Jacobs v. National Drug Intelligence Center

United States Court of Appeals
Fifth Circuit
F I L E D
IN THE UNITED STATES COURT OF APPEALS
FOR THE FIFTH CIRCUIT August 25, 2005

)))))))))))))))))))))))))) Charles R. Fulbruge III
Clerk
No. 04-40466

))))))))))))))))))))))))))

GARY JACOBS,

Plaintiff–Appellant,

v.

NATIONAL DRUG INTELLIGENCE CENTER, ET AL.,

Defendants–Appellees.

Appeal from the United States District Court
for the Southern District of Texas

Before REAVLEY, JOLLY, and PRADO, Circuit Judges.

EDWARD C. PRADO, Circuit Judge:

This case involves the disclosure provision of the Privacy

Act of 1974. The district court granted summary judgment for the

National Drug Intelligence Center, holding that the information

in the disclosed document is not a “record” within the meaning of

the Act. We disagree and now reverse.

I.

Plaintiff–Appellant Gary Jacobs is the President and CEO of

Laredo National Bank, which conducts business in the United

States and Mexico. Jacobs has been the President–CEO of the bank

for 25 years. He claims that the National Drug Intelligence

1
Center (“NDIC”) violated the Privacy Act by leaking part of an

internal analytical document, the “White Tiger Report” (“the

Report”), to the press. The Report alleged that Jacobs was

involved in a Mexican money-laundering and drug-trafficking

organization.

The NDIC is part of the Department of Justice. Its function

is to coordinate and consolidate drug intelligence from national-

security and law-enforcement agencies. Specifically, the NDIC

analyzes the structure, membership, finances, and activities of

drug-trafficking organizations.

In 1997, the FBI and the DEA asked the NDIC to conduct a

strategic assessment of a Mexican criminal organization that was

allegedly involved in money laundering and drug trafficking in

the United States, Mexico, and several other countries. As a

result, the “White Tiger Project” was born: NDIC analysts

collected and reviewed pertinent information from thousands of

agency records, including records from the DEA, FBI, U.S. Customs

Service, and the U.S. Attorney’s Office. The analysts placed

these records in the NDIC’s “RetrievalWare” database.

RetrievalWare is the NDIC’s electronic-document system.

RetrievalWare is located within the NDIC’s computer

system——”Justice/NDIC-001.” The “Main Network System” of

Justice/NDIC-001 contains RetrievalWare and two other component

parts, the “unit group” and the “unit home” directories, both of

2
which store Microsoft Word documents.

The White Tiger Report contained several different sections.

The section at issue in this case is the “Executive Summary,”

which summarized the entire Report. Neither the Report nor the

Executive Summary were stored in RetrievalWare, but rather in one

of the other component parts of the Main Network System (unit

group or unit home).

In March 1999, NDIC supervisor Daniel Huffman mailed a draft

version of the Executive Summary to Donald E. Schultz, a

professor at the U.S. Army War College. However, neither NDIC

management nor the agencies participating in the White Tiger

Project had reviewed this version of the Executive Summary yet.

The Office of the Inspector General of the Justice Department

conducted an investigation into the leak and concluded that

Huffman’s disclosure of the document to Schultz was unauthorized

and recommended “significant discipline.” Then–Attorney General

Janet Reno also acknowledged that “the release of the draft NDIC

report . . . was not authorized by either the NDIC or the

Department of Justice.”

In May 1999, Donald Schultz sent the Executive Summary to

Dolia Estevez, a reporter for the Mexican newspaper, El

Financiero. Later that month, El Financiero published a front-

page article entitled, “The Hanks, in the Gun Sight of U.S. Drug

Enforcement; They Constitute a Threat, It is Warned” (translated

3
from Spanish). The article purported to rely heavily on an

“unpublished official document” from the NDIC and contained

allegations of wrongdoing against Jacobs. Specifically, the

article discussed the activities of a family referred to as the

Hank Group and reported that the family laundered money through

Jacobs’s bank, stating,

The analysis states that Hank Rhon uses “front men” or
“men of straw” to acquire interests in the United States.
One of these characters, it says, is Gary Jacobs, the
president of the Laredo National Bank, who, according to
the NDIC, lacks personal resources sufficient to acquire
the shares he owns in the Bank.

