FOR PUBLICATION
UNITED STATES COURT OF APPEALS
FOR THE NINTH CIRCUIT
ROBERT OJA,
Plaintiff-Appellant, No. 03-35877
v. D.C. No.
UNITED STATES ARMY CORPS OF CV-02-06301-
ENGINEERS; ROBERT B. FLOWERS, MRH/TMC
Lieutenant General, OPINION
Defendants-Appellees.
Appeal from the United States District Court
for the District of Oregon
Michael R. Hogan, District of Oregon, Presiding
Argued and Submitted
March 11, 2005—Portland, Oregon
Filed March 14, 2006
Before: Procter Hug, Jr., Marsha S. Berzon, and
Jay S. Bybee, Circuit Judges.
Opinion by Judge Bybee
2655
2658 OJA v. USACE
COUNSEL
Marianne Dugan, Facaros & Dugan, Eugene, Oregon, for the
appellant.
Karin J. Immergut, U.S. Attorney, and James L. Sutherland,
Assistant United States Attorney, Eugene, Oregon, for the
appellee.
OJA v. USACE 2659
OPINION
BYBEE, Circuit Judge:
Petitioner Robert Oja sued the United States Army Corps
of Engineers (“the USACE”) and Robert Flowers (collec-
tively “Defendants”) under the Privacy Act of 1974, Pub. L.
No. 579, 88 Stat. 1896 (codified as amended at 5 U.S.C.
§ 552(a)), for disclosing Oja’s personal information by post-
ing it on the USACE’s public Internet website. The District
of Oregon granted summary judgment for Defendants. We
affirm, holding that the district court properly applied the Pri-
vacy Act’s statute of limitations to both of Oja’s amended
complaints. In the course of answering Oja’s claims, we hold
that the single publication rule applies to Privacy Act claims
relating to Internet posting.
I. FACTS AND PROCEEDINGS1
A. Background
Oja served as Regulatory Chief of the Alaska District of the
USACE from 1985 until 1998. During his tenure at the
USACE, Oja avers that he “was frequently critical of the
USACE, accusing the agency of thwarting his efforts to
enforce wetlands violations and bending to pressure from oil
companies.” Oja made numerous protective disclosures under
the Whistleblower Protection Act of 1989, Pub. L. No. 101-
12, 103 Stat. 16 (codified in scattered sections of 5 U.S.C.),2
1
Given that the district court granted the USACE’s motion for summary
judgment, we view the alleged facts in the light most favorable to Oja, the
non-moving party. See Am. Bankers Ass’n v. Gould, 412 F.3d 1081, 1086
(9th Cir. 2005) (“We must determine, viewing the evidence in the light
most favorable to the nonmoving party, whether there are any genuine
issues of material fact and whether the district court correctly applied the
relevant substantive law.”).
2
A protective disclosure is “any disclosure of information by an
employee or applicant which the employee or applicant reasonably
2660 OJA v. USACE
and documented repeated statutory violations by the
USACE’s Alaska construction projects in investigative
reports required under the Clean Water Act of 1977, Pub. L.
No. 95-217, 91 Stat. 1566 (codified in scattered sections of 33
U.S.C.). In 1997, the USACE stripped Oja of his duties’ as
Regulatory Chief. In February 1998, Oja filed a claim for job-
related illness. That same month, the USACE acknowledged
in writing that Oja’s medical records demonstrated that he
was disabled for work due to a stress-related illness.
In 1999, Oja and the USACE entered into a settlement
agreement regarding his claim for job-related illness
(“Settlement Agreement”). The USACE agreed to “convert
the basis” for Oja’s termination from “excessive absence and
failure to follow leave procedures” to “continued absence due
to illness.” The USACE also agreed to purge the former
explanation from its records. Oja agreed to file for retirement,
which the USACE subsequently granted, retroactive to March
1998.
In September 2000, The Washington Post published a
series of articles critical of the USACE. The series included
a discussion of the Alaska District and Oja’s tenure as Regu-
latory Chief and mentioned Oja’s earlier complaints that the
USACE had thwarted his efforts to enforce wetlands viola-
tions.
At some point shortly after the Post articles appeared, the
USACE posted a point-by-point response to the articles on its
Internet website under “Corps Facts” at http://www.hq.usace.
army.mil/cepa/pubs/Alaska.htm. One of these points reads:
Issue: Mr. Robert Oja, Chief of Regulatory in the
Alaska District . . .
believes evidences . . . a violation of any law, rule, or regulation, or . . .
gross mismanagement, a gross waste of funds, an abuse of authority, or
a substantial and specific danger to public health or safety . . . .” 5 U.S.C.
§ 2302(b)(8)(A).
OJA v. USACE 2661
Removal from Job: Mr. Oja stopped coming to work
on October 23, 1997, and failed to provide informa-
tion about the likelihood of returning to work. Effec-
tive September 5, 1998, Mr. Oja was removed from
his position for excessive absence due to illness.
The USACE removed the posting from its public Internet
website on November 27, 2000. The following month, Oja
asserts, he discovered “the very same personal information
about me could be accessed by going into the [USACE’s]
Public Affairs website, clicking on ‘news publications,’ and
then finding a new posting that contained the [same] personal
information about me.”
