American Federation of Government Employees et al v. Hawley et al

MOTION to Dismiss

D.D.C.July 10, 2007

UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLUMBIA AMERICAN FEDERATION OF GOVERNMENT ) EMPLOYEES, et al. ) ) Plaintiffs, ) ) Case No. 1:07CV00855-HHK v. ) ) KIP HAWLEY, et al. ) ) Defendants. ) __________________________________________) DEFENDANTS’ MOTION TO DISMISS INTRODUCTION Within days of learning that an external hard drive containing personnel data was discovered missing from a controlled area of the Transportation Security Administration (“TSA”), four individual transportation security officers and the unions that purportedly represent them (collectively, “Plaintiffs”) brought this action seeking to hold TSA and United States Department of Homeland Security (“DHS”) strictly liable for that loss. Specifically, Plaintiffs contend that TSA, DHS, TSA Administrator Kip Hawley, and DHS Secretary Michael Chertoff (collectively, “Defendants”) violated the Privacy Act and the Aviation and Transportation Security Act (“ATSA”) because they allegedly failed to safeguard against loss of the hard drive, and the loss itself allegedly resulted in the unauthorized disclosure of Plaintiffs’ personal information. The Privacy Act, however, imposes liability on the government for intentional and willful violations of its provisions – not, as here, a clearly unintended incident that TSA is working diligently to rectify. Case 1:07-cv-00855-HHK Document 3 Filed 07/10/2007 Page 1 of 27 2 Although TSA cannot account for the hard drive’s present location, neither Defendants nor Plaintiffs have any evidence of unauthorized uses of the personnel data it contained. TSA, in cooperation with the United States Secret Service, is investigating the incident and has offered potentially affected employees one year of free credit monitoring and identity theft protection insurance. Against this background, Plaintiffs clearly fail to state a claim under the Privacy Act. Without reaching the dubious merits of that claim, however, this Court should dismiss this action for lack of jurisdiction. Plaintiffs’ ATSA claim fails as a matter of law because that Act does not confer a private right of action on Plaintiffs to enforce its provisions. Although the Privacy Act confers such a right on certain individuals, the union Plaintiffs lack standing because the Act expressly provides that only an “individual” may bring an action in federal court. As a waiver of sovereign immunity, the Privacy Act must be construed narrowly and therefore “individual” cannot be interpreted to include unions. The individual Plaintiffs also lack standing because they have alleged no cognizable injury. Instead, they speculate about possible future identify theft and related financial harms. Alternatively, as is clear from the circumstances giving rise to this action, Plaintiffs’ claims are unripe. Plaintiffs have not alleged a sufficient factual basis on which to decide their claims. Instead, Plaintiffs invite this Court to speculate as to the hard drive’s location and its possible future unauthorized use to resolve their claim under the Privacy Act. The Court, however, should refuse that invitation. Accordingly, Defendants’ motion should be granted and this action dismissed. Case 1:07-cv-00855-HHK Document 3 Filed 07/10/2007 Page 2 of 27 3 PRIVACY ACT OF 1974 The Privacy Act of 1974 governs federal agencies’ acquisition, maintenance, and control of information about individuals maintained by an agency in a “system of records” that are retrieved by the name or other identifying information of the individual. 5 U.S.C. §§ 552a(a) & 552(f). The Act limits what information agencies may maintain about individuals, requires that agencies establish appropriate safeguards to ensure the confidentiality of records, and limits agencies’ authority to disclose information about individuals. See 5 U.S.C. §§ 552a(b), (e)(1), (e)(10). Except as otherwise permitted, a federal agency is prohibited by 5 U.S.C. § 552a(b) from disclosing without consent “any record which is contained in a system of records” subject to twelve enumerated exceptions. Agencies are required to publish notices of the existence of their systems of records maintained as well as their authorized uses. See 5 U.S.C. § 552a(e). The Privacy Act expressly grants federal courts jurisdiction to hear claims brought by an individual whenever (1) an agency refuses to amend an individual’s record in accordance with his request, 5 U.S.C § 552a(g)(1)(A); (2) an agency refuses an individual access to a record concerning him, 5 U.S.C. § 552a(g)(1)(B); (3) an agency fails to maintain a record with the requisite accuracy and completeness, 5 U.S.C. § 552a(g)(1)(C); or (4) an agency fails to comply with any other provision of the Act “in such a way as