transactions in which financial institutions wouldn't otherwise be involved So if I go down to a corner store and I want to buy soda from someone although I have an obligation not to transact with people on the SDN list I'm not going to ask him for a Social Security number and if he gave it to me, he probably wouldn't give me his real one So having Social Security numbers publicly available simply doesn't further the objective for which the information was collected and again, it actually undermines the objective because it allows people to impersonate individuals on this list and engage in transactions which are intended to be barred by the relevant statute But given the fact that so many people have the same name isn't it reasonable to have a Social Security number on the list because that's a unique identifier? No, Your Honor. We identify people without Social Security numbers all the time and while it's true that individuals often have the same name again, financial institutions are going to be involved in most transactions and they will have individual Social Security numbers so they can assure that accounts are not opened in their name or that large-scale transactions are not occurring and in terms of the sort of smaller cash-based transactions that banks are not involved in people do not meaningfully use or require Social Security numbers There's no reason why the general public needs that information to effectuate What if Mr. Chichokle wants to become a real estate agent or join the D.C. Bar or become a member of the treasurer of his homeowner's association? How are those people going to be aware that they're not supposed to transact with him? Sure, so it might be a little bit case-by-case, but in the bar circumstance again, we concede that government institutions could receive a Social Security number The bar isn't a government institution. The D.C. Bar is. I guess that's true. But when I applied for the bar, I had to submit a routine credit check or I had to submit a credit report and your credit report reflects whether or not you are on the SDN list There's an OFAC publication that we cite in our brief that specifically makes that point that anyone can run a credit check or submit a credit check and it will reflect this status Social Security numbers are simply not meaningfully required to effectuate these counterterrorism or law enforcement objectives And just before I sit down before rebuttal, I just wanted to note that Chichokle has adequately pled damages on page 48 of the appendix where he specifically pleads that he lost thousands of dollars to identity thieves Also, the statute of limitations does not provide an alternative basis for affirmance because it is not clear from the record that Mr. Chichokle has not fell within the statute of limitations and this Court has explained that that is a basis for affirmative affirmance only where it is clear from the record. Thank you. Thank you. May it please the Court. Flora Myron for the government. I'd like to begin with the question of the role of Social Security information in the implementation of OFAC sanctions and the assertion that it undermines the efficacy of the program That is not supported by the facts on the ground both in this case and in others Social Security information is used not only to identify those individuals who are properly subject to sanctions but also, importantly, to distinguish individuals who are not As you mentioned, Judge Wilkins, there are a number of individuals who have similar names individuals who have many aliases especially individuals who are subject to this list often have many aliases or many known birth dates and that information is not always enough to be able to identify both the proper individual subject to the sanction and also to distinguish individuals who are not It is part of OFAC's consideration and very reasonably so that this program be targeted in such a way that it is limited only to those individuals properly subject to the sanction It is a very significant and burdensome sanction It is a prohibition on engaging in any commercial transactions in the United States and as a result, the agency has a significant interest in ensuring that it is only applied to those people to whom it is properly to whom it is properly subject to the prohibition What was the first system of records notice that said that public disclosure of Social Security numbers would occur? When was that promulgated? The first system of records notice that expressly references the general public is the 2010 disclosure There have been systems of records notice in place long before that since long before Mr. Ciaccioccoli's information was published and OFAC has always considered the publication and dissemination of this information as part of the implementation of sanctions to be covered by systems of records notices that are in place But how do you square that with our case law about it needing to be explicit in the system of records notice? I certainly think the language of the system of records notice would cover the dissemination here The one that was in place in 2002 references third parties which would certainly encompass financial institutions, individuals, the public, etc. I might also put a pin in this and suggest that Mr. Ciaccioccoli did not make this argument below and was not properly before this court but OFAC has always believed that the dissemination of information in this manner was covered by the system of records notice that was in place going back well before the publication of Mr. Ciaccioccoli's information in 2005 But how can that be when the system of records notice doesn't say anything about Social Security numbers? It does reference personal information information that would be relevant to the holding of assets and I think given the use of Social Security information that is pervasive in the financial world that it is very reasonable for OFAC to consider the inclusion of Social Security information as covered by that system of records notice But the whole purpose of this is so that the public and others can weigh in and promulgate that regulation and so that issue can be debated and aired and the agency can take into consideration people's privacy and other concerns and then potentially amend the regulation or try something on a trial basis, etc. There are lots of things that agencies do in response to public comment. Where was the public debate about this issue? Well, as I said, OFAC has been disseminating information in this manner since long before Mr. Ciaccioccoli's information has been doing so consistent with the system of records notice issue at that time and didn't see any suits of similar nature or complaints about the dissemination of information as an impermissible routine use. So there hasn't been that kind of discussion even though this has been going on for a long time and certainly is covered by the system of records notice that was at issue in 2010 and we haven't seen objection or debate about it under that system of records notice either. The Treasury notice in 2005 that you mentioned and you mentioned that there's an