Beaven v. United States Department of Justice

RECOMMENDED FOR FULL-TEXT PUBLICATION
Pursuant to Sixth Circuit Rule 206
File Name: 10a0313p.06

UNITED STATES COURT OF APPEALS
FOR THE SIXTH CIRCUIT
_________________

X
Plaintiffs-Appellees/Cross-Appellants, -
MARY ELLEN BEAVEN et al.,
-
-
-
Nos. 08-5297/5298/5317
v.
,
>
-
-
UNITED STATES DEPARTMENT OF JUSTICE et

Defendants-Appellants/Cross-Appellees. -
al.,
-
N
Appeal from the United States District Court
for the Eastern District of Kentucky at Lexington.
No. 03-00084—Jennifer B. Coffman, Chief District Judge.
Argued: December 3, 2009
Decided and Filed: September 27, 2010
Before: KENNEDY, MOORE, and WHITE, Circuit Judges.

_________________

COUNSEL
ARGUED: Steve Frank, UNITED STATES DEPARTMENT OF JUSTICE,
Washington, D.C., for Appellants. Douglas L. McSwain, STURGILL, TURNER,
BARKER & MOLONEY, PLLC, Lexington, Kentucky, for Appellees. ON BRIEF:
Steve Frank, UNITED STATES DEPARTMENT OF JUSTICE, Washington, D.C., for
Appellants. Douglas L. McSwain, Andrew DeSimone, STURGILL, TURNER,
BARKER & MOLONEY, PLLC, Lexington, Kentucky, for Appellees.
MOORE, J., delivered the opinion of the court, in which WHITE, J., joined.
KENNEDY, J. (pp. 26–32), delivered a separate dissenting opinion.
_________________

OPINION
_________________

KAREN NELSON MOORE, Circuit Judge. In this Privacy Act and Federal Tort
Claims Act case, the Defendants-Appellants/Cross-Appellees appeal the district court’s

1
Nos. 08-5297/5298/5317 Beaven et al. v. United States Dep’t Page 2
of Justice et al.

judgment, after a twenty-three-day bench trial, in favor of the Plaintiffs-Appellees/Cross-
Appellants on the Privacy Act claims. The Plaintiffs cross-appeal the district court’s
judgment in favor of the Defendants on the Federal Tort Claims Act claim, as well as a
variety of subsidiary issues. The Plaintiffs, a group of staff members at the Federal
Bureau of Prisons (“BOP”) Lexington, Kentucky, Federal Medical Center (“FMC”)
facility, alleged that the Defendants allowed an employee roster containing the Plaintiffs’
sensitive personal information to be disclosed to improper persons, namely prison
inmates and other BOP staff. The Defendants include the United States Department of
Justice, the BOP, the Attorney General, the head of the BOP, various FMC officials, and
the United States of America. The district court found that the responsible employee’s
actions resulted in a disclosure actionable under 5 U.S.C. § 552a(b) & (g)(1)(D) of the
Privacy Act, and that the actions were “intentional or willful” within the meaning of
5 U.S.C. § 552a(g)(4) such that the Plaintiffs were entitled to damages, even though the
employee’s final act of leaving the folder unsecured was “inadvertent.” For the
following reasons, we AFFIRM in part and REVERSE in part, and we REMAND for
proceedings consistent with this opinion.

I. FACTUAL AND PROCEDURAL BACKGROUND1

During an internal investigation of unauthorized inmate computer usage at the
FMC’s UNICOR work facility (“UNICOR”),2 Special Investigative Agent Walter Clint
Jones (“SIA Jones”) left behind a green file folder on a civilian employee’s desk that
included a roster of all FMC Lexington employees’ names, addresses, Social Security
numbers, home telephone numbers, pay grades, and other personal information (the
“folder”). Contrary to BOP Program Statements, the folder was not marked with “LOU-
Sensitive”3 or other required markings to indicate its contents. SIA Jones left the folder

1
The section is a summary of the district court’s lengthy findings of fact. Beaven v. U.S. Dep’t
of Justice, No. 03-84-JBC, 2007 WL 1032301, at *1–14 (E.D. Ky. Mar. 30, 2007) (unpublished opinion).
2
UNICOR is the trade name of Federal Prison Industries, Inc.
3
“LOU” stands for Limited Official Use.
Nos. 08-5297/5298/5317 Beaven et al. v. United States Dep’t Page 3
of Justice et al.

on the desk in the Project Management area of UNICOR around 3:00 a.m. on Thursday,
March 30, 2001. Staff began to admit inmates into this part of UNICOR beginning
around 7:30 a.m., and inmate Charles Kinnard arrived sometime between 9:50 a.m. and
10:00 a.m. Susan Moore, on whose desk the folder lay, did not arrive until sometime
after 9:50 a.m.; when she arrived she immediately discovered the folder and turned it
over to her acting supervisor, Mark Barnes, and their acting manager, James Jones. At
trial, three inmates testified that they saw inmate Charles Kinnard next to Moore’s desk
prior to her arrival, and two inmates, Mark Geralds and Terrell Harris, saw Kinnard
looking at something on Moore’s desk for at least two minutes. No civilian staff
members noticed this behavior. Although inmates are never present without staff
supervision, the Project Management employees do allow inmates with whom they work
to approach the staff members’ desks and to deposit and remove work papers.

James Jones, after meeting with Moore and Barnes, reported the incident to
Associate Warden Ann Mary Carter. Carter then met with Moore and Barnes, told them
the folder had been properly secured, asked them to submit memoranda explaining the
incident, and instructed them not to discuss the incident with anyone. Because the folder
was found on a civilian staff member’s desk, Carter believed that no disclosure had
occurred, and neither she nor anyone else ordered an investigation, lockdown, or
shakedown. The inmates were subjected to the normal pat-down searches prior to their
leaving Project Management at the lunch break and at the end of the workday. Warden
Maryellen Thoms later decided to treat SIA Jones’s act as a performance violation, and,
thus, the incident was not reported to the BOP Office of Internal Affairs (“OIA”).4

Soon after March 30, Moore contacted the Union Steward, but Thoms declined
to discuss the incident with anyone other than the Union President, with whom she met
in mid-April. On April 19, 2001, the Union filed an official grievance alleging that FMC
management violated the Freedom of Information Act and the Privacy Act, and

4
The district court found that Thoms’s and Carter’s explanations for their decisions during this
time period were “not consistent with FMC security practices and policies” concerning a security breach.
Beaven, 2007 WL 1032301, at *4.
Nos. 08-5297/5298/5317 Beaven et al. v. United States Dep’t Page 4
of Justice et al.

requesting that staff be advised of the incident and potential personal-security
implications. Scott Murchie, FMC Lexington Human Resources Manager, responded
and suggested that no action should be taken before evidence of disclosure was
available. The BOP Regional Director denied the grievance on May 4, 2001, citing the
absence of “specific proof that staff had their privacy compromised” as the reason not
to notify staff. Beaven, 2007 WL 1032301, at *6. Thoms later denied two staff
members’ requests for information under the Privacy Act related to any disclosure of
their personal information based on lack of proof of disclosure under the Privacy Act.
The Union referred the incident to the OIA on May 9, 2001, and then invoked arbitration
on May 29, 2001. The Union requested an accounting of disclosures, but Thoms denied
the request for lack of evidence that a disclosure occurred.

On September 17, 2001, Thoms issued the first memorandum to staff related to
the incident, but the memorandum included several factual inaccuracies—including
assertions that the folder was properly marked “LOU-Sensitive” and that it was
discovered at 9:00 a.m. after being left unattended since only 7:30 a.m.—and the
memorandum failed to state the incident date, the information in the folder, and whom
it affected. The memorandum closed by assuring staff of Thoms’s “commitment to
investigate [disclosure] allegations.” Id. at *8. The memorandum also offered assistance
from BOP attorneys in filing administrative tort claims if any allegations “prove
founded” because “we have yet to receive any documentation that inmates accessed the
file in question.” Id. After arbitration on October 30, 2001, Thoms issued a second staff
memorandum on December 17, 2001, but failed to correct inaccuracies or omissions
other than the incident date and information included in the folder. The December 17
memorandum again stressed Thoms’s “commitment to investigate allegations” of
disclosure and provide assistance if “such allegations prove founded.” R. on Appeal
(“ROA”) Vol. 1 (J.A.) at 707 (Pls.’ Exhibit 56). Sometime after the arbitration, but
before the second memorandum, Thoms instructed Murchie to destroy the folder when
he was moving to D.C. (Murchie had received the folder from SIA Jones in case it was
necessary for arbitration).
Nos. 08-5297/5298/5317 Beaven et al. v. United States Dep’t Page 5
of Justice et al.