In May 2001, Jacobs filed suit against the NDIC in the

Southern District of Texas, claiming that by leaking the

Executive Summary, the NDIC violated the Privacy Act by

disclosing “records” maintained in a “system of records.”

Specifically, Jacobs alleged that the Executive Summary was

derived from items of information (records) that the NDIC

analysts retrieved from RetrievalWare (the system of records).

The NDIC has not provided Jacobs with either the information

about him in RetrievalWare or a copy of the Executive Summary.

However, Jacobs believes that a confidential Customs Service

report from November 1997 was included in the RetrievalWare

records that formed the basis of the Executive Summary’s

information on Jacobs. Jacobs believes this for three reasons:

first, such reports were generally scanned into RetrievalWare;

second, El Financiero stated that the Executive Summary relied on

4
19 Customs Service cases; and third, the language of the El

Financiero article, which purports to quote the Executive

Summary, is similar to the language of the Customs report.1

Jacobs provided the following comparison in his brief:

November 1997 Customs Report El Financiero Article
“An in depth analysis of the “The analysis states that Hank
finances of Jacobs indicates Rhon uses ‘front men’ or ‘men of
that he is just a front man for straw’ to acquire interests in
Carlos Hank-Rhon and the Hank the United States. One of these
family in many enterprises of characters, it says, is Gary
the United States. A source has Jacobs, the president of the
indicated that Jacobs would Laredo National Bank, who,
never have been able to obtain according to the NDIC, lacks
those enormous earnings by personal resources sufficient to
himself. This is an example of acquire the shares he owns in
how the Hank family is obtaining the Bank.”
a solid foothold on the economy
of the United States.”

Jacobs claims that as a result of the accusations against

him published in El Financiero, his reputation has been

significantly damaged and he has lost substantial business

opportunities in both the United States and Mexico.

In September 2002, the NDIC moved to dismiss Jacobs’s

complaint or, alternatively, for summary judgment. Jacobs also

cross-moved for partial summary judgment against the NDIC on the

issue of liability.

The district court heard oral argument on the motions in

December 2002, granting the NDIC’s and denying Jacobs’s. The

1
The November 1997 Customs Service report was reprinted in
JOSE MARTINEZ, THE TEACHINGS OF THE PROFESSOR: INQUEST ON CARLOS HANK-GONZALES
234–66 (1999).

5
district court did not issue written reasons for its decision,

but did make the following statement at the summary judgment

hearing:

I’m going to grant the Motion to Dismiss and/or for
Summary Judgment of the NDIC here and that I don’t think
that the records here are maintaining a system of records
under the Privacy Act, section 552-A(a), where it defines
“record” and “system of records” and I don’t – both on
the Motion to Dismiss and/or the Summary Judgment Motion
I think it’s clear that they don’t, and that this is not
a Privacy Act matter.

Jacobs filed a motion to reconsider, which the district

court denied. Judgment was entered in April 2004. This appeal

followed.2 The only issue before the court is whether the

information about Jacobs in the Executive Summary constitutes a

“record” contained in a “system of records” within the meaning of

the Privacy Act.

II.

This court reviews a grant of summary judgment de novo,

applying the same standard as the district court. Bettersworth

v. FDIC, 248 F.3d 386, 391 (5th Cir. 2001).

The Privacy Act of 1974, 5 U.S.C. § 552a (1996), “safeguards

the public from unwarranted collection, maintenance, use and

dissemination of personal information contained in agency records

. . . by allowing an individual to participate in ensuring that

2
Jacobs appeals only the district court’s grant of the
NDIC’s motion for summary judgment; he does not appeal the denial
of his partial motion for summary judgment.

6
his records are accurate and properly used.” Henke v. U.S. Dep’t

of Commerce, 83 F.3d 1453, 1456 (D.C. Cir. 1996) (ellipsis in

original) (quoting Bartel v. FAA, 725 F.2d 1403, 1407 (D.C. Cir.