In September 2001, Oja filed a Petition for Enforcement
with the Merit Systems Protection Board (“MSPB”). He
alleged that the USACE had breached the Settlement Agree-
ment by posting employment and medical information about
him on its Internet website and by not providing relocation
entitlements. He further alleged that these breaches were
intentional and that the USACE had continued to abuse him
as if the Settlement Agreement had never existed. He stated
in his petition that
In September 2000, (more than a year after the set-
tlement terms had taken effect, I learned that the
[USACE] posted the following information about me
on their national Internet web site.
“Removal from Job. Mr. Oja stopped coming to work
on October 23, 1997, and failed to provide informa-
tion about the likelihood of returning to work. Effec-
tive September 5, 1998, Mr. Oja was removed from
his position for excessive absence due to illness.”
Oja later confirmed that “I first saw the [USACE] Internet
posting about me in September 2000.” In October 2001, the
USACE informed Oja that it had placed his personal informa-
2662 OJA v. USACE
tion on its Internet website to “defend” the USACE from
“media inquiries.”
Oja filed his original complaint in the District of Oregon on
November 5, 2002, alleging that the USACE had violated the
Privacy Act by posting Oja’s private information on its public
Internet website (“Original Complaint”). He then filed an
amended complaint on November 25, 2002 (“First Amended
Complaint”). Both complaints stated that “[d]uring the month
of November 2000, and continuously until at least November
27, 2000, the defendants posted private information about Mr.
Oja on the public portions of the USACE’s Internet website.”
On March 10, 2003, Oja filed a Second Amended Complaint.
In that complaint, Oja did not repeat his allegations that the
USACE violated the Privacy Act by posting private informa-
tion on its public Internet website from September to Novem-
ber 2000. Rather, he alleged that “[d]uring the month of
December 2000” Defendants posted private information about
him on “public portions of the USACE’s Public Affairs Inter-
net website.” Oja noted that this was the same information he
“had previously located on a different USACE website, [ ] but
which had disappeared from that website in late November
2000.” Oja alleged that the USACE continuously posted this
information on the USACE Public Affairs Internet website
from December 2000 until January 2001. Defendants filed a
motion for summary judgment in response to Oja’s First
Amended Complaint and a motion to dismiss in response to
Oja’s Second Amended Complaint.
B. Proceedings
1. First Amended Complaint
Defendants filed for summary judgment against Oja’s First
Amended Complaint on the basis that Oja had not filed his
claim within the Privacy Act’s two-year statute of limitations.
See 5 U.S.C. § 552a(g)(5) (specifying that an “action to
enforce any liability created under this section may be
OJA v. USACE 2663
brought . . . within two years from the date on which the cause
of actions arises”). The Defendants submitted Oja’s statement
before the MSPB that he had discovered the Internet postings
in September 2000, and argued that his Original Complaint—
filed November 5, 2002—had not been filed within the Pri-
vacy Act’s statute of limitations; accordingly, Defendants
argued that the district court lacked jurisdiction to consider
Oja’s Original and First Amended Complaints.
Oja opposed the Motion, asserting that the continuously-
available Internet posting constituted a perpetual violation of
the Privacy Act and that his action was therefore within the
statute of limitations. He also argued that the statute of limita-
tions should actually have commenced to run when the
USACE informed him in October 2001 of its reason for post-
ing the information because it was only as of that point that
he had actual knowledge that the posting was “willful or
intentional.”
The magistrate judge recommended granting Defendants’
summary judgment request. The magistrate judge found that
Oja’s First Amended Complaint only referenced the posting
he discovered in September 2000; the September 2000 post-
ing did not fall within the narrow parameters of the continuing
violation doctrine and, accordingly, the statute began to run at
the time Oja discovered the posting; and Oja’s cause of action
accrued when Oja first became aware of the posting rather
than when Oja first learned that the posting had been inten-
tionally or willfully published on the USACE public website.
After a de novo review, the District Court adopted the magis-
trate judge’s findings and recommendation, and entered judg-
ment for Defendants.
2. Second Amended Complaint
Defendants filed a motion to dismiss Oja’s Second
Amended Complaint, asserting that it was also filed more than
two years after Oja discovered the second posting on the
2664 OJA v. USACE
USACE Internet website. Defendants argued that because the
Second Amended Complaint concerned a posting distinct
from that contemplated in Oja’s Original and First Amended
Complaints, the Second Amended Complaint did not relate
back to the First Amended Complaint. See Fed. R. Civ. P.
15(c). Oja opposed the motion, arguing that his Second
Amended Complaint averred that he found the same informa-
tion referenced in his Original and First Amended Complaints
on a different USACE Internet website; thus, the conduct and
basic facts alleged in the First and Second Amended Com-
plaints were identical, his Second Amended Complaint should
relate back to the First Amended Complaint’s filing date, and
the Second Amended Complaint should accordingly be con-
sidered filed within the statutory period. Oja argued in the
alternative that the multiple publication rule should apply to
his case because the USACE engaged in serial disclosure of
identical private information; under that theory, each disclo-
sure made to those who accessed the personal information on
the USACE’s website commenced a new statute of limitations
period.
After considering the foregoing, the magistrate judge rec-
ommended granting the Defendants’ motion to dismiss. The
magistrate judge viewed the “question before the court [as]
. . . whether the second posting [discovered in December
2000], to a different website, can reasonably be viewed as
involving the same transaction as the first posting [discovered
in September 2000].” The magistrate judge held that the
“posting of information—even identical information—on a
website different from that to which the information was first
posted is a discrete act, independent of the first posting.”