On March 1, 2002, the Plaintiffs’ counsel filed administrative tort claims for
seventy-eight staff members, but the BOP denied the claims on August 26, 2002, based
on the claimants’ failure to produce evidence of actual disclosure to inmates. On
February 19, 2003, the Plaintiffs filed the instant suit asserting nine separate counts on
behalf of 106 staff members (adding six more staff and four additional counts in the
January 8, 2004, amended complaint). Counts One through Eight alleged violations of
the Privacy Act, Count Nine alleged a violation of the Social Security Act, and Counts
Ten through Thirteen alleged claims under the Federal Tort Claims Act. On cross-
motions for summary judgment, the district court on February 9, 2005, denied the
Plaintiffs’ motion and granted the Defendants’ motion on all counts except the
outrageous-conduct claim in Count Eleven, but on September 29, 2005, the district court
reinstated the claims of Privacy Act disclosure and common law invasion of privacy,
Counts One and Ten. The district court also granted the Plaintiffs’ motion to sanction
the Defendants for destroying the folder, and the court excluded testimony about the
Defendants’ inspection of the folder. A twenty-three day bench trial started on February
27, 2006. On March 30, 2007, the district court imposed the Plaintiffs’ requested
adverse evidentiary inference for spoliation, found that the Defendants had violated the
Privacy Act, and denied all other claims. On December 19, 2007, the district court
denied the Plaintiffs’ motion for discovery sanctions related to misstatements about the
folder’s labeling and destruction and entered judgment against the Defendants, awarding
damages of $1,000 each to all of the plaintiffs except two who had proved greater actual
damages.

II. ANALYSIS

The Defendants raise three issues on appeal: (1) Whether the district court erred
as a matter of law in holding that the alleged disclosure of the folder was “intentional
and willful” while also finding that the responsible employee’s act of leaving it in an
unsecured location was “inadvertent”; (2) Whether the district court abused its discretion
in adopting, as an evidentiary sanction for spoliation, a non-rebuttable inference that
“disclosure” occurred; and (3) Whether the district court abused its discretion in its
Nos. 08-5297/5298/5317 Beaven et al. v. United States Dep’t Page 6
of Justice et al.

alternative ruling that the Plaintiffs proved “disclosure” by a preponderance of the
evidence. On cross-appeal, the Plaintiffs raise only one issue that we must resolve,
contending that the district court erred in limiting “actual damages” recoverable under
the Privacy Act to preclude their claims for lost time and future expenses. Because the
Plaintiffs raise the three remaining cross-appeal issues only as alternative grounds for
relief, should this court overturn the district court’s Privacy Act decisions, we need not
reach these issues.5

We will address each pertinent issue in turn, mindful that “[o]n an appeal from
a judgment entered after a bench trial, we review the district court’s findings of fact for
clear error and its conclusions of law de novo.” Lindstrom v. A-C Prod. Liab. Trust, 424
F.3d 488, 492 (6th Cir. 2005). We “afford great deference to the district court’s factual
findings” if the findings “involve credibility determinations.” Id.

A. “Intentional or Willful” Finding

The district court found that SIA Jones’s course of conduct resulted in a
disclosure under the Privacy Act, specifically 5 U.S.C. § 552a(b) & (g)(1)(D), and that
his actions were “intentional or willful” within the meaning of § 552a(g)(4), although
his final act of leaving the folder unsecured was “inadvertent.” Before deciding whether
the district court erred in finding that SIA Jones’s actions satisfied the “intentional or
willful” standard of conduct, we must determine whether the district court erred in
looking to the entire course of conduct for its determination of whether “the agency acted
in a manner which was intentional or willful,” rather than looking to SIA Jones’s final
act of inadvertently leaving the folder on the desk.

Under § 552a(g)(1)(D), the Privacy Act provides a civil remedy to an individual
for an agency’s “fail[ure] to comply with any other provision of this section, or any rule

5
The remaining cross-appeal issues include: (1) Whether the district court erred in denying the
Plaintiffs’ motion for summary judgment by holding that a BOP Program Statement or Institution
Supplement is not a “rule promulgated” actionable under 5 U.S.C. § 552a(g)(1)(D); (2) Whether the district
court’s Privacy Act damages decision should not have mooted the FTCA outrageous-conduct claims; and
(3) Whether the district court’s adverse evidentiary inference and related Privacy Act damages decision
should have led the district court to grant the Plaintiffs’ motion for discovery sanctions.
Nos. 08-5297/5298/5317 Beaven et al. v. United States Dep’t Page 7
of Justice et al.

promulgated thereunder, in such a way as to have an adverse effect on an individual.”
5 U.S.C. § 552a(g)(1)(D). Thus, an individual may bring a civil action under
§ 552a(g)(1)(D) if he or she is adversely affected by an agency’s failure to comply with
§ 552a(b)’s requirement that “[n]o agency shall disclose any record which is contained
in a system of records by any means of communication to any person, or to another
agency, except pursuant to a written request by, or with the prior written consent of, the
individual to whom the record pertains.” 5 U.S.C. § 552a(b). Under § 552a(g)(4), a
Privacy Act plaintiff who can prove actual damages is entitled to recover the greater of
actual damages or $1,000 “[i]n any suit brought under the provisions of subsection
(g)(1)(C) or (D) of this section in which the court determines that the agency acted in a
manner which was intentional or willful.” 5 U.S.C. § 552a(g)(4).

The main issue before us is whether the requirement under § 552a(g)(4) that the
district court find that “the agency acted in a manner which was intentional or willful”
requires the court to find that the final act that resulted in the disclosure was “intentional
or willful” or whether the court may find that the entire course of conduct that resulted
in the disclosure was “intentional or willful.” No court has specifically interpreted
§ 552a(g)(4) in the light this panel must address; therefore we must engage de novo in
the analysis of what a court may consider in determining whether “the agency acted in
a manner which was intentional or willful.” As recently stated, we

employ[] a three-step legislative-interpretation framework established by
the Supreme Court: “‘first, a natural reading of the full text; second, the
common-law meaning of the statutory terms; and finally, consideration
of the statutory and legislative history for guidance,’” Lockhart v.
Napolitano, 573 F.3d 251, 255 (6th Cir. 2009) (quoting United States ex
rel. A+ Homecare, Inc. v. Medshares Mgmt. Group, Inc., 400 F.3d 428,
442 (6th Cir. 2005) (citing United States v. Wells, 519 U.S. 482, 490–92
(1997))). The “natural reading of the full text” requires that we examine
the statute for its plain meaning, including “‘the language and design of
the statute as a whole.’” Id. (quoting [United States v. ]Parrett, 530 F.3d
[422,] 429 [(6th Cir. 2008)]). “If the statutory language is not clear, we
may examine the relevant legislative history.” Parrett, 530 F.3d at 429.
Nos. 08-5297/5298/5317 Beaven et al. v. United States Dep’t Page 8
of Justice et al.

Elgharib v. Napolitano, 600 F.3d 597, 601 (6th Cir. 2010). We begin with the
recognition that the language of § 552a(g)(4) at issue is ambiguous. And although we
have not found any cases in which the court stated explicitly which actions a district
court may consider in determining whether “the agency acted in a manner which was
intentional or willful,” several Privacy Act cases are instructive.

In Doe v. Chao, the Supreme Court interpreted the interplay between
§ 552a(g)(1)(D) and § 552a(g)(4) to decide whether a plaintiff suing under
§ 552a(g)(1)(D) must prove “actual damages” under § 552a(g)(4) before he or she is
entitled to the statutory minimum under § 552a(g)(4). Doe v. Chao, 540 U.S. 614
(2004). Although the Court did not address the specific issue before this panel (because
the government did not challenge the finding that the agency acted in an intentional or
willful manner), the Court found that subsection (g)(1)(D) is intended to “deal with
derelictions having consequences beyond the statutory violations per se” and “speaks of
a violation when someone suffers an ‘adverse effect’ from any other failure [not covered
under subsections (g)(1)(A)–(C)] to hew to the terms of the Act.” Id. at 619. The
Court’s opinion can thus be read to endorse a broader interpretation of what actions a
court may consider in determining whether “the agency acted in a manner which was
intentional or willful.” Indeed throughout the opinion the Court referred to subsection
(g)(4) as covering damages for “an intentional or willful violation,” see, e.g., id. at
620–22, 627 (emphasis added), and Justice Ginsburg in dissent interpreted the language
of (g)(4) relevant for our purposes to cover “an agency’s intentional or willful
Nos. 08-5297/5298/5317 Beaven et al. v. United States Dep’t Page 9
of Justice et al.

commission of a Privacy Act violation of the kind described in § 552a(g)(1)(C) or (D).”6
Id. at 628 (Ginsburg, J., dissenting) (emphasis added).

Even though many courts have interpreted what “intentional or willful” means
under § 552a(g)(4),7 none have set forth an interpretation of what a court may consider
in determining whether “the agency acted in a manner” that meets this standard. Under
our precedent, Privacy Act damages are recoverable only if the Plaintiffs prove that the
Defendants acted “intentionally” or “willfully”—“a standard ‘somewhat greater than
gross negligence’”—“‘either by committing the act without grounds for believing it to
be lawful, or flagrantly disregarding others’ rights under the [Privacy] Act.’” Mount v.
U.S. Postal Serv., 79 F.3d 531, 533 (6th Cir. 1996) (quoting White v. Office of Pers.
Mgmt., 840 F.2d 85, 87 (D.C. Cir. 1988); Wilborn v. Dep’t of Health & Human Servs.,
49 F.3d 597, 602 (9th Cir. 1995)). We have noted that the Privacy Act is an attempt “‘to
strike a balance between the government’s need to collect and maintain information and
the privacy interests of the persons to whom such information pertains.’” Cardamone
v. Cohen, 241 F.3d 520, 524 (6th Cir. 2001) (quoting Hudson, 130 F.3d at 1204).