1984)). The Act provides four causes of action: (1) for an

agency’s failure to amend an individual’s record pursuant to his

request;3 (2) for an agency’s denial of access to an individual’s

records;4 (3) for an agency’s failure to maintain an individual’s

records with “accuracy, relevance, timeliness, and completeness”;5

and (4) for an agency’s failure to comply with other Privacy Act

provisions, which has an “adverse effect” on the individual.6 See

Gowan v. U.S. Dep’t of the Air Force, 148 F.3d 1182, 1187 (10th

Cir. 1998) (listing the four causes of action). The remedy

available to a successful plaintiff depends on which cause of

action he pursues. For the first two causes of action, a

successful plaintiff is entitled to injunctive relief, and, if

the plaintiff has “substantially prevailed,” the court may also

award attorney’s fees and costs. Id. at 1187 (citing 5 U.S.C. §

552a(g)(2), (g)(3)). For the latter two, a successful plaintiff

may recover damages, attorney’s fees, and costs, but only if he

proves that the governmental agency acted willfully. Id. at

3
5 U.S.C. § 552a(g)(1)(A).
4
Id. § 552a(d)(1), (g)(1)(B).
5
Id. § 552a(g)(1)(C).
6
Id. § 552a(g)(1)(D).

7
1187–88 (citing 5 U.S.C. § 552a(g)(4)).

Here, Jacobs asserts the fourth cause of action: he claims

that the NDIC willfully disclosed a “record” contained in a

“system of records” in violation of § 552a(b) and that the

disclosure had an adverse effect on him. Section 552a(b)

provides that “[n]o agency shall disclose any record which is

contained in a system of records by any means of communication to

any person,” unless the disclosure falls within one of twelve

statutory exceptions. § 552a(b). The NDIC has not alleged that

any exception applies to this case.

Thus, for Jacobs to survive summary judgment on his

disclosure claim, he must present evidence of the following

elements: (1) the information is a “record” in a “system of

records”; (2) the agency disclosed the information; (3) the

disclosure had an adverse effect on him; and (4) the disclosure

was willful. Quinn v. Stone, 978 F.2d 126, 131 (3d Cir. 1992).

Only the first element is at issue here——whether the information

disclosed about Jacobs is protected by the Act as a “record”

within a “system of records.”

III.

Jacobs argues that the record that was disclosed in this

case is the information about him that was retrieved by his name

from RetrievalWare and put into the Executive Summary. The NDIC,

by contrast, argues that the disclosed record is the Executive

8
Summary, itself. According to the NDIC, the Privacy Act does not

apply because the Executive Summary was not contained within

RetrievalWare’s system of records; that is, the document, itself,

was not retrieved from RetrievalWare by Jacobs’s name. The NDIC

cites little authority to support its interpretation of the

statute and instead tries to distinguish those cases relied upon

by Jacobs. It cannot. Jacobs’s interpretation of the statute is

supported by both the statute’s text and the cases interpreting

it. We therefore reverse the judgment of the district court.

A.

The Privacy Act prohibits the disclosure of “any record

which is contained in a system of records by any means of

communication.” § 552a(b). The Act defines “record” in the

following way:

[T]he term “record” means any item, collection, or
grouping of information about an individual that is
maintained by an agency, including, but not limited to,
his education, financial transactions, medical history,
and criminal or employment history and that contains his
name, or the identifying number, symbol, or other
identifying particular assigned to the individual, such
as a finger or voice print or photograph.

§ 552a(a)(4) (emphasis added). The statute further defines

“system of records” as “a group of records under the control of

any agency from which information is retrieved by the name of the

individual or by some identifying number, symbol, or other

identifying particular assigned to the individual.” § 552a(a)(5)

(emphasis added).

9
 This case fits plainly within the statute. First, the

Executive Summary accused Jacobs of being a front man for the

Hank Group money-laundering and drug-trafficking organization and

opined that Jacobs did not have the financial capability to

purchase the bank shares that he owned. The Executive Summary

thus included “information about” Jacobs. See § 552a(a)(4).