Analogizing the instant case to a publication of the same arti-
cle in two different issues of two different magazines owned
by a single parent company, the magistrate judge stated that
a plaintiff could “not amend his complaint . . . and expect that
it would relate back because the two publications are entirely
independent factual bases for separate claims.” Finding that
the December 2000 USACE Internet website posting was a
OJA v. USACE 2665
transaction wholly independent of the September 2000 post-
ing, the magistrate judge held that the relation back doctrine
was inapplicable, and, accordingly, the statute of limitations
for the Privacy Act cause of action in Oja’s Second Amended
Complaint expired three months before the filing of that com-
plaint. After conducting a de novo review, the District Court
again adopted the magistrate judge’s findings and recommen-
dation, and granted Defendants’ Second Motion for Summary
Judgment. This timely appeal by Oja followed.
II. STANDARD OF REVIEW
We review de novo the question of when a cause of action
accrues and whether a claim is barred by the statute of limita-
tions. Orr v. Bank of America, NT & SA, 285 F.3d 764, 779-
80 (9th Cir. 2002). We also review de novo the district court’s
application of the Federal Rules of Civil Procedure, including
Rule 15(c)’s relation back doctrine. In re Dominguez, 51 F.3d
1502, 1509 (9th Cir. 1995).
III. ANALYSIS
Over the last several years, we have labored to apply settled
principles of law and procedure to the relatively new medium
of the Internet.3 That application has often proved difficult
and occasionally unsatisfying, given the novel structure and
ubiquity of the web and its growing importance to social dia-
logue and electronic commerce. The present appeal raises a
novel question in this circuit: when does a cause of action
3
See, e.g., Gator.Com Corp. v. L.L. Bean, Inc., 341 F.3d 1072 (9th Cir.
2003) (finding general personal jurisdiction on basis of Internet-based
commerce), rehearing en banc granted, 366 F.3d 789 (9th Cir. 2004),
appeal dismissed as moot, 398 F.3d 1125 (9th Cir. 2005) (en banc);
Cybersell, Inc. v. Cybersell, Inc., 130 F.3d 414, 416-20 (9th Cir. 1997)
(applying traditional jurisdictional prerequisites to claims arising from
Internet-borne contact); see also Rio Props., Inc. v. Rio Int’l Interlink, 284
F.3d 1007, 1017-18 (9th Cir. 2002) (considering the benefits and draw-
backs to allowing email as an alternative service of process).
2666 OJA v. USACE
accrue for an unauthorized, Internet-borne publication of
information protected by the Privacy Act?
The Privacy Act provides:
No agency shall disclose any record which is con-
tained in a system of records by any means of com-
munication to any person, or to another agency,
except pursuant to a written request by, or with the
prior written consent of, the individual to whom the
record pertains . . . .
5 U.S.C. § 552a(b). The Privacy Act also specifies civil reme-
dies to be imposed for violations:
Civil Remedies.—Whenever any agency . . .
(D) fails to comply with any other provision of this
section, or any rule promulgated thereunder, in such
a way as to have an adverse effect on an individual,
the individual may bring a civil action against the
agency, and the district courts of the United States
shall have jurisdiction in the matters under the provi-
sions of this subsection.
5 U.S.C. § 552a(g)(1)(D).
[1] The statute declares—as plainly as words can convey—
that no agency shall disclose any record within its system
without a written request by or the prior written consent of the
individual affected, subject to certain exceptions not applica-
ble here. Oja has alleged (and for purposes of this appeal we
must assume) that the USACE violated § 552a(b) by disclos-
ing his personal information on its Internet website without
Oja’s prior written request or consent. The only question
before us, then, is whether the Privacy Act’s statute of limita-
tions bars Oja from bringing his suit more than two years after
OJA v. USACE 2667
he first learned of the USACE’s disclosure. A suit seeking
civil damages under the Privacy Act must be filed
within two years from the date on which the cause
of action arises, except that where an agency has
materially and willfully misrepresented any informa-
tion required under this section to be disclosed to an
individual and the information so misrepresented is
material to establishment of the liability of the
agency to the individual under this section, the
action may be brought at any time within two years
after discovery by the individual of the misrepresen-
tation.
5 U.S.C. § 552a(g)(5).
[2] In general then, an individual must bring suit within two
years of the unauthorized disclosure except where an agency
has willfully misrepresented information required to be dis-
closed to the individual and which would be material to estab-
lishing the agency’s liability under the Privacy Act; in such
exceptional circumstances, § 552a(g)(5) affords the individual
two years from the time he discovers the agency’s actions.
Oja’s Original Complaint was filed on November 5, 2002,
and then amended and refiled as his First Amended Com-
plaint on November 25, 2002. The First Amended Complaint
states that “[d]uring the month of November 2000, and con-
tinuously until at least November 27, 2000, the defendants
posted private information about Mr. Oja on the public por-
tions of the USACE’s Internet website . . . .” In Oja’s Petition
for Enforcement filed with the MSPB on September 8, 2001,
however, he acknowledged that
In September 2000, (more than a year after the set-
tlement terms had taken effect), I learned that the
Agency posted the following information about me
on their national Internet web site [ ]:
2668 OJA v. USACE
“Removal from Job. Mr. Oja stopped coming to
work on October 23, 1997, and failed to provide
information about the likelihood of returning to
work. Effective September 5, 1998, Mr. Oja was
removed from his position for excessive absence due
to illness.”