6
Justice Ginsburg further explained that subsection (g)(4)’s opening clause requires that “the
agency action triggering the suit under § 552a(g)(1)(C) or (D) must have been ‘intentional or willful,’”
and also phrased the condition as “intentional or willful conduct.” Doe, 540 U.S. at 629 (Ginsburg, J.,
dissenting) (emphases added). And although the majority opinion questioned the deference owed to the
1975 Office of Management & Budget (“OMB”) interpretations, id. at 627 n.11 (majority opinion), it is
useful to note that the OMB’s Privacy Act Guidelines interpret these subsections to provide for damages
“[w]hen the court finds that an agency has acted willfully or intentionally in violation of the Act,” Office
of Mgmt. & Budget, Privacy Act Implementation: Guidelines & Responsibilities, 40 Fed. Reg. 28,970
(1975), cited in Doe, 540 U.S. at 633 (Ginsburg, J., dissenting). In his separate dissent, Justice Breyer
remarked on the likelihood of recovery based on the “intentional or willful” requirement, finding that “the
lower courts have interpreted the phrase restrictively, essentially applying it where the Government’s
violation of the Act is in bad faith” and concluding that “[g]iven this prevailing interpretation, the
Government need not fear liability based upon a technical, accidental, or good-faith violation of the
statute’s detailed provisions.” Doe, 540 U.S. at 642 (Breyer, J., dissenting) (citing, inter alia, Hudson v.
Reno, 130 F.3d 1193, 1205 (6th Cir. 1997), cert. denied, 525 U.S. 822 (1998), abrogated on other grounds
by Pollard v. E.I du Pont de Nemours & Co., 532 U.S. 843, 848 (2001)).
7
The “intentional or willful” qualifying language of § 552a(g)(4) is present in at least two other
privacy statutes, the Electronic Communications Privacy Act of 1986, 18 U.S.C. § 2707(a) (granting relief
to those “aggrieved by any violation of this chapter in which the conduct constituting the violation is
engaged in with a knowing or intentional state of mind”) and § 2707(c) (“If the [unauthorized access to
electronic communications] violation is willful or intentional, the court may assess punitive damages.”);
and the Tax Reform Act of 1976, 26 U.S.C. § 6110(j)(2) (awarding damages under certain provisions if
“the Court determines that an employee of the Internal Revenue Service intentionally or willfully failed
to [comply with certain provisions]”).
Nos. 08-5297/5298/5317 Beaven et al. v. United States Dep’t Page 10
of Justice et al.

From our review of the cases in this area, we conclude that courts determining
whether a Privacy Act violation occurred have not differentiated between the final act
and the course of action that results in the final act, but rather courts generally look to
the entire course of conduct in context. In an early case interpreting § 552a(g)(4) in a
suit under § 552a(g)(1)(D) for a disclosure violation, the Tenth Circuit looked to the
entire course of conduct engaged in by IRS agents to find that the plaintiffs would be
able to allege “intentional or willful” agency actions on remand. Parks v. Internal
Revenue Serv., 618 F.2d 677, 683 (10th Cir. 1980) (considering allegations that the
agency published lists containing the plaintiffs’ personal information, furnished the lists
to IRS employees, and condoned the use of the information in the lists to contact the
plaintiffs for solicitations). Other circuit courts since have applied this reasoning, and
the D.C. Circuit has explicitly stated that “[t]he agency’s actions must be viewed in their
context to determine whether the agency’s staff acted in a willful or intentional manner.”
Waters v. Thornburgh, 888 F.2d 870, 876 (D.C. Cir. 1989) (citing Albright v. United
States, 732 F.2d 181, 189 (D.C. Cir. 1984)), abrogated on other grounds by Doe, 540
U.S. 614; id. at 876–77 (looking to, among other things, “the events that led up to
sending the letter” in finding genuine issue of material fact regarding intent); Albright,
732 F.2d at 189–90 (considering agency’s actions prior to and after decision to videotape
meeting, including subsequent offer to destroy videotape at issue, in finding actions not
intentional or willful); see also Dong v. Smithsonian Inst., 943 F. Supp. 69, 73 (D.D.C.
1996) (applying Waters and looking at agency’s notice of its obligations under the Act
and lack of effort to abide by Act prior to violation to find intentional or willful action
because reckless disregard for rights); Romero-Vargas v. Shalala, 907 F. Supp. 1128,
1131, 1133–34 (N.D. Ohio 1995) (finding intentional or willful disclosure based on
flagrant disregard where no effort made to comply with Act and each step that agency
employee took was in violation of internal guidelines and led to Act violation).

Without the aid of prior interpretations directly on point for what a court may
consider in determining whether “the agency acted in a manner which was intentional
or willful” and faced with admittedly ambiguous language, we will look to Congress’s
Nos. 08-5297/5298/5317 Beaven et al. v. United States Dep’t Page 11
of Justice et al.

intent regarding § 552a(g)(4) as shown in the legislative history. As the preface to the
public law stated, “The purpose of this Act is to provide certain safeguards for an
individual against an invasion of personal privacy by requiring federal agencies, except
as otherwise provided by law, to . . . be subject to civil suit for any damages which occur
as a result of willful or intentional action which violates any individual’s rights under
this Act.” Privacy Act of 1974, Pub. L. No. 93-579, § 2(b)(6), 88 Stat. 1896 (codified
as amended at 5 U.S.C. § 552a). The Senate Report accompanying the original Senate
version of the Act states that one of the purposes of the Act is “to prevent the kind of
illegal, unwise, overbroad, investigation and record surveillance of law-abiding citizens
produced in recent years from actions of some over-zealous investigators, and the
curiosity of some government administrators, or the wrongful disclosure and use, in
some cases, of personal files held by Federal agencies.” S. REP. NO. 93-1183, at 1
(1974), reprinted in JOINT COMM. ON GOV’T OPERATIONS, LEGISLATIVE HISTORY OF THE
PRIVACY ACT OF 1974, S. 3418 (PUBLIC LAW 93-579): SOURCE BOOK ON PRIVACY 154
(1976) (hereinafter SOURCE BOOK). The Privacy Act was passed in the relatively short
period between the Thanksgiving recess and the end of the 93rd congressional session
and “reflects the merger of seemingly disparate bills from the Senate and the House.”
ABA SECTION OF ADMIN. LAW & REGULATORY PRACTICE, FEDERAL ADMINISTRATIVE
PROCEDURE SOURCEBOOK 1083 (William F. Funk et al. eds., 4th ed. 2008). This short
time-frame led the two houses of Congress to forgo the usual conference committee and,
instead, to reach an agreement to pass identical bills through informal meetings between
the respective staffs of the two houses’ committees, with the amendments to each version
included in their respective records. Id. A staff memorandum entitled “Analysis of
House and Senate Compromise Amendments to the Federal Privacy Act” is “[t]he only
record of the final negotiations leading to the bill actually adopted.” ABA SECTION OF
ADMIN. LAW & REGULATORY PRACTICE, supra, at 1083; 120 Cong. Rec. 40,405–08,
40,881–83 (1974), reprinted in SOURCE BOOK, supra, at 858, 985. The analysis explains
the compromise reached for including the “intentional or willful” standard of conduct
rather than a greater standard of “willful, arbitrary, or capricious” action or a lesser
standard of “negligent” action (or no standard at all, as some members of Congress had
Nos. 08-5297/5298/5317 Beaven et al. v. United States Dep’t Page 12
of Justice et al.

advocated),8 but does not address what actions a court could examine in making its
finding. 120 Cong. Rec. 40,406–07; SOURCE BOOK, supra, at 861–62 (explaining that
“[o]n a continuum between negligence and the very high standard of willful, arbitrary,
or capricious conduct, this standard is viewed as only somewhat greater than gross
negligence”). Not once did the Congress address the scope of a court’s analysis under
§ 552a(g)(4).