to have an adverse effect on an individual,” 5 U.S.C. § 552a(g)(1)(D). In an action under subparagraphs (C) and (D), supra, the agency is only liable for damages if it “acted in a manner which was intentional and willful,” 5 U.S.C. § 552a(g)(4), and only to the extent of the “actual damages sustained by the individual as a result of the [violation]” and the costs of the action including reasonable attorney’s fees, 5 U.S.C. § 552a(g)(4)(A), (B). An individual entitled to recovery is statutorily guaranteed a minimum of Case 1:07-cv-00855-HHK Document 3 Filed 07/10/2007 Page 3 of 27 The Statement of Facts is based on the allegations in the Complaint and the attached1 Declaration of K. David Holmes (“Holmes Decl,”), which this Court properly may consider in ruling on a motion to dismiss for lack of jurisdiction. See National Community Reinvestment Coalition v. National Credit Union Admin., 290 F. Supp. 2d 124, 131 (D.D.C. 2003) (“In resolving a Rule 12(b)(1) motion for lack of jurisdiction . . . courts are generally free to consider relevant materials outside the pleadings.”). Plaintiffs’ Complaint contains ellipses in place of this sentence and the previous one. 2 In deciding a motion to dismiss, however, this Court may consider any documents incorporated by reference in the Complaint. See EEOC v. St. Francis Xavier Parochial Sch., 117 F.3d 621, 624 (D.C. Cir. 1997) (noting that a court “may consider only the facts alleged in the complaint, any documents either attached to or incorporated in the complaint and matters of which [it] may take judicial notice”). Therefore, a complete and accurate copy of the email sent to TSA employees is included as an attachment to the Holmes Declaration. 4 $1000. 5 U.S.C. § 552a(g)(4)(A). STATEMENT OF FACTS1 On May 3, 2007, TSA discovered that an external hard drive containing personnel data for approximately 100,000 individuals employed by the agency between January 2002 and August 2005 was “missing from a controlled area at the TSA Headquarters Office of Human Capital.” Compl. ¶¶ 28-29. Although TSA had no evidence of any unauthorized use of those data, TSA “out of an abundance of caution” notified all potentially affected current and former employees of the incident so that they could “be alert to signs of any possible misuse of [their] identity.” Compl. ¶ 31. On May 4, 2007, Administrator Kip Hawley issued the following: The Transportation Security Administration (TSA) learned on May 3 that an external hard drive containing personnel data (including name, social security number, date of birth, payroll information, financial allotments, and bank account and routing information) was discovered missing from a controlled area at the Headquarters Office of Human Capital. It is unclear at this stage whether the device is still within Headquarters or was stolen. TSA immediately reported the incident to senior DHS and law enforcement officials and launched an investigation.2 Case 1:07-cv-00855-HHK Document 3 Filed 07/10/2007 Page 4 of 27 5 We are notifying you of this incident because you may be one of the employees whose information was contained on the device. TSA has no evidence that an unauthorized individual is using your personal information, but we bring this incident to your attention so that you can be alert to the signs of any possible misuse of your identity. We are notifying you out of an abundance of caution at this early stage of the investigation given the significance of the information contained on the device. We apologize that your information may be subject to unauthorized access, and I deeply regret this incident. As a result of this, TSA will provide you with identity theft protection and monitoring for one year free of charge, as necessary. Credit monitoring services will include monitoring of all three national credit bureau reports, fraud alerts, detection of fraudulent activity and identity theft, and fraud resolution and assistance. Additional details on this free identity theft monitoring and protection will be provided shortly. The individual Plaintiffs were among the employees who received this communication. See Compl. ¶¶ 7-10. Four days later, Plaintiffs, four individual TSA security officers and their unions, filed the instant action under the Privacy Act. Plaintiffs speculate that their personal information was disclosed when the hard drive was lost. Compl. ¶ 37. None of the Plaintiffs, however, has alleged any unauthorized use of their personal information as a result of the incident. Plaintiffs are concerned about that possibility and allegedly “must take affirmative steps to recover peace of mind.” Compl. ¶¶ 41-43. TSA, however, has offered its employees one year of free credit monitoring from Identity Force and identity theft insurance up to $25,000. See Holmes Decl. ¶ 5. TSA’s