Oja then filed his Second Amended Complaint in March
2003, in which he alleged that the USACE had posted the
same information on its Public Affairs Internet website from
December 2000 until January 2001. Obviously, Oja’s Original
and First Amended complaints were filed more than two years
after he first learned that the USACE had posted private infor-
mation on its website. Similarly, Oja filed his Second
Amended Complaint more than two years after he discovered
that the USACE had posted the same information on a differ-
ent portion of its website.
Oja raises three arguments for why his First and Second
Amended Complaints were nonetheless filed within the Pri-
vacy Act’s statute of limitations. First, Oja argues that posting
information on the Internet is a continuing tort, that each dis-
closure gives rise to a cause of action and new limitations
period, and that the single publication rule should not apply
to Internet publications. Accordingly, Oja argues that his First
Amended Complaint was timely because it was filed on
November 5, 2002—less than two years after November 27,
2000, the date on which the USACE removed the posted
information. Second, Oja avers that because the USACE
posted identical information at a second website, his Second
Amended Complaint related back to the dates on which he
filed his Original and First Amended Complaint. Third, Oja
asserts that his suit was timely because his cause of action did
not actually accrue until October 2001, when he learned that
the USACE intentionally or willfully disclosed private infor-
mation on its Internet website. We consider each of these
arguments in turn.
OJA v. USACE 2669
A. The Single Publication Rule and Internet Publications
As a threshold matter, we note the enormous impact of the
Internet on commerce and the marketplace of ideas. Indeed,
“[f]rom the publishers’ point of view, [the World Wide Web]
constitutes a vast platform from which to address and hear
from a worldwide audience of millions of readers, viewers,
researchers, and buyers.” Reno v. ACLU, 521 U.S. 844, 853
(1997). Such broad access to the public carries with it the
potential to influence thought and opinion on a grand scale.
By extension, the publication of defamatory and private infor-
mation on the web has the potential to be vastly more offen-
sive and harmful than it might otherwise be in a more
circumscribed publication. Accordingly, in search of cogent
principles, we compare the Internet to other media with great
care.4
[3] While the language of the Privacy Act speaks in terms
of “disclosures,” the magistrate judge analogized the
USACE’s website posting to the publication of a magazine or
office manual. We agree that the analogy to mass media, defa-
mation law, and the notion of publication is appropriate when
considering unauthorized disclosures under the Privacy Act,
given that the statutory text prohibits disclosure “by any
means of communication” and such disclosure implies the
concept of publication to a third party. In addition, the term
“disclose” is defined as “to make known or public.” See
MERRIAM-WEBSTER’S COLLEGIATE DICTIONARY 330 (10th ed.
1999). In light of these textual and grammatical indicia, we
conclude that it is appropriate to import publication consider-
4
Almost all of the cases to have considered the publication rules associ-
ated with other media have done so in the context of defamation actions.
See infra note 5 and accompanying text. Such claims are governed by state
law, while we are called upon to consider publication in the context of the
federal Privacy Act. Accordingly, we note that while we look to the states’
approaches to and decisions regarding media publication rules for their
persuasive value, we are not bound by their precedents in construing a fed-
eral law.
2670 OJA v. USACE
ations into our analysis of the Privacy Act. In so doing, we
also consider legal doctrines generally associated with the
realm of defamation law, namely the single publication rule.
We also note that the fact that both the Privacy Act and defa-
mation law are driven by similar policy concerns—personal
integrity and reputational interests—makes the application all
the more apt.
[4] Courts that have considered the issue of when Internet-
based information is properly considered “published” have
done so largely in the context of state defamation suits. These
courts have generally concluded that the posting of informa-
tion on the web should be treated in the same manner as the
publication of traditional media (i.e., books, newspapers,
magazines, and radio and television broadcasts), that is, that
traditional media’s “single publication rule” should apply to
postings on the Internet.5 Under the single publication rule,
“any one edition of a book or newspaper, or any one radio or
5
See, e.g., Van Buskirk v. New York Times Co., 325 F.3d 87 (2d Cir.
2003); Mitan v. Davis, 243 F. Supp. 2d 719 (W.D. Ky. 2003); Lane v.
Strang Commc’ns Co., 297 F. Supp. 2d 897 (N.D. Miss. 2003); Simon v.
Ariz. Bd. of Regents, 28 Media L. Rep. (BNA) 1240 (Ariz. Super. Ct.
1999); Traditional Cat Ass’n, Inc. v. Gilbreath, 118 Cal. App. 4th 392, 13
Cal. Rptr. 3d 353 (2004); McCandliss v. Cox Enter., 593 S.E.2d 856 (Ga.
2004); Abate v. Me. Antique Digest, No. 03-3759, 2004 WL 293903, *1-
2 (Mass. Super. Ct. Jan. 26, 2004); Churchill v. State, 876 A.2d 311 (N.J.
Super. Ct. App. Div. 2005); Firth v. State, 775 N.E.2d 463 (N.Y. 2002);
E.B. v. Liberation Publ’ns, Inc., 777 N.Y.S.2d 133 (N.Y. App. Div. 2004).