Consistent with the language of the Act, other courts’ interpretations, and the
legislative history, we conclude that a court may consider the entire course of conduct
that resulted in the disclosure in making its required finding under § 552a(g)(4). Such
an interpretation will allow recovery under circumstances similar to those here, where
an agency’s actions, although inadvertent at the last step, were in flagrant disregard of
the plaintiff’s rights under the Privacy Act at other steps along the way and afterward,
but would deny recovery where an agency’s actions were conscientious of Privacy Act
rights throughout and contravened the Act inadvertently only at the last step—as where
an employee with full rights to access personal information took every precaution to
safeguard that information, but had it stolen and disclosed through no fault of his or her
own while working away from the office.9 Only a context-based analysis will allow a

8
In debate over what standard to include, members of the House attempted to amend the bill to
allow actual damages without any finding of intent or other standard of conduct, 120 Cong. Rec.
36,658–60, 36,955–57, SOURCE BOOK, supra, at 919–29, as the original Senate version had read, 120
Cong. Rec. 36,893, 36,921, 39,204, S. REP. NO. 93-1183, at 83 (1974), SOURCE BOOK, supra, at 236,
370–71. The original House version awarded recovery for either willful or negligent actions. H.R. 16373,
93rd Cong. (as introduced Aug. 12, 1974), reprinted in SOURCE BOOK, supra, at 251–52. But, as reported
by the House Committee on Government Relations, damages were available only if “the court determines
that the agency acted in a manner which was willful, arbitrary, or capricious.” H.R. 16373, 93rd Cong.
(as reported by H.R. Comm. on Gov’t Relations, Oct. 2, 1974), reprinted in SOURCE BOOK, supra, at
287–88; H.R. Rep. No. 93-1416, at 31–32, reprinted in SOURCE BOOK, supra, at 324–25. The compromise
“intentional or willful” language reflected the desire to provide a way to limit the government’s liability
for monetary recoveries. (One Representative spoke out in opposition to the second proposed amendment
to remove a standard of conduct and specifically argued against allowing recovery for a completely
“inadvertent” violation because of the potential for “undue liability.” 120 Cong. Rec. 36,956, SOURCE
BOOK, supra, at 926–27.)
9
See Scrimgeour v. Internal Revenue, 149 F.3d 318, 323–26 (4th Cir. 1998) (finding conduct not
even grossly negligent where agency employees were simply careless in improperly handling initial
disclosure request and other employees who delayed in handling request to stop improper disclosures
exercised best professional judgment in how to protect plaintiff’s rights); Sullivan v. Veterans Admin., 617
F. Supp. 258, 259 n.2, 262 (D.D.C. 1985) (finding agency did not act intentionally or willfully in releasing
report that “inadvertently” included one instance of plaintiff’s name because “[w]hile the VA was not
completely successful in deleting all the personally identifiable references to plaintiff, its attempt to do so
Nos. 08-5297/5298/5317 Beaven et al. v. United States Dep’t Page 13
of Justice et al.

court to distinguish between such situations and fulfill the Privacy Act’s intended
purpose—“‘to strike a balance between the government’s need to collect and maintain
information and the privacy interests of the persons to whom such information
pertains.’” Cardamone, 241 F.3d at 524 (quoting Hudson, 130 F.3d at 1204); see Pilon
v. U.S. Dep’t of Justice, 73 F.3d 1111, 1118 (D.C. Cir. 1996) (“Recognizing the
[Privacy] Act’s varied ambiguities, we have consistently turned back ‘neat legal
maneuver[s],’ attempted by the government that, while literally consistent with the Act’s
terms, were not in keeping with the privacy-protection responsibilities that Congress
intended to assign to agencies under the Act.” (quoting Benavides v. U.S. Bureau of
Prisons, 995 F.2d 269, 272 (D.C. Cir. 1993))); see also United Savings Ass’n v. Timbers
of Inwood Forest Assocs., 484 U.S. 365, 371 (1988) (“Statutory construction . . . is a
holistic endeavor. A provision that may seem ambiguous in isolation is often clarified
by the remainder of the statutory scheme— . . . because only one of the permissible
meanings produces a substantive effect that is compatible with the rest of the law . . . .”
(citations omitted)); Kostyu v. United States, 742 F. Supp. 413, 417 (E.D. Mich. 1990)
(“By requiring a showing that any violation of the Act be willful and [sic] intentional,
it is clear that Congress intended to reserve civil liability only for those lapses which
constituted an extraordinary departure from standards of reasonable conduct.”).

With this framework in mind, we may now decide whether the district court erred
in finding that SIA Jones’s actions satisfied the “intentional or willful” standard of
conduct. Here, the district court applied the correct legal standard, and its credibility-
based findings of fact are supported by the record and not clearly erroneous. The
Defendants are correct that the district court’s finding that SIA Jones’s final act of
leaving the folder was “inadvertent” appears to be inconsistent with a finding that the
agency’s course of conduct was “intentional or willful.” An action that is inadvertent
likely is not intentional, but could still be sufficiently willful to violate the Act. Albright,

demonstrates that agency’s consideration of and concern for plaintiff’s privacy interests”).
Nos. 08-5297/5298/5317 Beaven et al. v. United States Dep’t Page 14
of Justice et al.

732 F.2d at 189. A review of the facts in the instant case supports the district court’s
conclusion.

Although neither party here could point to a case factually similar to the instant
case, we conclude that the district court did not commit clear error in finding that SIA
Jones’s course of conduct was “willful.” SIA Jones carried the folder, which he knew
to contain confidential and sensitive information, into an inmate-accessible work area
for the purpose of carrying out his own investigative work should he need to call a
UNICOR computer administrator at home. Yet the roster not only listed the home
telephone numbers of UNICOR computer administrators but also included detailed
private and personal information related to all FMC employees. SIA Jones’s asserted
need for some of the information while inside the UNICOR facility did not provide a
legitimate basis for him to have the entire contents of the folder with him at the time to
mitigate his Privacy Act violation. Moreover, the roster was contained in a folder not
properly marked LOU-Sensitive,10 and this and other instances of SIA Jones’s conduct
violated several BOP Program Statements. See White v. Office of Pers. Mgmt., 840 F.2d
85, 87 (D.C. Cir. 1988) (“A plain failure to comply with established [agency] policy
might constitute ‘willful’ or ‘intentional’ conduct actionable under § 552a(g)(4).”). Thus
the district court’s finding that SIA Jones willfully violated the Privacy Act by flagrantly
disregarding the FMC employees’ rights under the Act was not clearly erroneous—SIA
Jones’s course of conduct that resulted in his leaving the unmarked folder in an inmate-
accessible area did not just “inadvertently contravene one of the Act’s strictures” and
could properly be viewed as “the intentional or willful failure of the agency to abide by
the Act.” Albright, 732 F.2d at 189; cf. Wiley v. Dep’t of Veterans Affairs, 176 F. Supp.
2d 747, 756–57 (E.D. Mich. 2001) (finding agency’s mere inattention to detail in
disclosing entire file, seemingly without any effort to identify those items within scope
of request, rose at most to level of gross negligence). Therefore, we affirm the district

10
The “LOU-Sensitive” marking is required under BOP Program Statement 1237.11 and
Institutional Supplement 1237.11 A. Beaven, 2007 WL 1032301, at *2. “The purpose of marking
sensitive information as ‘LOU-Sensitive’ was to ensure that persons in possession of such documents were
conscious of their sensitive nature and cautious to protect them from disclosure.” Id.
Nos. 08-5297/5298/5317 Beaven et al. v. United States Dep’t Page 15
of Justice et al.

court’s judgment that “the agency acted in a manner which was . . . willful” under
§ 552a(g)(4), triggering liability under the Act.

B. Imposition of Non-Rebuttable Adverse Evidentiary Inference for Spoliation
Sanction
We review for abuse of discretion the district court’s decision to impose
sanctions for evidence spoliation. See Adkins v. Wolever, 554 F.3d 650, 652 (6th Cir.
2009) (en banc) (holding federal courts have broad discretion in such decisions). The
district court imposed a non-rebuttable adverse inference of disclosure as an evidentiary
sanction against the Defendants because the court found that the Defendants
intentionally destroyed the folder. Beaven, 2007 WL 1032301, at *17 (“The court will
therefore infer that the appearance of the file folder would have been unfavorable to the
defendants, in that its inspection would have provided proof that disclosure to an inmate
actually occurred.”). The Defendants argue that the district court abused its discretion
because they assert that the Plaintiffs failed to establish the culpable mental state and
relevance of the folder as evidence required to impose an adverse inference, and that,
even if such an adverse inference was warranted, it was legal error to impose such a
severe sanction.

After the district court’s decision, this court clarified that a federal court in this
circuit should apply federal law in determining whether spoliation sanctions are
appropriate. Adkins, 554 F.3d at 652. Because earlier precedents in this circuit applied
state law on spoliation, we look to other circuits for guidance in this inquiry.

[A] a party seeking an adverse inference instruction based on the
destruction of evidence must establish (1) that the party having control
over the evidence had an obligation to preserve it at the time it was
destroyed; (2) that the records were destroyed “with a culpable state of
mind”; and (3) that the destroyed evidence was “relevant” to the party’s
claim or defense such that a reasonable trier of fact could find that it
would support that claim or defense.

Residential Funding Corp. v. DeGeorge Fin. Corp., 306 F.3d 99, 107 (2d Cir. 2002)
(quoting Byrnie v. Town of Cromwell, Bd. of Educ., 243 F.3d 93, 107–12 (2d Cir. 2001)).
Nos. 08-5297/5298/5317 Beaven et al. v. United States Dep’t Page 16
of Justice et al.