Second, the NDIC has conceded that NDIC analysts on the

White Tiger Project retrieved information from RetrievalWare

using Jacobs’s name as a search term. Moreover, deposition

testimony by White Tiger analysts indicates that information from

RetrievalWare was cut and pasted into the Report: one analyst

testified that he moved information from RetrievalWare to his

home directory or shared drive so that he could incorporate it

into the Report; another analyst testified that he opened two

parallel windows on his computer——one with the search results

from RetrievalWare and the other with his draft section of the

Report——and he incorporated notes and exact quotes from

RetrievalWare records into his draft section of the Report; a

third analyst testified that as a general matter, information

from RetrievalWare could be cut and pasted into a Microsoft Word

document. In addition, a White Tiger analyst also testified that

analysts working on the Report did not conduct any independent

investigations into the activities of the Hank Group. Taken

together, this information raises a genuine issue of material

10
fact as to whether the disclosed information was retrieved from

RetrievalWare using Jacobs’s name as a search term.

Finally, RetrievalWare qualifies as a system of records

under the statute. RetrievalWare is located within Justice/NDIC-

001. In 1993, several years before the beginning of the White

Tiger Project, the NDIC published a notice in the Federal

Register identifying Justice/NDIC-001 as its Privacy Act system

of records.

Under a straightforward application of the statute, then,

Jacobs has raised a genuine issue of material fact as to the

statute’s applicability, which defeats the NDIC’s motion for

summary judgment.

The NDIC argues, however, that the statute only protects

against the disclosure of a physical document that is contained

in a system of records. Thus, it contends, the Privacy Act does

not apply to the disclosure of the Executive Summary in this case

because it was not stored in RetrievalWare. We reject this

argument.

A myriad of cases has held or assumed that the Act protects

against oral disclosures,7 as well as the nonconsensual

7
See Orekoya v. Mooney, 330 F.3d 1 (1st Cir. 2003); Doe v.
U.S. Postal Serv., 317 F.3d 339 (D.C. Cir. 2003); Krieger v.
Fadely, 211 F.3d 134 (D.C. Cir. 2000); Pippinger v. Rubin, 129
F.3d 519 (10th Cir. 1997); Henson v. NASA, 14 F.3d 1143 (6th Cir.
1994); Kimberlin v. U.S. Dep’t of Justice, 788 F.2d 434 (7th Cir.
1986); Bartel v. FAA, 725 F.2d 1403 (D.C. Cir. 1984); Doyle v.
Behan, 670 F.2d 535 (5th Cir. 1982); Stokes v. Comm’r of Soc.

11
dissemination of letters and memoranda containing information

from a system of records.8 For example, in Pippinger v. Rubin,

the Tenth Circuit used the Privacy Act’s legislative history to

support a broad interpretation of the disclosure provision. 129

F.3d 519, 529 (10th Cir. 1997). There, information about

Pippinger from his employer’s record system was orally disclosed

by his former coworkers in deposition testimony. Id. at 523–24.

In interpreting the term “disclose” (which is not defined in the

Privacy Act), the Pippinger court stated,

The court’s broad interpretation of the Privacy Act’s
prohibition against disclosure is clearly consistent with
Congressional intent. As the Joint House and Senate
Report explained, a primary purpose of 5 U.S.C. § 552a(b)
is to[] “require employees to refrain from disclosing
records or personal data in them, within the agency . .
. . This section is designed to prevent the office
gossip, interoffice and interbureau leaks of information