In addition to state and federal courts, academic commentators have
begun to weigh in on the issue, and have largely endorsed application of
the single publication rule in the context of Internet publication. See, e.g.,
Sapna Kumar, Comment, Website Libel and the Single Publication Rule,
70 U. CHI. L. REV. 639, 662 (2003) (in favor of applying the single publi-
cation rule only when the Internet website is “truly available” to the pub-
lic); Lori A. Wood, Note, Cyber-Defamation and the Single Publication
Rule, 81 B.U. L. REV. 895 (2001) (in favor of applying the single publica-
tion rule to Internet publications). But see Odelia Braun, Comment, Inter-
net Publications and Defamation: Why the Single Publication Rule Should
Not Apply, 32 GOLDEN GATE U.L. REV. 325 (2002).
OJA v. USACE 2671
television broadcast, exhibition of a motion picture or similar
aggregate communication is a single publication.” RESTATE-
MENT (SECOND) OF TORTS § 577A(3) (1977). Under this rule,
the aggregate communication can give rise to only one cause
of action in the jurisdiction where the dissemination occurred,
and result in only one statute of limitations period that runs
from the point at which the original dissemination occurred.
Zuck v. Interstate Publ’g Corp., 317 F.2d 727, 729-30 (2d Cir.
1963).
Courts that have extended the single publication rule to
Internet publishing have done so on the premise that pub-
lished web content is functionally identical to published tradi-
tional print media and, accordingly, Internet publication
should be considered “published” in the same manner as is a
print edition.6 While that premise is not entirely accurate,7 we
agree that the analogy between Internet and print publication
is sufficiently apt to be serviceable. Internet publication is a
form of “aggregate communication” in that it is intended for
a broad, public audience, similar to print media.8 In both print
6
See, e.g., Mitan v. Davis, 243 F. Supp. 2d at 724 (“A statement elec-
tronically located on a server which is called up when a web page is
accessed, is no different from a statement on a paper page in a book lying
on a shelf which is accessed by the reader when the book is opened. After
carefully examining the issue, we can find no basis for treating defamatory
Internet communication differently than any other form of aggregate com-
munication. Therefore, we will apply the single publication rule to the
statements in this case which were published on the Internet.”).
7
We note, for example, that a book cannot be updated in the same man-
ner that a web page can be; and once a book has been published and sold,
an author or publisher may not be in a position to withdraw its availability,
whereas a website host who is also the author of the site’s content gener-
ally controls the availability of the information, at least as it is accessible
from the author-host’s own website. It is also true, however, that a viewer
can save or print accessed material before the website host has a chance
to make any changes, resulting in a permanent record.
8
See Wood, supra note 5, at 913 (“Information contained on Internet
sites is available to the public, and is properly classified as an aggregate
2672 OJA v. USACE
and Internet publishing, information is generally considered
“published” when it is made available to the public.9 Once
information has been published on a website or print media,
there is no further act required by the publisher to make the
information available to the public.10
[5] In addition to functional similarities between print and
Internet publication, the same considerations that compel
application of the first publication rule to traditional forms of
aggregate communication are equally compelling in the con-
text of Internet publication. The single publication rule is
publication . . . . Arguably, the information on a website is even more
accessible than information in many traditional forms of publication
because once a person has access to the Internet, the information contained
on most sites is free. Moreover, an Internet communication, even more so
than publications by traditional means, can instantly reach an expansive
geographical area, thus exposing the publisher to liability in every state.”)
9
See Firth v. State, 706 N.Y.S.2d. 835, 841 (N.Y. Ct. Cl. 2000) (noting
that “[p]ublication occurs when the defamatory work first becomes gener-
ally available to the public or is placed on sale, and it should be noted that
this is not the same as the ‘publication date,’ a term of art in the publishing
industry which refers to a time substantially after the material has been
shipped to bookstores and sales are already under way, and when publicity
events begin.” (internal citations and quotations omitted)), aff’d, 731
N.Y.S.2d 244 (N.Y. App. Div. 2001), aff’d, 775 N.E.2d 465 (N.Y. 2002).
10
It is true that an Internet publisher may have greater control over the
availability of content posted on its server than a print publisher has over
its printed stock; however, that fact alone does not corrupt the analogy
between Internet and print publication, given that the single publication
rule generally applies to books in a publisher’s stock that could have been
withdrawn following their initial availability for sale but were not. See
Gregoire v. G.P. Putnam’s Sons, 81 N.E.2d 45, 48-49 (N.Y. 1948) (noting
this approach, and rejecting a contrary result: “although a book containing
libelous material may have been the product of but one edition or printing
fifty years ago, if, by sale from stock or by display, the publisher continues
to make unsold copies of the single publication available to the public
today, such conduct would amount to a republication of any libel the book
contains and thereby would become actionable. Under such a rule the Stat-
ute of Limitation would never expire . . . .”).
OJA v. USACE 2673
designed to protect defendants from harassment through mul-
tiple suits and to reduce the drain of libel cases on judicial
resources. See Keeton v. Hustler Magazine, Inc., 465 U.S.
770, 777 (1984). Those same considerations present them-
selves in relation to Internet publishing, and militate in favor
of applying the single publication rule to Internet publication.
Given that “[c]ommunications posted on Web sites may be
viewed by thousands, if not millions, over an expansive geo-
graphic area for an indefinite period of time,” allowing Inter-
net publications to be subject to a multiple publication rule
“would implicate an even greater potential for endless retrig-
gering of the statute of limitations, multiplicity of suits and
harassment of defendants. Inevitably, there would be a serious
inhibitory effect on the open, pervasive dissemination of
information and ideas over the Internet, which is, of course,
its greatest beneficial promise.” Firth, 775 N.E.2d at 466.