Thus, an adverse inference for evidence spoliation is appropriate if the Defendants
“‘knew the evidence was relevant to some issue at trial and . . . [their culpable] conduct
resulted in its loss or destruction.’” Hodge v. Wal-Mart Stores, Inc., 360 F.3d 446, 450
(4th Cir. 2004) (quoting Vodusek v. Bayliner Marine Corp., 71 F.3d 148, 156 (4th Cir.
1995)). This depends on the alleged spoliator’s mental state regarding any obligation
to preserve evidence and the subsequent destruction. An obligation to preserve may
arise “when a party should have known that the evidence may be relevant to future
litigation,” Kronisch v. United States, 150 F.3d 112, 126 (2d Cir. 1998), but, if there was
“no notice of pending litigation, the destruction of evidence does not point to
consciousness of a weak case” and intentional destruction, Joostberns v. United Parcel
Servs., Inc., 166 F. App’x 783, 797 (6th Cir. 2006) (unpublished opinion) (applying
federal law). “[T]he ‘culpable state of mind’ factor is satisfied by a showing that the
evidence was destroyed ‘knowingly, even if without intent to [breach a duty to preserve
it], or negligently.’” Residential Funding Corp., 306 F.3d at 108 (quoting Byrnie, 243
F.3d at 109). When appropriate, “a proper spoliation sanction should serve both fairness
and punitive functions,” but its severity should correspond to the district court’s finding
after a “fact-intensive inquiry into a party’s degree of fault” under the circumstances,
including the recognition that a party’s degree of fault may “‘rang[e] from innocence
through the degrees of negligence to intentionality.’” Adkins, 554 F.3d at 652–53
(quoting Welsh v. United States, 844 F.2d 1239, 1246, (6th Cir. 1988), overruled on
other grounds by Adkins, 554 F.3d 650). “Thus, a district court could impose many
different kinds of sanctions for spoliated evidence, including dismissing a case, granting
summary judgment, or instructing a jury that it may infer a fact based on lost or
destroyed evidence.” Id. at 653 (citing Vodusek, 71 F.3d at 156).

The district court here did not abuse its broad discretion in finding that an
adverse inference was appropriate here as a spoliation sanction. As the Second Circuit
has noted, the “veracity of [defendant’s] stated reasons for destroying the [evidence] ‘is
an issue of credibility.’” Kronisch, 150 F.3d at 127. Giving great deference to the
district court’s credibility determinations and findings of fact, we accept the district
Nos. 08-5297/5298/5317 Beaven et al. v. United States Dep’t Page 17
of Justice et al.

court’s findings that the Defendants were sufficiently on notice of potential claims to
have an obligation to preserve the evidence as a result of the Defendants’ repeated
statements that concerned persons could file tort claims, and that the later destruction
prior to the issuance of the second memorandum was intentional. Cf. Silvestri v. Gen.
Motors Corp., 271 F.3d 583, 591–92 (4th Cir. 2001) (upholding dismissal as spoliation
sanction for plaintiff who anticipated filing suit, knew evidence was relevant to potential
claims, and preserved evidence for only three months, but did not file suit until three
years later). Although in Joostberns, an unpublished opinion, we held that a completed
union grievance proceeding does not suffice to prove an obligation to preserve based on
notice of potential litigation arising from the same facts, especially if the allegedly
spoliated evidence would have been available at the time of the grievance proceeding
and was not destroyed until afterwards in the course of regular business practice,
Joostberns, 166 F. App’x at 796–97, the facts of the instant case support the district
court’s decision. Unlike the facts the court found influential in Joostberns, the
Defendants’ actions in destroying the folder were not part of a regular business practice.
In Joostberns, the court found that the defendants had no notice of potential litigation or
the need for the evidence in their possession at the time that they destroyed the evidence.
Id. But here, the Defendants preserved the folder as direct evidence of the alleged
disclosure at the same time that they made repeated statements that actual evidence
would be necessary to pursue claims, demonstrating their awareness that claims could
be filed and that direct evidence—the folder—would be necessary. The Defendants also
had not completed their official response to the incident at the time that they destroyed
the folder—arbitration was complete, but Thoms had not yet issued the second
memorandum on behalf of FMC.

The district court also did not abuse its discretion in holding that the folder was
relevant—that the Plaintiffs had made “some showing indicating that the destroyed
evidence would have been relevant to the contested issue” of who may have accessed the
folder, Kronisch, 150 F.3d at 127, such that “a reasonable trier of fact could find that it
would support that claim,” Residential Funding Corp., 306 F.3d at 107. “[A] party
Nos. 08-5297/5298/5317 Beaven et al. v. United States Dep’t Page 18
of Justice et al.

seeking an adverse inference may rely on circumstantial evidence to suggest the contents
of destroyed evidence.” Byrnie, 243 F.3d at 110. The Defendants’ argument that the
folder was not “relevant” because of uncertainty regarding whether it would provide
“credible evidence” is unconvincing, especially given their attempts to prove non-
disclosure at trial by introducing testimony about the results of their own inspection of
the folder. The Plaintiffs’ proof at trial included testimony from inmates present at the
time who stated that another inmate had accessed the folder. The physical appearance
and condition of the folder was clearly relevant to this offer of proof because it would
make the existence of a favorable material fact—disclosure of the folder to unauthorized
persons—more probable. See Residential Funding Corp., 306 F.3d at 109 (holding
evidence of bad faith or gross negligence that satisfies the culpable-state-of-mind
requirement is also usually sufficient to satisfy the relevance requirement).

The district court did not abuse its discretion in imposing a non-rebuttable
adverse inference after finding that the Defendants’ destruction of the folder “severely
compromised” the Plaintiffs’ case by depriving the Plaintiffs of the most relevant piece
of evidence to prove their claims. Beaven, 2007 WL 1032301, at *16. The Plaintiffs’
case hinged on whether or not the folder was compromised, constituting disclosure to
unauthorized persons. The district court’s spoliation sanction was “necessary to further
the remedial purpose of the inference.” See Residential Funding Corp., 306 F.3d at 108
(“[The] sanction [of an adverse inference] should be available even for the negligent
destruction of documents if that is necessary to further the remedial purpose of the
inference.” (citation omitted)); Silvestri, 271 F.3d at 593–95 (upholding dismissal as
sanction for plaintiff’s negligent spoliation where highly prejudicial to other party
because the plaintiff “denied . . . [the defendant] access to the only evidence from which
it could develop its defenses adequately”). The district court’s use of a spoliation
inference for a critical element of the case is not unprecedented. See Rogers v. T.J.
Samson Cmty. Hosp., 276 F.3d 228, 232 (6th Cir. 2002) (“‘When . . . a plaintiff is unable
to prove an essential element of her case due to the negligent loss or destruction of
evidence by an opposing party, . . . it is proper for the trial court to create a rebuttable
Nos. 08-5297/5298/5317 Beaven et al. v. United States Dep’t Page 19
of Justice et al.

presumption that establishes the missing elements of the plaintiff’s case that could only
have been proved by the availability of the missing evidence.’” (quoting Welsh, 844 F.2d
at 1248)). And although an adverse inference is usually only permissive for the
factfinder, not mandatory, see Blinzler v. Marriott Int’l, Inc., 81 F.3d 1148, 1158–59 (1st
Cir. 1996), here the district court judge was the factfinder and therefore was free to
accept the inference and discredit the Defendants’ proffered testimony to the contrary.11

Even if the Defendants were correct, however, that the district court erred in
imposing the evidentiary sanction, we conclude that it would be harmless error because
the district court’s alternative finding that the Plaintiffs proved disclosure by a
preponderance of the evidence, without considering the adverse inference, was not
clearly erroneous.

C. Finding “Disclosure” Proved by Preponderance of the Evidence

We review the sufficiency of the district court’s findings of fact for clear error,
and we may not reverse a “district court’s account of the evidence [that] is plausible in
light of the entire record . . . even if convinced that, had [we] been sitting as trier of fact,
[we] would have weighed the evidence differently.” Harlamert v. World Finer Foods,
Inc., 489 F.3d 767, 771 (6th Cir. 2007) (citing Anderson v. City of Bessemer City, N.C.,
470 U.S. 564, 574–75 (1985)). We cannot deem “the factfinder’s choice” between two
permissible views of the evidence clearly erroneous. Id. “[W]hen a trial judge’s finding
is based on his decision to credit the testimony of one of two or more witnesses, each of
whom has told a coherent and facially plausible story that is not contradicted by extrinsic

11
The district court’s use of a conclusive, non-rebuttable inference of disclosure fulfilled the
purpose of spoliation sanctions for the destruction of relevant evidence. See 2 John Henry Wigmore,
Evidence in Trials at Common Law § 291, at 227–29 (Chadbourn rev. 1979) (noting that “there is no
reason why the utmost inference logically possible should not be allowable, namely, that the contents of
the document (when desired by the opponent) are what he alleges them to be, or (when naturally a part of
the possessor’s case) are not what he alleges them to be” and that in the case of spoliation, rather than mere
nonproduction, “it is open to the larger inference . . . , namely, a consciousness of the weakness of the
whole case”); id. at 228 (“[T]he rule might correctly be stated as follows: The failure or refusal to produce
a relevant document, or the destruction of it, is evidence from which alone its contents may be inferred to
be unfavorable to the possessor, provided the opponent, when the identity of the document is disputed, first
introduces some evidence tending to show that the document actually destroyed or withheld is the one as
to whose contents it is desired to draw an inference.”).
Nos. 08-5297/5298/5317 Beaven et al. v. United States Dep’t Page 20
of Justice et al.

evidence, that finding, if not internally inconsistent, can virtually never be clear error.”
Anderson, 470 U.S. at 575. We must “liberally construe[]” findings in support of the
district court’s judgment, “even if the findings are not as explicit or detailed as we might
desire.” Truform, Inc. v. Gen. Motors Corp., 80 F. App’x 968, 973 (6th Cir. 2003)
(unpublished opinion) (citing Grover Hill Grain Co. v. Baughman-Oster, Inc., 728 F.2d
784, 793 (6th Cir. 1984)). “[T]he failure to even make an express finding of a particular
fact does not require reversal if a complete understanding of the issues may be had
without the aid of separate findings.” Grover Hill, 728 F.2d at 793; Truform,
80 F. App’x at 973.