Sec. Admin., 292 F. Supp. 2d 178 (D. Me. 2003); Sullivan v. U.S.
Postal Serv., 944 F. Supp. 191 (W.D. N.Y. 1996); Romero-Vargas v.
Shalala, 907 F. Supp. 1128 (N.D. Ohio 1995); Brooks v. Veterans
Affairs, 773 F. Supp. 1483 (D. Kan. 1991); Savarese v. U.S. Dep’t
of Health, Educ., & Welfare, 479 F. Supp. 304 (N.D. Ga. 1979)
(all involving the oral disclosure of information).
8
Williams v. Dep’t of Veterans Affairs, 104 F.3d 670 (4th
Cir. 1997) (letter); Pilon v. U.S. Dep’t of Justice, 73 F.3d 1111
(D.C. Cir. 1996) (memo); Wilborn v. Dep’t of Health & Human
Servs., 49 F.3d 597 (9th Cir. 1995) (judicial opinion); Tijerina
v. Walters, 821 F.2d 989 (D.C. Cir. 1987) (letter); Bartel v.
FAA, 725 F.2d 1403 (D.C. Cir. 1984) (letter); Boyd v. Sec’y of
the Navy, 709 F.2d 684 (11th Cir. 1983) (memo); Chang v. Dep’t of
the Navy, 314 F. Supp. 2d 35 (D.D.C. 2004) (press release and
“Information Paper”); Swenson v. U.S. Postal Serv., Civ. No. S-
87-1282 MLS, 1994 U.S. Dist. LEXIS 16524 (E.D. Cal. Mar. 10,
1994) (letter); Savarese v. U.S. Dep’t of Health, Educ., &
Welfare, 479 F. Supp. 304 (N.D. Ga. 1979) (letter).

12
 about persons of interest in the agency or in the
community, or such actions as the publicizing of
information of a sensational or salacious nature or of
that detrimental to character reputation.”

Id. at 529 (first emphasis in original) (quoting S. REP. NO. 93-

1183; H.R. REP. NO. 93-1416, at 51 (1974), reprinted in 1974

U.S.C.C.A.N. 6916, 6966).

We agree with the Tenth Circuit’s characterization of the

statute; the Privacy Act’s legislative history supports a broader

interpretation of the Privacy Act than the one advanced by the

NDIC in this case. The disclosure provision is meant to protect

against just the sort of governmental activity that took place

here——the leaking and publicizing of information that is

“detrimental to character reputation.” See id. Both the

statute’s plain text and its legislative history support the

application of the Privacy Act to this case. The caselaw

applying the Act’s disclosure provision confirms our conclusion.

Jacobs principally relies on Bartel v. FAA, 725 F.2d 1403

(D.C. Cir. 1984), the seminal case interpreting the Privacy Act’s

disclosure provision. That case involved both an oral disclosure

and the disclosure of letters, analogous to the Executive Summary

disclosed in this case. Id. at 1406.

In Bartel, the plaintiff, Bartel, worked as an air-safety

inspector for the FAA. Id. at 1405. Contemplating the filing of

an EEOC complaint alleging reverse discrimination, Bartel

13
requested employment information about several other inspectors.

Id. The information he received “consisted of virtually complete

airman files” of three of his coworkers. Id. Despite being

assured that the requested information was available to the

public, some of the information in the files was not public. Id.

Bartel’s acquisition of the files was therefore a potential

Privacy Act violation. Id.

Bartel then filed a discrimination complaint with the FAA’s

EEO office. Id. Shortly thereafter, one of Bartel’s superiors,

Vincent, instituted an investigation into Bartel’s request for

the employment files. Id. Documents collected pursuant to the

investigation were placed in a file called a “Report of

Investigation,” or “ROI.” The investigation closed without any

criminal charges being filed against Bartel. Id. at 1405–06.

Bartel soon left the FAA for civilian employment. Id. at 1406.

The next year, Vincent learned that Bartel was seeking

reemployment with the FAA. Id. Vincent then sent the three

airmen whose files had been requested letters notifying them of

the apparent Privacy Act violation by Bartel. Id. These

letters contained Bartel’s name and place of work and stated that

Bartel had obtained records about them, potentially in violation

of the Privacy Act. Id. Vincent also disclosed Bartel’s alleged

Privacy Act violation over the phone to an investigator for

Flight Resources, Inc., with whom Bartel was interviewing for a

14
job. Id. Bartel was denied several jobs because of Vincent’s

letters and phone calls. See id.

Bartel sued the FAA, alleging that Vincent’s letters and

phone conversations themselves constituted nonconsensual

disclosures in violation of § 552a(b) of the Privacy Act. Id.

The district court dismissed Bartel’s complaint. Id. at 1407.

The D.C. Circuit reversed. Id.