Such concerns have motivated state courts to extend the sin-
gle publication rule to Internet publication,11 and federal
courts sitting in diversity have done likewise.12
Oja takes issue with the analogy to traditional media and
the proposition that the single publication rule should apply to
Internet publication. He urges us to consider the continuous
hosting of private information on an Internet website as a
series of discrete and ongoing acts of publication, each giving
rise to a cause of action with its own statute of limitations.
Specifically, Oja compares the hosting of a website to a series
of citizen telephone calls to the USACE, each caller asking
11
See, e.g., Firth, 775 N.E.2d at 466; McCandliss, 593 S.E.2d at 858
(endorsing the language used and result reached in the Firth opinion); Tra-
ditional Cat Ass’n, Inc., 118 Cal. App. 4th at 404 (same).
12
See, e.g., Van Buskirk, 325 F.3d at 89 (applying the single publication
rule to a defamation action arising from Internet publications after Firth
became settled New York state law); Mitan, 243 F. Supp. 2d at 722-24
(determining that Kentucky would apply the single publication rule to
Internet-borne defamation); Lane, 297 F. Supp. 2d at 900 (applying the
single publication rule to a defamation action under Mississippi law
regarding articles published on the Internet).
2674 OJA v. USACE
the same question and each receiving the same private infor-
mation in response and in violation of the Privacy Act. We
find that approach problematic. The actual posting or publish-
ing of information onto a website requires only a single, dis-
crete act, and no additional action by the host is necessary
before the information may be accessed by the general public.
Thus, unlike a series of telephone calls, once a host posts
information on the Internet, the host may remain passive and
does not have to respond anew each time an Internet user
accesses its website. Here, for example, the USACE (the web-
site host) did not modify the substance of the published infor-
mation following the initial posting of the private information
in September of 2000 through November of 2000, or cause its
renewed publication beyond the continued hosting of its Inter-
net site.13 Although it is true that a website must be continu-
ously hosted on a server computer for the public to access
posted information, that action concerns technical mainte-
nance rather than the particularized and original effort
involved in publishing information to an audience; such rou-
tine maintenance of a website (which often amounts to no
more than supplying the server computer with power) should
not in itself be considered an act of republication.14
Oja urges us to adopt the approach taken in Swafford v.
Memphis Individual Practice Association, No. 02A01-9612-
13
We note that Oja alleged in his Second Amended Complaint that the
USACE republished the private information on another website; we
address that allegation in Section III.B., infra.
14
See, e.g., Firth, 706 N.Y.S.2d at 841 (“[T]he defendant’s allegedly
wrongful acts consisted of the issuance of the report on December 16,
1996 and its initial publication upon the Internet on the same date. Any
continuing damage to the claimant arising from its availability upon the
Internet would simply be a continuing effect of an earlier wrongful act.”).
Of course, substantive changes or updates to previously hosted content
that are not “merely technical” may sufficiently modify the content such
that it is properly considered a new publication for purposes of the statute
of limitations period. See In re Davis, 334 B.R. 874 (Bankr. W.D. Ky.
2005).
OJA v. USACE 2675
CV-00311, 1998 WL 281935 (Tenn. Ct. App. 1998), an
unpublished decision by the Tennessee Court of Appeals. In
Swafford, the National Practitioner Data Bank (“NPDB”) pro-
vided allegedly defamatory information to health care entities
which requested the information directly from the electronic
data bank maintained by the NPDB. Id. at *1. “Each transmis-
sion . . . was released in response to an affirmative request by
a hospital or other health care entity” and the databank could
be accessed only by certified health care entities. Id. at *5.
Accordingly, the court of appeals found that the single publi-
cation rule did not apply because each time a certified entity
directly requested the information from the electronic data-
bank held by the NPDB, the NPDB itself provided the infor-
mation directly to the requesting entity. Id. at *8.
Swafford is distinguishable from our present concern, and
is not inconsistent with application of the single publication
rule to the vast majority of Internet publications. Unlike a typ-
ical Internet publication, the information at issue in Swafford
was not available for the general public to access, nor could
any unregistered and non-specific entities access the regis-
tered databank. Given the exclusive and controlled access to
the NPDB “pay-to-play” databank, the release of the offend-
ing information could hardly be considered an “aggregate
communication” comparable to typical Internet publication,
where access is generally available to anyone at any time.
Indeed, the limited access scenario set forth in Swafford
resembles Oja’s telephone call analogy where the agency
releases the information anew each time there is a request.
Swafford is much more akin to the release of personal credit
reports by those agencies that track and compile credit infor-
mation; in such cases, it has been widely accepted that the
transmission or publication of the information does not war-
rant application of the single publication rule, and each trans-
mission or publication is actionable.15
15
See Wood, supra note 5, at 909-12 (surveying the approach taken in
credit reporting cases and distinguishing such cases—and Swafford—from
2676 OJA v. USACE
[6] Application of the single publication rule to Internet
publication is not inconsistent with the Privacy Act’s stric-
tures. Application of the single publication rule to Internet
publication will focus Privacy Act claims against a defendant,
thereby economizing judicial resources while preserving the
plaintiff’s ability to bring the claims. Thus, we hold that the
single publication rule should be applied under the Privacy
Act to general Internet publications. Consequently, Oja’s
Original and First Amended Complaints were not filed timely,
and the district court correctly determined that Oja’s claims
were barred by the statute of limitations.