Contrary to the Defendants’ contentions, the district court here did not rely on
legally insufficient circumstantial evidence and credibility determinations in finding
proof of disclosure by a preponderance. Although the district court did not explicitly
state that it was crediting the Plaintiffs’ proffer of inmate testimony respecting other
inmates’ access to the folder and use of the information over the Defendants’ proffered
testimony regarding the appearance of the folder, the court did explicitly state it was
discrediting all of the Defendants’ testimony. See Beaven, 2007 WL 1032301, at *17.
We conclude that, when viewed in context, the findings in the remainder of the opinion
confirm that the district court accepted the inmates’ testimony of disclosure. See id. at
*2–3. These findings support the district court’s judgment and permit us to have a clear
understanding of the reasoning behind the district court’s decision. Grover Hill,
728 F.2d at 793 (“If, from the facts found, other facts may be inferred which will support
the judgment, such inferences should be deemed to have been drawn by the District
Court.”).

We therefore affirm the district court’s judgment that a disclosure occurred.
Because we have affirmed the district court’s judgment that a Privacy Act disclosure
occurred in violation of § 552a(g)(1)(D) and that “the agency acted in a manner that was
intentional or willful,” we conclude that the district court properly determined that the
Plaintiffs were entitled to damages under § 552a(g)(4) of the Privacy Act. The
Nos. 08-5297/5298/5317 Beaven et al. v. United States Dep’t Page 21
of Justice et al.

Defendants do not challenge the district court’s damages award on appeal, but our
conclusion does require us to address one of the Plaintiffs’ cross-appeal contentions.

D. “Actual Damages” Requirement

On cross-appeal, the Plaintiffs argue that the district court’s damages award does
not make them “whole” because, although the court awarded mitigation damages, it
disallowed recovery for “lost time” and “future protective measures” that the Plaintiffs
assert should qualify as “actual damages” under common-law tort principles. The
Plaintiffs asserted that they should be compensated at their regular hourly rate as BOP
employees for the time they had already spent dealing with the disclosure so that
damages would exceed the $1,000 statutory minimum for actual damages. The district
court disagreed, but found that all of the Plaintiffs were entitled to recover the $1,000
statutory minimum because the costs of the prophylactic measures each took to prevent
harm from the disclosure constituted actual damages. The court concluded that
compensation for lost time was unavailable under the Privacy Act because it must
narrowly construe the waiver of sovereign immunity in the damages provision. The
court found that only two of the Plaintiffs had incurred costs above $1,000, and the court
awarded the respective amount of actual damages to each. The court rejected the claim
for damages for any future protective measures, finding that such damages would be
unreasonable given the court’s earlier finding that none of the Plaintiffs had suffered
adverse effects from the disclosure. Beaven, 2007 WL 1032301, at *28; Doc. 353
(Damages Op. at 3–5).

The Supreme Court in Doe v. Chao held that a Privacy Act plaintiff must prove
some actual damages before she is entitled to the minimum statutory damages under
§ 552a(g)(4), specifically rejecting “general” or “presumed” damages available in other
common-law privacy torts. Doe, 540 U.S. at 621–23. The Court also noted that, from
a review of the legislative history, “it is implausible that Congress intended tacitly to
recognize a nominal damages remedy after eliminating the explicit reference to general
damages.” Id. at 623 n.6. In Hudson v. Reno, we noted that although “actual damages”
Nos. 08-5297/5298/5317 Beaven et al. v. United States Dep’t Page 22
of Justice et al.

as required under § 552a(g)(4) “has no plain meaning or consistent legal interpretation,
. . . when it is being applied against the government [as a waiver of sovereign immunity]
it must be narrowly interpreted—here that requires finding that actual damages only
mean out-of-pocket losses, not emotional distress.” Hudson, 130 F.3d 1193, 1207 n.11
(6th Cir. 1997) (declining to follow Johnson v. Dep’t of Treasury, 700 F.2d 971 (5th Cir.
1983), abrogated by Doe, 540 U.S. at 618), cert. denied, 525 U.S. 822 (1998), abrogated
on other grounds by Pollard v. E.I du Pont de Nemours & Co., 532 U.S. 843, 848
(2001); see Fanin v. U.S. Dep’t of Veterans Affairs, 572 F.3d 868, 874 (11th Cir. 2009)
(acknowledging Hudson and reiterating that the Sixth and Eleventh Circuits follow the
same rule requiring proof of actual pecuniary loss), cert. denied, — U.S. —, 2010 WL
757702 (U.S. Mar. 8, 2010) (No. 09-513). In Hudson, this court specifically rejected an
attempt to broaden actual damages to include compensatory damages such as “‘mental
injuries, loss of reputation, embarrassment or other non-quantifiable injuries,’” but did
not actually decide whether § 552a(g)(4) foreclosed such damages. Hudson, 130 F.3d
at 1207 (quoting Fitzpatrick v. I.R.S., 665 F.2d 327, 331 (11th Cir. 1982), overruled on
other grounds by Doe, 540 U.S. at 618). The Hudson court’s finding that the plaintiff
could not prove actual damages was not necessary to its decision; indeed, the court
introduced its actual damages discussion as “[a] final basis for affirming the District
Court’s decision” that the plaintiff had presented no viable Privacy Act claims. Hudson,
130 F.3d at 1207. We need not now decide whether this circuit should adopt the Hudson
court’s rationale expressed in dicta because it is not necessary to do so to reach a
decision in this case.12

First, even if we determined that the Plaintiffs’ alleged “future protective
measures” damages are cognizable “out-of-pocket losses,” the Plaintiffs are unable to

12
The Plaintiffs request that this panel reconsider Hudson in light of the circuit split
acknowledged in Doe: “The Courts of Appeals are divided on the precise definition of actual damages.
Compare Fitzpatrick v. IRS, 665 F.2d 327, 331 (C.A.11 1982) (actual damages are restricted to pecuniary
loss), with Johnson v. Department of Treasury, IRS, 700 F.2d 971, 972–974 (C.A.5 1983) (actual damages
can cover adequately demonstrated mental anxiety even without any out-of-pocket loss). That issue is not
before us . . . .” Doe, 540 U.S. at 627 n.12. Doe merely recognized the circuit split without resolving it.
Because this court has already declined to follow Johnson, and we need neither accept nor reject Hudson’s
rationale for our decision in this case, we decline to reevaluate our position now.
Nos. 08-5297/5298/5317 Beaven et al. v. United States Dep’t Page 23
of Justice et al.

prove causation. See Doe, 540 U.S. at 621–22 (holding a plaintiff must prove causation
in order to obtain damages); Hudson, 130 F.3d at 1207 (same). The Plaintiffs do not
challenge the district court’s factual finding that it was unreasonable to believe that the
disclosure would cause any adverse effects in the future based on the lack of adverse
effects to date, Doc. 353 (Damages Op. at 3–4), and, by extension, it is only logical that
the Plaintiffs also cannot prove that the disclosure would cause any future “out-of-pocket
losses.” See Hudson, 130 F.3d at 1207 n.11; Brown v. U.S. Dep’t of Justice, 169 F.
App’x 537, 541 (11th Cir. 2006) (unpublished opinion) (§ 552a(g)(4) actual damages
claims cannot be merely speculative). We therefore affirm the district court’s decision
to deny the “future protective measures” damages.