In the course of its analysis, the Bartel court assumed a

broad definition of “record,” stating,

It is of course obvious that the letters were not
themselves agency records. On the other hand, it is not
disputed that the Bartel ROI referred to in the letters
is a record subject to the disclosure provisions of the
Act. Because we find that under the peculiar
circumstances of this case, the letters did in fact
communicate sensitive information contained in the
ROI——specifically, that Bartel’s conduct was the subject
of an official agency investigation, that he acted
improperly, and that he may have violated the Privacy
Act——we conclude that the Act’s disclosure provisions may
have been triggered. Courts have up to now unanimously
agreed that the Act covers more than the mere physical
dissemination of records (or copies) but that it does not
necessarily cover disclosure of information merely
because the information happens to be contained in the
records. The line they draw is that where no statutory
exception applies, the Act prohibits nonconsensual
disclosure of any information that has been retrieved
from a protected record.

Id. at 1408 (emphasis added).

Bartel squarely supports Jacobs’s position. First, the

letters disclosed there are analogous to the Executive Summary

disclosed here. In both cases, the damaging information was

15
taken from a protected record and inserted into a new document,

which was then disclosed without the plaintiff’s consent. Under

the statute, the new document is also a protected record. See 5

U.S.C. § 552a(a)(4).

Second, the narrow definition of record that the NDIC

advances here is inconsistent with the broad definition set forth

in Bartel. The NDIC claims that the Privacy Act was not

triggered here since the Executive Summary, itself, was not

stored in RetrievalWare. This reading of the Act, however,

cannot be reconciled with the caselaw.

Furthermore, the NDIC attempts to distinguish Bartel on the

ground that the letters there were “information paper[s]” created

“for the purpose of disclosing information contained in a system

of records.” According to the NDIC, the Executive Summary should

be treated differently because it is “an analysis of vast amounts

of underlying data created at the request of other agencies.”

The NDIC does not cite any authority to support this proposition,

nor is the distinction persuasive. There is absolutely nothing

in Bartel suggesting that the court’s decision hinged on the

nature of the document disclosed. In fact, courts following

Bartel have done so in contexts where the disclosed document was

not created for the purpose of disclosing information contained

in a system of records.

In Wilborn v. Department of Health and Human Services, for

16
example, the information illegally disclosed was contained in a

judicial opinion. 49 F.3d 597 (9th Cir. 1995), rev’d on other

grounds by Doe v. Chao, 306 F.3d 170 (2004). In that case,

Wilborn had previously been employed as a staff attorney for the

Department of Health and Human Services (“HHS”), where his job

was to write decisions in social-security cases for two

administrative law judges (“ALJs”). Id. at 599. During his

tenure at HHS, one of the ALJs informed Wilborn that “the agency

was dissatisfied with the number of decisions he was writing and

told him he would be placed on a Performance Improvement Plan

(‘PIP’).” Id. Thereafter, the ALJ recorded Wilborn’s job

performance in the PIP, which was placed in Wilborn’s file. Id.

Wilborn filed a grievance over the PIP, and it was

eventually ordered to be expunged from the agency’s records.

Id. Wilborn then left HHS and went into private practice

representing social-security-disability claimants. Id. One of

his cases was handled by the same ALJ who had administered the

PIP. Id. Wilborn wrote a letter to the ALJ attacking his

impartiality. The ALJ responded to Wilborn’s allegations in the

text of an opinion, noting, “What Mr. Wilborn does not state is

that as his supervisor, the undersigned was required to place him

on a Performance Improvement Plan (PIP) because of his failure to

meet even minimal production requirements.” Id.

Wilborn complained that the ALJ had violated the Privacy

17
Act, after which the ALJ issued a substituted opinion without the

objectionable language, but which did not disclose that the PIP

had been rescinded and expunged from the agency’s records. Id.

Wilborn filed suit, alleging that the ALJ’s opinion

impermissibly disclosed information about him in violation of the

Privacy Act. See id. Although the district court granted

summary judgment for the agency, the Ninth Circuit reversed,

relying on Bartel. Id. at 600–01.

Wilborn is important for two reasons. First, as in Bartel,

the information disclosed in Wilborn was equally removed from the

relevant system of records as was the Executive Summary here:

There, the ALJ incorporated information that had once been in

Wilborn’s employment file into a judicial opinion, which was

disclosed without Wilborn’s consent. See id. Here, information

was taken from RetrievalWare and incorporated into the Executive

Summary, which was then disclosed.