[7] Oja’s Second Amended Complaint is also barred by the
statute of limitations. In March 2003, Oja filed a Second
Amended Complaint, alleging that the USACE published the
same private information at a different Internet address in
December 2000. If, in fact, the USACE published the same
private information at a different URL address,16 then that dis-
closure constitutes a separate and distinct publication—one
not foreclosed by the single publication rule—and the
USACE might be liable for a separate violation of the Privacy
Act. However, such an additional claim is still subject to the
statute of limitations, which, under the Privacy Act, is two
Firth and its progeny that would apply the single publication rule: “Al-
though Swafford also involved defamation that occurred via the Internet,
the similarity between its facts and those of Firth end there. . . . The court
in Swafford appropriately relied on the credit reporting service cases,
because credit reporting services closely resembled the defendant’s indus-
try. On the other hand, when a site is available to the general public, the
communications contained therein more closely resemble newspapers,
books, magazines, and television or radio broadcasts.”).
16
While Oja does not provide the public affairs website’s URL listing
in his Second Amended Complaint, he claims therein that this site was a
second site, distinct from the national page site contemplated in his first
two complaints: “This information [posted on the public affair’s website]
was the same information Mr. Oja had previously located on a different
USACE website . . . but which had disappeared from that website in late
November 2000.” Accordingly, we herein treat the unidentified second
site as separate and distinct from the USACE’s national page site.
OJA v. USACE 2677
years from the date the private information is made public.
See 5 U.S.C. § 552a(g)(5). Given that the alleged second dis-
closure occurred in December 2000, the statute would have
run in December 2002, some three months before Oja filed
suit for the disclosure in his Second Amended Complaint,
filed in March 2003. Accordingly, the district court correctly
determined that the Second Amended Complaint was
untimely.
B. The Relation Back Doctrine
Oja claims that his Second Amended Complaint is timely
because it relates back to the filing of his earlier complaints.
Oja argues that the Privacy Act claims in his Second
Amended Complaint are timely because they arose out of the
same “conduct, transaction, or occurrence” alleged in his ear-
lier complaints, given that the information in the second post-
ing was identical to the information in the first posting;
accordingly, Oja avers that his Second Amended Complaint
should relate back to the filing date of his earlier complaint
under Rule 15(c)(2).
[8] After considering the issue, we find that Oja mistakes
the meaning of the language of Rule 15(c)(2). Rule 15(c) of
the Federal Rules of Civil Procedure provides, in pertinent
part, that
An amendment of a pleading relates back to the date
of the original pleading when:
...
(2) the claim or defense asserted in the amended
pleading arose out of the conduct, transaction, or
occurrence set forth or attempted to be set forth in
the original pleading . . . .
2678 OJA v. USACE
The conduct, transaction, or occurrence of which Oja com-
plained in his First Amended Complaint was the USACE’s
act of disclosing Oja’s personal information on its website in
November 2000, in violation of the Privacy Act’s prohibi-
tions. By contrast, Oja’s Second Amended Complaint alleges
claims arising from a second disclosure by the USACE on a
separate website occurring in December 2000. Nowhere in
Oja’s First Amended Complaint does he reference a second
disclosure on a USACE public affairs site in December 2000,
and nowhere has Oja alleged that the disclosure act in Decem-
ber 2000 arose out of the conduct, transmission, or occurrence
of the USACE’s November 2000 disclosure on the USACE’s
national site. The Privacy Act states that “[n]o agency shall
disclose any record which is contained in a system of records
by any means of communication to any person,” 5 U.S.C.
§ 552a(b), and we have determined, supra, that a disclosure
occurs when the information is first posted on the Internet.
The fact that the language in the two disclosures is identical
is inapposite because Oja’s claims under the Privacy Act are
based on the acts of disclosure themselves, each of which is
distinct in time and place, if not substance.17 Accordingly, and
given that the claims made in Oja’s Second Amended Com-
plaint are otherwise barred by the statute of limitations, we
agree with the district court that Oja’s Second Amended
Complaint does not relate back to the filing date of Oja’s ear-
lier complaint. Our conclusion is consistent with our applica-
tion of the single publication rule to Internet publication.18
17
See 6A CHARLES ALAN WRIGHT, ARTHUR R. MILLER & MARY KAY
KANE, FEDERAL PRACTICE AND PROCEDURE, § 1497, at 70-74 (2d ed. 1990)
(“When plaintiff attempts to allege an entirely different transaction by
amendment, Rule 15(c) will not authorize relation back. For example,
amendments alleging the separate publication of libelous statement, . . . or
even a separate violation of the same statute may be subject to the defense
of statute of limitations because of a failure to meet the transaction stan-
dard.” (internal footnotes omitted)).