exception or a routine use for disclosure to third parties but it's for during the course of an investigation to the extent necessary to obtain information pertinent to the investigation. How does that fit here? OFAC considers these both to be implementations and also ongoing investigations. They continue to collect information from financial institutions and other kinds of entities about instances in which individuals who are subject to sanction attempt to engage in transactions in the United States. They also continue to collect information about individuals subject to sanctions that might speak to the propriety of continuing those sanctions. So the fact that they're disseminating information to entities that might be transacting or where individuals might be attempting to transact business with those is part of ongoing investigation by the agency and certainly falls within the system of records notice that was published at that time. And if I may speak just briefly to the assertion that somebody who is buying something at the corner store doesn't need this kind of information, I would say in response that the information is disseminated much more widely than just financial institutions and government institutions. It goes to car dealerships, to real estate agents, to employers, to landlords. And those are the kinds of institutions that are also obligated not to transact with individuals subject to this list. And OFAC gets compliance calls from car dealerships all the time. So it is certainly the case that this information is being used by entities more broadly than just financial institutions in order to implement these kinds of sanctions. And for the purpose of buying something at the corner store, OFAC issues what are called living licenses, which allow people to engage in low-level transactions even within the implementation of this kind of program. But, I mean, you just kind of undermine your argument by saying OFAC gets calls all the time. I mean, you could serve the same and achieve the same goal by publicizing a list of names and then on the Internet, and then if somebody sees the name and they don't know whether it's the right person, they could then run a credit check or contact OFAC, and OFAC could look up in their database and confirm whether it's the same person, right? It's certainly true that other systems might be workable, but the question before this Court is whether this permissible, this is a permissible routine use under the Privacy Act. And in order to answer that question, we look both to whether it's compatible with the purpose for which the information was collected, which certainly it is in this instance, and second, to whether it's consistent with the purposes of the Privacy Act. And the purpose of the Privacy Act is not to restrict the disclosure of information to the least intrusive means possible. The purposes of the Privacy Act are to routinize the collection, maintenance, and dissemination of personal information by the government. And there are a number of exceptions within the statute that allow... So the word privacy and Privacy Act, we should just kind of ignore that? I'm not sure I understand your argument. The purpose is just to routinize disclosure? Privacy doesn't have anything to do with what we're talking about? I might point you to Judge Randolph's dissent in National Association of Letter Carriers in which he discusses that routine uses and disclosure of information are permissible under the Privacy Act when they're justified by a substantial public interest. And the point is not to prohibit disclosure. It's to ensure that when the government does disclose information, it has made a consideration of the substantial public interest and a consideration of the privacy interests at stake as well. And certainly in this case, there's a substantial public interest in the disclosure of information, and there's consideration of the fact that this kind of information will further the purposes of the OFAC sanctions program by ensuring that individuals who are properly subject to sanction are identified, and also individuals who are not properly subject to sanction are distinguished because, as I said, this is a very burdensome obligation not to be able to engage in any commercial transactions in the United States. So the agency does have an interest in ensuring the accuracy in the implementation of this program. What's our standard of review of, I guess, the scope of the routine use exception? I would think that what you would be considering is whether the agency has made a reasonable determination that the interest at stake here is compatible... with the disclosure and considering the substantial public interest at stake and whether the agency appropriately considered the public interest on one side and the privacy interest on the other. I see my time has expired. Thank you very much. To begin, you know, the government has suggested that any disclosure of information that furthers the identification of someone on the specially designated nationals list is permissible, but that simply cannot be correct. I mean, that rationale would allow OFAC to, for example, distribute flyers or put up posters put up a flyer that says, or include, for example, their DNA profile or their fingerprint, and that simply cannot be what compatible means. And while we don't dispute that the government has important sanctions enforcement and law enforcement prerogatives, this case shows that the current regime simply does not further those prerogatives in a meaningful way. Rather than preventing individuals on this specially designated nationals list from engaging in transactions, it actually increases the likelihood that transactions in their name will take place with their assets. That's exactly what Mr. Tkachakli has alleged here. But what about the idea that part of the policy here is to prevent innocent people from being ensnared who have the same name? Yes, but on the other hand, I mean, that is a valid government interest. On the other hand, you know, OFAC gets calls all the time, and it's not clear that the public availability of Social Security numbers, as opposed to the availability to government institutions and financial institutions, who would be running these sort of identity checks. Well, what about the point that, on your response to your corner store hypo, that car dealers and landlords and the like are using this information? Again, it seems unlikely to me that no financial institution is going to be involved in, for example, renting a car or paying your lease or your rental amount, your rent. There's going to be a rare person who pays those things in cash. So in general, a financial institution is going to be involved. And again, when I rented an apartment, I had to submit to a credit check. Finally, I just wanted to note that this is a pro se complaint, and Mr. Tkachakli has adequately fled all of the elements of the Privacy Act violation. Thank you. Thank you. Mr. Turner, you were appointed by the court to assist the court in this case. You've done an outstanding job, and the court thanks you. Case is submitted.