Second, Wilborn refutes the NDIC’s argument that Bartel can

be distinguished because the disclosed document in that case was

made for the purpose of “disseminat[ing] information from a

system of records.” Although the letter in Bartel was written

for the purpose of informing the objects of Bartel’s information

request that Bartel had obtained their files in apparent

violation of the Privacy Act, Bartel, 725 F.2d at 1406, the

document disclosed in Wilborn, a judicial opinion, was written

18
for the purpose of adjudicating a social-security-disability

claimant’s request for benefits, Wilborn, 49 F.3d at 599. Thus,

in Wilborn, the damaging information was collateral to the

purpose of the document’s existence, as was the information about

Jacobs in the Executive Summary, the purpose of which was to

summarize the available intelligence on the Hank Group’s drug-

trafficking and money-laundering activities for law-enforcement

agencies. The NDIC’s attempt to distinguish Bartel therefore

fails.

In addition to Bartel and Wilborn, the First, Third, Fourth,

Sixth, Seventh, and Tenth Circuits have all interpreted the

Privacy Act’s record requirement consistent with the reading that

Jacobs advances here.9 District-court cases construing the

9
See Orekoya v. Mooney, 330 F.3d 1, 6 (1st Cir. 2003) (oral
disclosure) (“The Privacy Act prohibits more than dissemination
of records themselves, but also ‘nonconsensual disclosure of any
information that has been retrieved from a protected record.’”
(emphasis added)); Quinn v. Stone, 978 F.2d 126, 133 (3d Cir.
1992) (oral disclosure) (stating that “a record can . . . consist
of a single piece of information”); Williams v. Dep’t of Veterans
Affairs, 104 F.3d 670, 673 (4th Cir. 1997) (letters) (“In
general, courts have been lenient in determining what information
constitutes a ‘record’ within the meaning of the Act.”); id. at
674 (rejecting the agency’s argument that the letter’s status as
a “draft” removed it from the Act’s purview and stating that
“were that the case, agency bureaucrats could too easily
circumvent the purposes of the Act by stamping all records
‘Draft’”); Henson v. NASA, 14 F.3d 1143, 1149 (6th Cir. 1994)
(oral disclosure) (reversing summary judgment for the agency
because an affidavit by an agency employee “establish[ed] that
information contained in a system of records was divulged”);
Kimberlin v. U.S. Dep’t of Justice, 788 F.2d 434, 436 (7th Cir.
1986) (letter) (stating that unless the routine-use exception
applied, the nonconsensual disclosure of a letter containing

19
Privacy Act also uniformly support Jacobs’s position.10 No case

supports the NDIC’s position.

B.

Finally, the NDIC asks us to reject Jacobs’s argument for

policy reasons. It argues that were this court to rule in

Jacobs’s favor, an intolerably heavy burden would be imposed on

the government. Specifically, the NDIC claims that under

Jacobs’s approach, “it is impossible for an agency to predict

with certainty whether a document is subject to the statute”;

and, it argues, the government will have to “analyze each

document’s component parts and determine whether any of those

information derived from the agency’s system of records was
prohibited by the Privacy Act); Pippinger v. Rubin, 129 F.3d 519
(10th Cir. 1997) (oral disclosure) (discussed above).
10
See Buckles v. Indian Health Serv./Belcourt Serv. Unit,
310 F. Supp. 2d 1016, 1068 (D.N.D. 2004) (“A disclosure of a
record may occur by oral communication——it need not be a written
communication.”); Sullivan v. U.S. Postal Serv., 944 F. Supp.
191, 196 (W.D.N.Y. 1996) (recognizing that the disclosure of
information from a record is enough to trigger the protection of
the Privacy Act); Romero-Vargas v. Shalala, 907 F. Supp. 1128,
1132 (N.D. Ohio 1995) (“The Act requires a federal agency to
obtain the written consent of an individual before it discloses
information about an individual to a third party.”); Brooks v.
Veterans Admin., 773 F. Supp. 1483, 1486 (D. Kan. 1991) (“We
believe that whether an unidentified doctor supported or failed
to support an employee’s disability retirement application is an
item of ‘information about an individual’ which is covered by the
Privacy Act.”); Savarese v. U.S. Dep’t of Health Educ. & Welfare,
479 F. Supp. 304, 308 (N.D. Ga. 1979) (“Congress had as its
purpose the control of the unbridled use of highly sophisticated
and centralized information collecting technology. The capacity
of computers and related systems to collect and distribute great
masses of personal information clearly poses a threat that the
Privacy Act seeks to remedy.”).

