The Nature of Privacy Harms: Financial and Physical Harm vs. Emotional and Mental Harm
The 9th Circuit is hearing an interesting case involving the Privacy Act — Cooper v. Federal Aviation Administration, No. C 071383 VRW (N.D. Cal. 2008). The Federal Aviation Administration (FAA) shared information about pilot Stanmore Cooper’s HIV positive status with other government agencies. The district court found this information sharing to be improper under the Privacy Act, 5 U.S.C. § 552a:
Because DOT-OIG transmitted Cooper’s records to another agency without his prior consent and this use does not fall within the routine use or another exception to 5 USC § 552a(b), the DOTOIG’s use of Cooper’s record was unlawful under 5 USC § 552a(b).
However, the fact that an agency violates the Privacy Act does not mean that a plaintiff can obtain redress. In a decision I find wrongheaded–both as a matter of statutory interpretation as well as normative policy–the U.S. Supreme Court has held that the Privacy Act requires that a plaintiff prove actual damages before being able to get monetary relief under the Act. See Doe v. Chao, 540 U.S. 614 (2004). The Supreme Court reached this conclusion even though the Privacy Act has a liquidated damages provision:
[T]he United States shall be liable to the individual in an amount equal to the sum of . . . actual damages sustained by the individual as a result of the refusal or failure, but in no case shall a person entitled to recovery receive less than the sum of $1,000.
5 U.S.C. § 552a(g)(4). In order to receive the liquidated damages of $1000, plaintiffs must first demonstrate they are “entitled to recovery” and prove actual damages.
I believe the holding in Chao is misguided because the very function of a liquidated damages provision is to address difficulties in proving harm. Privacy Act violations often involve harms that are not akin to traditional types of injuries. Privacy harms caused by misuse or improper dissemination of information are more abstract in nature and often can’t be directly linked to financial losses or physical injury. Nevertheless, they are harms, and without a way for plaintiffs to recover damages for such harms, there is not a sufficient incentive for plaintiffs to bring Privacy Act lawsuits and for agencies to follow the Privacy Act.
Unfortunately, until Congress amends the Privacy Act to more clearly establish that liquidated damages can be recovered without proof of actual damages, plaintiffs must establish actual damages.
The issue in Cooper is what kind of damages can constitute actual damages. Can emotional/mental damages alone constitute actual damages?
There’s a circuit split on the issue. As the district court noted:
Two circuits that have addressed the definition of actual damages in the context of the Privacy Act examined the statute’s legislative history to reach different conclusions. In Fitzpatrick v. Internal Revenue Service, 665 F.2d 327 (11th Cir. 1982), the Eleventh Circuit focused on the evolution of the Privacy Act’s damages provisions and noted that while early versions of the legislation included provisions for punitive damages and general damages, these damages provisions were not included in the version that became law. Fitzpatrick, 665 F.2d at 329-31. The court found support in the legislative history for a narrow reading of actual damages and held that “‘actual damages’ as used in the Privacy Act permits recovery only for proven pecuniary losses and not for generalized mental injuries, loss of reputation, embarrassment or other non-quantifiable injuries.” Fitzpatrick, 665 F.2d at 331.
In Johnson v. Department of Treasury, IRS, 700 F.2d 971 (5th Cir. 1983), the Fifth Circuit reached the opposite conclusion. The court noted that one of the Privacy Act’s stated purposes is requiring federal agencies to “be subject to civil suit for any damages which occur as a result of willful or intentional” violation.” Johnson, 700 F.2d at 974-75; see 88 Stat. 1896 § 2(b)(6). After a lengthy analysis of the legislative history, see Johnson, 700 F2d at 974-83, the Fifth Circuit concluded that the plaintiff there could recover for proven mental injuries. Johnson, 700 F.2d at 986.
The district court in Cooper sided with Fitzpatrick, reasoning that the Act was ambiguous about what actual damages constituted and such ambiguity should be resolved in favor of the government.
I disagree. If Doe v. Chao is combined with a rule that actual damages must involve physical injury or financial loss, then it becomes extremely difficult for plaintiffs to recover under the Privacy Act. There will be a large group of cases where plaintiffs suffer Privacy Act violations but can’t get damages because privacy harms are often emotional harms. When they wrote their seminal article, The Right to Privacy, inspiring a significant development of privacy law, Samuel Warren and Louis Brandeis recognized that privacy was an “injury to the feelings” and that the law at the time (1890) had evolved sufficiently to redress such harms that did not constitute physical injuries or financial loss.
It would certainly be ironic if the Privacy Act wouldn’t recognize the nature of most privacy harms. Agencies could violate the Privacy Act, improperly sharing and disseminating information, and in a large number of cases, then be able to argue that there’s no harm. Why should Congress have bothered to pass the Privacy Act limiting such practices and providing plaintiffs with a remedy if in many of these cases there would be no cognizable harm and plaintiffs won’t be able to recover any damages? It seems like a wrongheaded interpretation to me.
If we must live with Doe v. Chao, at the very least, to avoid making a total mockery of the Privacy Act, emotional/mental harm must be sufficient to establish actual injury.