The additional “lost time” damages sought by the Plaintiffs may qualify as “out-
of-pocket losses” under the rationale in Hudson.13 The Plaintiffs do not challenge the
district court’s finding that the out-of-pocket costs that the Plaintiffs incurred for taking
prophylactic measures did not exceed $1,000, and they have not included a calculation
of any “lost time” damages as an out-of-pocket cost incurred at their hourly rate in their
briefing on appeal.14 However, we conclude that the district court erred in denying the
Plaintiffs’ “lost time” damages on the ground that their failure to assert valid FTCA
claims precluded them from recovering damages for their valid Privacy Act claims. We
agree with the Hudson court’s determination that the sovereign immunity waiver in
§ 552a(g)(4) requires a narrowing construction, and that this narrowing construction

13
Our reference to the Hudson term here does not contradict our declination to embrace the full
Hudson rationale because the Plaintiffs’ “lost time” damages claim does not require us to decide whether
actual damages may include non-pecuniary losses—any Privacy Act injury incurred in the form of lost
time is necessarily a pecuniary harm that is readily determined and does not require the court to speculate
in the same manner as general or presumed damages. This is in line with this court’s recognition that
“[a]lthough dictum is unnecessary to the decision, it may nevertheless be followed if ‘sufficiently
persuasive.’” PDV Midwest Ref., L.L.C. v. Armada Oil & Gas Co., 305 F.3d 498, 510 (6th Cir. 2002)
(quoting Central Green Co. v. United States, 531 U.S. 425, 431 (2001)).
14
The Plaintiffs’ motion for entry of judgment (Doc. 335) in the district court did not include a
calculation of “lost time” damages but instead stated that “about a dozen, more or less, of the Plaintiffs will
exceed the $1,000.00 minimum threshold of damages” and “ask[ed] they be given leave to amend their
motion for judgment to include the amounts they specifically claim for lost time” if the district court
concluded that “lost time” was recoverable under the Privacy Act. Doc. 335 (Mot. for Entry of J. at
10–11). Therefore, even if the Plaintiffs did challenge the district court’s finding, we would be unable to
review whether the district court correctly determined the damages.
Nos. 08-5297/5298/5317 Beaven et al. v. United States Dep’t Page 24
of Justice et al.

when applied here justifies requiring the Plaintiffs to prove “out-of-pocket losses” for
their “lost time” damages. Hudson, 130 F.3d at 1207 n.11. We therefore reverse the
district court’s damages decision to the extent that it denies the Plaintiffs’ recovery for
“lost time” damages on the theory of sovereign immunity, and we remand to the district
court for a finding on the amount of “lost time” damages for each Plaintiff. Such
damages are neither “general damages” nor “presumed damages” within the meaning
accorded to those terms in Doe. Doe, 540 U.S. at 620–27. If the district court finds that
a Plaintiff is able to prove that his or her “lost time” coupled with the costs of his or her
prophylactic measures taken exceeds $1,000, then that Plaintiff should be entitled to
recover the total amount of his or her actual damages rather than the statutory minimum
of $1,000.

E. Remaining Issues

The Plaintiffs raised the three remaining issues in their cross-appeal only as
alternative grounds for relief “[i]f for any reason this Court does not affirm the trial
court’s determination that an actual disclosure occurred, ‘intentionally or willfully,’
within the meaning of the Privacy Act.” Pls.-Appellees/Cross-Appellants Br. at 55, 62,
63. Because we have affirmed the district court’s judgment in this respect, we conclude
that we do not need to address the remaining issues on cross-appeal.

III. CONCLUSION

The district court did not clearly err in finding that the agency’s “inadvertent”
final act was “willful” within the meaning of 5 U.S.C. § 552a(g)(4) because a court may
consider the entire course of conduct that resulted in the Privacy Act violation in making
its required finding under § 552a(g)(4). Further, the district court did not abuse its
discretion in imposing a non-rebuttable adverse evidentiary inference of disclosure as
a sanction for the Defendants’ destruction of relevant evidence with the knowledge that
the evidence would be necessary for known potential claims, as this was a proper
sanction in light of the remedial purpose of evidentiary sanctions. Finally, from a review
of the district court’s opinion, we conclude that the court did not commit clear error in
Nos. 08-5297/5298/5317 Beaven et al. v. United States Dep’t Page 25
of Justice et al.

its alternative finding that the Plaintiffs did prove disclosure by a preponderance of the
evidence. We cannot agree, however, with the Plaintiffs’ contention that “actual
damages” recoverable under the Act includes recovery for future protective measures,
but we conclude that the Plaintiffs may be entitled to recovery for lost time if they can
prove out-of-pocket losses. The district court correctly declined to extend the meaning
of “actual damages” beyond the scope of our precedents, but it erred in extending
sovereign immunity to preclude potential out-of-pocket losses. Therefore, we AFFIRM
the district court’s judgment finding the Defendants liable on the Plaintiffs’ Privacy Act
claims and finding that “future protective measures” damages are unavailable, but we
REVERSE the district court’s judgment as it relates to the Plaintiffs’ “lost time”
damages and we REMAND for proceedings consistent with this opinion.
Nos. 08-5297/5298/5317 Beaven et al. v. United States Dep’t Page 26
of Justice et al.

__________________

DISSENT
__________________

CORNELIA G. KENNEDY, Circuit Judge, dissenting. Because I do not agree
that bringing an unlabelled folder containing Plaintiffs’ Privacy Act-protected
information into an unsecured workspace rose to the level of “intentional or willful”
agency action under 5 U.S.C. § 552a(g)(4), I must respectfully dissent.

The majority affirms the district court’s award of Privacy Act damages to
Plaintiffs, upholding the district court’s conclusion that Defendants “acted in a manner
which was intentional or willful” as required by § 552a(g)(4), despite that court’s finding
that the final act resulting in disclosure—Jones’s leaving the folder unsecured on
Moore’s desk—was inadvertent. In order to support its ruling, the majority reads the
Privacy Act to allow a court to consider “the entire course of conduct that resulted in [a
violation]” when determining whether an agency acted intentionally or willfully under
§ 552a(g)(4). Maj. Op. at 12. While I agree with the substance of this interpretation, I
would limit the “intentional or willful” inquiry to those agency actions that have a direct
causal connection to the Privacy Act violation. As I read § 552a(g)(4), its application
to suits brought under § 552a(g)(1)(D) implies that the agency’s relevant actions are only
those that constitute a failure to comply with a provision of the Privacy Act. Otherwise
I fear that too wide a range of agency conduct could be swept within the “intentional or
willful” analysis. Basing a finding of “intentional or willful” conduct on agency actions
that are not causally connected to a Privacy Act violation would subvert Congress’s
efforts to strike a balance between providing an appropriate damage remedy to victims
of Privacy Act violations and safeguarding the government from crippling liability under
the Privacy Act. See Privacy Act of 1974, Pub. L. No. 93-579, § 2(b)(5), 88 Stat. 1896,
1896 (1974) (“The purpose of this Act is to provide certain safeguards for an individual
against an invasion of personal privacy by requiring Federal agencies . . . to . . . be
subject to civil suit for any damages which occur as a result of willful or intentional
action which violates any individual’s rights under this Act.” (emphasis added)). This
Nos. 08-5297/5298/5317 Beaven et al. v. United States Dep’t Page 27
of Justice et al.

balance is evident in Congress’s decision to select “intentional or willful” conduct as the
standard of recovery for Privacy Act damages, instead of the stricter “willful, arbitrary
or capricious” standard originally favored by the House of Representatives or the more
lenient negligence standard proposed by the Senate. See Analysis of House and Senate
Compromise Amendments to the Federal Privacy Act, reprinted in 120 Cong. Rec.
40,405, 40,406 (1974). It has also served as a guiding principle for several courts
construing § 552a(g)(4). See, e.g., Albright v. United States, 732 F.2d 181, 189 (D.C.
Cir. 1984) (“[T]he ‘intentional or willful’ action requirement of Section 552a(g)(4) refers
only to the intentional or willful failure of the agency to abide by the Act, and not to all
voluntary actions which might otherwise inadvertently contravene one of the Act’s
strictures.” (emphasis added)), abrogated on other grounds by Doe v. Chao, 540 U.S.
614 (2004).

Applying this principle to Plaintiffs’ claim, when determining whether
Defendants acted intentionally or willfully we should consider only those acts of
Defendants that played a part in causing the unauthorized disclosure of Plaintiffs’
protected information. “An agency acts intentionally or willfully ‘either by committing
the act without grounds for believing it to be lawful, or flagrantly disregarding others’
rights under the [Privacy] Act.’” Mount v. U.S. Postal Serv., 79 F.3d 531, 533 (6th Cir.
1996) (alteration in original) (quoting Wilborn v. Dep’t of Health & Human Servs.,
49 F.3d 597, 602 (9th Cir. 1995)). As the majority notes, Defendants’ actions were not
“intentional” since the district court concluded that “leaving the folder unsecured on
Moore’s desk was inadvertent.” Beaven v. U.S. Dep’t of Justice, No. 03-84-JBC, 2007
WL 1032301, at *17 (E.D. Ky. 2007). Therefore, Plaintiffs must prove that Defendants
acted willfully by showing that Defendants flagrantly disregarded their rights under the
Privacy Act through actions that made a prohibited disclosure unreasonably likely to
occur. Based on the district court’s factual findings in this case, I do not believe
Plaintiffs satisfied their burden.

The district court determined that “Jones’s conscious decision to ignore the risks
associated with bringing unmarked confidential information into an area to which
Nos. 08-5297/5298/5317 Beaven et al. v. United States Dep’t Page 28
of Justice et al.

inmates have access” qualified as “willful” conduct under § 552a(g)(4). Id.1 The district
court’s opinion did not explain what acts prior to leaving the documents on Moore’s
desk were relevant to its determination; it relied only on the conclusary testimony of
Plaintiffs’ expert that “the information was handled in reckless disregard of the Privacy
Act and relevant guidelines.” Id. However, I do not see how Jones’s actions evidenced
a “reckless disregard” of the danger that unauthorized persons would access the file.
Jones carried the folder into an area where no one was present except himself and two
experts from Washington, D.C. sent by the BOP to audit staff and prisoners’ computer
use. Inmates and other prison personnel did not have access to this workspace during
the night-time hours Jones would be working; they were to return to the area the next
day,2 a time when, except for Jones’ inadvertence, the folder would have been returned
to his secure office.