20
parts were derived from a system of records anywhere throughout

the federal government.” According to the NDIC, each time a

document is found to include “such derivative information,” it

will be required to evaluate whether disclosure of the

information is permitted under any statutory exception to the

disclosure provision. This argument is flawed in several

respects.

First, the Act only prohibits the disclosure of records “in

a system of records.” 5 U.S.C. § 552a(b). And the Act defines

“system of records” narrowly——the records must be both “under the

control of [an] agency,” and the information must be “retrieved

by the name of the individual or by some identifying . . .

particular.” § 552a(a)(5). Courts have strictly enforced this

latter requirement.11

Second, the prohibition against disclosure is not a strict-

11
Bechhoefer v. U.S. Dep’t of Justice, 312 F.3d 563 (2d Cir.
2002) (holding that a letter left in a desk drawer was not in a
system of records); Bettersworth v. FDIC, 248 F.3d 386 (5th 2001)
(file on bank, not plaintiff, was not in a system of records);
Gowan v. U.S. Dep’t of Air Force, 148 F.3d 1182 (10th Cir. 1998)
(record kept in file marked “ethics” not in a system of records);
Henke v. U.S. Dep’t of Commerce, 83 F.3d 1453 (D.C. Cir. 1996)
(retrieval capability not enough, must be actual retrieval);
Manuel v. Veterans Affairs Hosp., 857 F.2d 1112 (6th Cir. 1998)
(no system of records where agency purposefully prevented
information from getting into the system); Boyd v. Sec’y of the
Navy, 709 F.3d 684 (11th Cir. 1983) (record kept in random file
and could be found only by searching through file not in system
of records); Thomas v. U.S. Dep’t of Energy, 719 F.2d 342 (10th
Cir. 1983) (disclosed information was within the personal
knowledge of government employee).

21
liability provision. In order for a plaintiff to recover, he

must show that the disclosure was willful and had an adverse

effect on him. § 552a(g)(1)(D), (g)(4). Many plaintiffs are

denied recovery for lack of evidence of these elements.12

Third, at least some courts have limited the type of

information protected by the Act.13 Finally, the Act, itself,

safeguards against unreasonable liability by providing for twelve

statutory exceptions. See § 552a(b)(1)–(12).

Jacobs is not asking the court for a more expansive reading

of the Privacy Act than other courts have given it. To the

contrary, Jacobs’s case is the kind at which the Privacy Act’s

disclosure provision is aimed.

IV.

For the foregoing reasons, we hold that the district court

erred in granting the NDIC’s motion for summary judgment. The

judgment of the district court is therefore reversed.

12
See Pippinger v. Rubin, 129 F.3d 519, 530 (10th Cir. 1997)
(no evidence of willfulness); id. at 532 (no evidence of adverse
effect); Stephens v. Tenn. Valley Auth., 754 F. Supp. 579, 583
(E.D. Tenn. 1990) (no intent).
13
See Bechhoefer v. U.S. Dep’t of Justice, 209 F.3d 57, 62
(2d Cir. 2000) (holding that a “record” is personal information
about an individual linked through an identifying particular);
Tobey v. NLRB, 40 F.3d 469, 470 (D.C. Cir. 1994) (information is
a “record” when it is “about” an individual); Quinn v. Stone, 978
F.2d 126, 133 (3d Cir. 1992) (information about an individual
linked with an identifying particular). But see Boyd v. Sec’y of
the Navy, 709 F.2d 684, 686 (11th Cir. 1983) (information must
reflect some quality or characteristic about the individual
involved).

22
REVERSED and REMANDED.

23