18
It is worth noting that if the USACE’s December 2000 publication of
Oja’s private information were considered the same publication as the
OJA v. USACE 2679
C. Intentional or Willful Disclosures
In the alternative, Oja argues that while he knew of the
USACE’s posting in September 2000, his cause of action did
not actually accrue until October 2001, when he claims he
first learned that the USACE’s posting was “intentional or
willful.” 5 U.S.C. § 552a(g)(1)(D) provides that “Whenever
an agency . . . (D) fails to comply with any other provision
of this section, or any rule promulgated thereunder, in such a
way as to have an adverse effect on an individual, the individ-
ual may bring a civil action against the agency . . . .” Section
552a(g)(4) predicates an award of monetary damages for a
violation of § 552a(g)(1)(D) on “the court determin[ing] that
the agency acted in a manner which was intentional or will-
ful.” (Emphasis added). Oja asserts that this reference to “wil-
lful[ness]” brings his claim within the exception to the statute
of limitations provision, Section 552a(g)(5). That section
states, in relevant part, that
An action to enforce any liability created under this
section may be brought . . . within two years from
the date on which the cause of action arises, except
that where an agency has materially and willfully
misrepresented any information required under this
section to be disclosed to an individual and the infor-
mation so misrepresented is material to establish-
ment of the liability of the agency to the individual
under this section, the action may be brought at any
USACE’s earlier publication—as Oja asks the Court to conclude in his
relation back argument—the single publication rule would be significantly
narrowed, given that the statute of limitations for claims of separate dis-
closures of identical private information on separate websites would run
from the first such publication. Such an outcome—which this opinion’s
holding forecloses—is inconsistent with the Privacy Act’s plain language
and is surely contrary to the true interests of Oja and similarly situated
plaintiffs that assert Privacy Act claims.
2680 OJA v. USACE
time within two years after discovery by the individ-
ual of the misrepresentation.
Id. (emphasis added). Thus, Oja asserts that the statute of lim-
itations for his original Privacy Act claims did not begin to
run until October 2001, placing them well within the limita-
tions period.
“The Privacy Act’s statute of limitations commences when
the person knows or has reason to know of the alleged viola-
tion. Because the accrual of the statute of limitations in part
turns on what a reasonable person should have known, we
review this mixed question of law and fact for clear error.”
Rose v. United States, 905 F.2d 1257, 1259 (9th Cir. 1990)
(internal citations omitted); see also Englerius v. Veterans
Admin., 837 F.2d 895, 898 (9th Cir. 1988) (“We join the Sev-
enth, Tenth and District of Columbia Circuits in holding that
a cause of action under the Privacy Act does not arise and the
statute of limitations does not begin to run until the plaintiff
knows or has reason to know of the alleged violation.”). To
the extent that Oja avers that he was unaware that the USACE
intentionally or willfully disclosed his personal information,
we find that the record substantiates the magistrate judge’s
finding that Oja knew or had reason to know in September
2000 that the USACE intentionally posted his information on
its Internet site. Indeed, the magistrate judge found that “it
would have been unreasonable for [Oja] to believe that the
posting was anything but intentional.” Accordingly, the mag-
istrate judge concluded that, “[w]hile the court allows for the
possibility of an ‘accidental posting,’ the chances of such an
unintentional posting occurring are so small that the only rea-
sonable assumption for plaintiff to make when he became
aware of the posting was that it was done intentionally.” We
add to that assessment that the context in which Oja’s infor-
mation was posted compels the inference that the USACE’s
posting was intentional: As Oja himself notes in his First
Amended Complaint,19 his personal information was posted in
19
Oja asserted that, “[d]uring the month of November 2000, and contin-
uously until at least November 27, 2000, the defendants posted private
OJA v. USACE 2681
conjunction with the USACE’s response to a Washington Post
article that was critical of the USACE and which referred to
Oja’s whistle-blowing activities during his tenure with the
Alaska District. Moreover, the information the USACE
posted on Oja was inconsistent with the Settlement Agree-
ment, as Oja had claimed in his September 2001 Petition for
Enforcement before the MSPB. Given the foregoing, there is
no error in the magistrate judge’s findings or conclusions.
[9] Oja asserts that § 552a(g)(5) tolled the statute of limita-
tions in his claim until he learned that the USACE admitted
that its posting was intentional. Oja’s argument incorrectly
conflates the context in which the term “willfulness” operates
in §§ 552a(g)(4) and (5). Section 552a(g)(4) provides that
agency disclosure of personal information must be intentional
or willful in order to permit the recovery of monetary dam-
ages. As discussed previously, § 552a(g)(5) requires that all
claims for actionable agency disclosures be brought within
two years of the disclosure unless the agency has materially
and willfully misrepresented information that the Privacy Act
requires the agency to disclose to an individual, and that mis-
representation is material to establishing the individual’s Pri-
vacy Act claim. Nowhere in his argument has Oja asserted
that the USACE materially or willfully misrepresented infor-
mation that it was required to disclose to him and that this
information was material to Oja bringing his Privacy Act
claim; rather, Oja asserts that the USACE failed to inform
him in 2000, and he did not learn until October 2001, that the
USACE’s disclosure was intentional or willful. The USACE
may have acted improperly in posting Oja’s personal informa-
tion, but the Privacy Act does not require the USACE to dis-
close that improper posting to Oja. Moreover, as we have
stated, it was clear from the outset that the USACE’s disclo-
information about Mr. Oja on the public portions of the USACE’s Internet
website . . . . These statements appear to be the Corps’ response to the
statements in the Washington Post Article.”
2682 OJA v. USACE
sures were intentional or willful and that his claim arose when
he learned of the disclosures in 2000. Consequently,
§ 552a(g)(5)’s tolling provisions are entirely inapposite to
Oja’s claims.
IV. CONCLUSION
We affirm the district court’s grant of summary judgment
in favor of the Defendants on Oja’s First Amended Complaint
and the district court’s dismissal of Oja’s Second Amended
Complaint. AFFIRMED.