Jones’s decision to bring into an unsecured workspace more information than
necessary to complete the investigation and his failure to properly label the information
as “LOU-Sensitive” are clearly negligent. Nevertheless, since Jones fully intended to
return the folder to the security of his office once he had completed his work and his
failure to do so was merely inadvertent, I cannot view this as an “extraordinary departure
from standards of reasonable conduct.” Kostyu v. United States, 742 F. Supp. 413, 417
(E.D. Mich. 1990).3 Though I believe that Jones’s actions might rise to the level of

1
The record indicates that all of the agency’s acts relating to the disclosure were Jones’ acts,
except the initial failure to place the “LOU-Sensitive” label on the information lists he carried in the folder
before they were turned over to Jones for his use every quarter. Since I do not think that a failure to label
the lists could be a cause of the disclosure—it had been the practice for years without incident—I do not
consider this action pertinent to the willfulness inquiry.
2
While the office was not occupied after 7:00 PM by either staff or inmates, inmates’ access
began at 7:00 AM, a time at which only a skeleton staff was present in the area. The employee on whose
desk Jones left the folder started work at 9:00 AM, though evidence indicates it would take her at least
twenty minutes to reach her desk after entering the prison complex. Therefore, at most there was only a
two-hour-and-twenty-minute window during which the folder sat unsecured and capable of being read by
inmates.
3
The majority points out that Jones violated BOP Program Statements by transporting the
unlabelled folder into an unsecured area, and that “[a] plain failure to comply with established [agency]
policy might constitute ‘willful’ or ‘intentional’ conduct actionable under § 552a(g)(4).” White v. Office
of Pers. Mgmt., 840 F.2d 85, 87 (D.C. Cir. 1988). However, given that Jones was aware of the sensitive
nature of the information contained in the folder and he intended to return it to his office once he had
completed his work, I do not think his violation of BOP policy has a sufficiently direct causal connection
Nos. 08-5297/5298/5317 Beaven et al. v. United States Dep’t Page 29
of Justice et al.

“willful” if his or other FMC employees’ conduct established a pattern of mishandling
sensitive information, the evidence does not support such a finding; instead, it indicates
that Jones did not ordinarily take the file out of his secure office, and prior exchanges of
this information between employees were made by hand without mishap. For these
reasons, I would reverse the district court’s award of Privacy Act damages to the
Plaintiffs based on a violation of § 552a(b). This ruling requires me to consider
Plaintiffs’ cross-appeals for alternative grounds of relief.

Plaintiffs first contest the district court’s summary judgment ruling denying its
claim for Privacy Act damages based on Defendants’ failure to follow BOP rules
governing security procedures for sensitive information. Section 552a(g)(4) provides
a damage remedy for an agency’s “fail[ure] to comply with any other provision of this
section, or any rule promulgated thereunder, in such a way as to have an adverse effect
on an individual.” § 552a(g)(4). Plaintiffs claim that the BOP Program Statements Jones
disobeyed by failing to mark the folder and its contents as “LOU-Sensitive” before
transporting it to an unsecured area constitute “rule[s] promulgated” under the Privacy
Act, making Jones’s violation actionable under § 552a(g)(4).

The plain meaning and construction of § 552a suggests that “rule promulgated”
as used in § 552a(g)(4) refers only to an agency rule promulgated under the notice-and-
comment procedures of the Administrative Procedure Act, 5 U.S.C. § 553.
“Promulgate” appears in three other subsections of § 552a, all of which explicitly
reference § 553; for example, § 552a(f), entitled “Agency rules,” requires that “[i]n order
to carry out the provisions of this section, each agency that maintains a system of records
shall promulgate rules, in accordance with the requirements (including general notice)
of section 553 of this title.” § 552a(f); see also § 552a(j) (“The head of any agency may
promulgate rules, in accordance with the requirements (including general notice) of
sections 553(b)(1), (2), and (3), (c), and (e) of this title . . . .”); § 552a(k) (same). In
contrast, the BOP Program Statement that forms the basis of Plaintiffs’ claim was

to the disclosure to support a finding that he acted willfully.
Nos. 08-5297/5298/5317 Beaven et al. v. United States Dep’t Page 30
of Justice et al.

created under § 552a(e), which requires an agency to “establish rules of conduct for
persons involved in . . . maintaining any record,” § 552a(e)(9) (emphasis added), and to
“establish appropriate administrative, technical, and physical safeguards to insure the
security and confidentiality of records,” § 552a(e)(10) (emphasis added). The difference
in language between § 552a(f) and (g)(4) on the one hand, and § 552a(e)(9) and (10) on
the other, suggests that “rules of conduct” or “safeguards” “established” under
§ 552a(e)(9) and (10) are not within the damage remedy provided in § 552a(g)(4) for an
agency’s failure to comply with “rules promulgated.” See also Office of Mgmt. &
Budget, Privacy Act Guidelines—July 1, 1975, 40 Fed. Reg. 28,949, 28,969 (July 9,
1975) (“In addition to the grounds specified in subsections (g)(1)(A) through (C) above,
an individual may bring an action for any other alleged failure by an agency to comply
with the requirements of the Act or failure to comply with any rule published by the
agency to implement the Act (subsection (f)) . . . .”). Because a BOP Program Statement
is not a rule promulgated through the notice-and-comment process, see Reno v. Korzay,
515 U.S. 50, 61 (1995) (describing a BOP Program Statement as an “internal agency
guideline” that is “akin to an ‘interpretive rule’ that ‘do[es] not require notice and
comment’” (alteration in original) (quoting Shalala v. Guernsey Mem’l Hosp., 514 U.S.
87, 99 (1995))), the district court correctly concluded that its violation is not actionable
under the Privacy Act, and I would affirm the grant of summary judgment to Defendants
on this claim.

Plaintiffs have two remaining cross-appeals4 based on the district court’s
dismissal of their Federal Tort Claims Act (“FTCA”) claim for outrageous conduct and
its denial of their motion for sanctions against Defendants. Plaintiffs’ FTCA claim
alleges that Defendants committed the tort of outrage through “Jones’s improper access
to the information in the folder, the failure to properly mark the documents or folder, the
transportation of the folder without taking appropriate security precautions, leaving the
folder unsecured in UNICOR, and FMC’s fail[ure] to timely report to OIA the result of

4
I need not consider the fourth issue Plaintiffs assert on cross appeal—whether the Privacy Act
allows recovery for “lost time” and “future protected measures” as “actual damages”—because I do not
think Plaintiffs have stated a valid Privacy Act claim.
Nos. 08-5297/5298/5317 Beaven et al. v. United States Dep’t Page 31
of Justice et al.

FMC’s inquiry into Jones’s handing of the Marion Johnson incident.” Beaven, 2007 WL
1032301, at *26.5 The district court dismissed this claim as moot, finding that
“plaintiffs’ damages are adequately compensated by the award under the Privacy Act.”
Id. at *27. Because I would make Plaintiffs’ FTCA claim no longer moot by overturning
their damage award, I would remand this claim to the district court.

Plaintiffs’ motion for sanctions against Defendant for its destruction of the folder
and for misrepresentations related to the folder made during discovery was denied by the
district court on similar grounds. Because it had already imposed the nonmonetary
sanction of the adverse inference of disclosure, which was dispositive of Plaintiffs’
Privacy Act claim, and because Plaintiffs were entitled to move for attorneys’ fees as a
prevailing party under the Privacy Act, the district court concluded that further sanctions
would be unjust under the circumstances and were not necessary to deter similar future
abuses. Reversing the district court’s ruling for Plaintiff on their Privacy Act claim takes
the substance out of the district court’s adverse inference and forecloses Plaintiffs from
receiving attorneys’ fees under the Privacy Act, so I would therefore remand Plaintiffs’
motion for sanctions to the district court.

In summary, the record in this case does not support a determination that
Defendants acted intentionally or willfully as required by the Privacy Act in order for
Plaintiffs to recover damages from Defendants’ inadvertent disclosure of protected
information; I find unavailing the majority’s attempt to use Defendants’ negligent
acts—namely, the failure to label the folder containing the prison employees’ protected
information as “LOU-Sensitive,” and Jones’s transferring of the entire folder, rather than
only the information needed to perform the investigation of the computers, to an area
that, though unsecured, was closed to prison employees and inmates during the night—to
transform Jones’s inadvertent failure to take the folder back to his secure office into an
“intentional or willful” disclosure. For this reason, I respectfully dissent. I would

5
In their original complaint, Plaintiffs included more of Defendants’ actions as the basis of their
outrage claim. However, the district court dismissed several of these counts for lack of jurisdiction, and
Plaintiffs do not appeal this ruling.
Nos. 08-5297/5298/5317 Beaven et al. v. United States Dep’t Page 32
of Justice et al.

reverse the district court’s judgment holding Defendants liable for Plaintiffs’ Privacy Act
claim premised on unauthorized disclosure. On Plaintiffs’ cross appeals, I would affirm
the district court’s grant of summary judgment to Defendants on Plaintiffs’ Privacy Act
claim premised on Defendants’ violation of internal BOP policies. I would reverse the
district court’s dismissal of Plaintiffs’ FTCA claim and its denial of Plaintiffs’ motion
for sanctions and remand both issues to the district court for reconsideration.