investigative division continues to work very closely with its partners at the United States Secret Service to locate the hard drive. At this time, TSA cannot account for the hard drive’s location. Compl. ¶ 30. Case 1:07-cv-00855-HHK Document 3 Filed 07/10/2007 Page 5 of 27 6 ARGUMENT I. THIS COURT SHOULD DISMISS PLAINTIFFS’ ATSA CLAIM BECAUSE CONGRESS DID NOT CREATE A PRIVATE RIGHT OF ACTION UNDER SECTION 114(f). Plaintiffs attempt to create a cause of action under the ATSA where none exists. Specifically, they contend that Defendants violated Section 114(f) by “fail[ing] to maintain personnel data from loss consistent with security-related regulations” and “to ensure the adequacy of security measures at airports resulting in the loss of personnel data.” Compl. ¶¶ 45, 46. Even assuming those allegations are true, the “violation of a federal statute alone is inadequate to support a private cause of action.” Tax Analysts v. Internal Revenue Serv., 214 F.3d 179, 185 (D.C. Cir. 2000). Rather, “private rights of action to enforce federal law must be created by Congress.” Alexander v. Sandoval, 532 U.S. 275, 276 (2001); see also Harper v. Williford, 96 F.3d 1526, 1528 (D.C. Cir. 1996) (noting “the Supreme Court’s unwillingness to presume the existence of a private right of action where none is explicitly articulated by Congress”). In the absence of an express grant of that right, the Court must determine whether the statute contains an implied private right of action. See Anderson v. USAir, Inc., 818 F.2d 49, 54 (D.C. Cir. 1987). The following factors are relevant to that determination: “(1) whether the plaintiff is one of the class for whose benefit the statute was enacted; (2) whether some indication exists of a legislative intent . . . to create or to deny a private remedy; (3) whether implying a private right of action is consistent with the underlying purposes of the legislative scheme; and (4) whether the cause of action is one traditionally relegated to state law, such that it would be inappropriate for the court to infer a cause of action based solely on federal law.” Tax Analysts, 214 F.3d at 185- Case 1:07-cv-00855-HHK Document 3 Filed 07/10/2007 Page 6 of 27 7 86. If neither (1) nor (2) indicates an intent to provide a private remedy, “analysis under the . . . [remaining] factors is unnecessary,” Anderson, 818 F.2d at 55, as without such intent, “a cause of action does not exist and courts may not create one, no matter how desirable that might be as a policy matter, or how compatible with the statute,” Alexander, 532 U.S. at 286-87; see also Dial A Car, Inc. v. Transportation, Inc., 132 F.3d 743, 744 (D.C. Cir. 1998) (concluding that the most important consideration is whether the legislature intended to create a private right of action). Nothing in Section 114(f) reflects either that Congress intended to create a private remedy or that the statute was enacted for Plaintiffs’ particular benefit. Plaintiffs’ ATSA claim therefore should be dismissed. The determination of whether Congress intended Section 114(f) of ATSA to confer a private right of action “must begin with the language of the statute itself.” Touche Ross & Co. v. Redington, 442 U.S. 560, 568 (1979); see also College Sports Council v. Government Accountability Office, 421 F. Supp. 2d 59, 65 (D.D.C. 2006) (same). That provision provides in relevant part that “the Under Secretary shall . . . (7) enforce security-related regulations and requirements; . . . [and] oversee the implementation, and ensure the adequacy, of security measures at airports and other transportation facilities.” 49 U.S.C. § 114(f). Nothing in that language concerns remedies for violations of the provision. Also completely absent is “rights- creating language” typically found in statutes that confer a right of action. See Alexander, 532 U.S. at 288 (characterizing the phrase “[n]o person . . . shall . . . be subjected to discrimination” as “rights-creating” language); see also Touche Ross & Co., 421 F. Supp. 2d at 65. Congress therefore did not intend for Plaintiffs to enforce Section 114(f). See Nabozny v. NCS Pearson, Inc., 270 F. Supp. 2d 1201, 1204 (D. Nev. 2003) (holding that because “[t]he ATSA contains no Case 1:07-cv-00855-HHK Document 3 Filed 07/10/2007 Page 7 of 27 8 language providing Plaintiff with a civil remedy to enforce § 44935(f)(2) . . . Plaintiff cannot, as a matter of law, bring an action against Defendant for violation of § 44935(f)(2)”). Moreover, Section 114(f)’s focus on the Under Secretary’s responsibilities is a further indication that it confers no rights on Plaintiffs. See Springs v. Stone, 362 F. Supp. 2d 686, 705 (E.D. Va. 2005) (“The ATSA was . . . [promulgated] to address[] national security and passenger safety.”). Statutes that “focus on the person regulated rather than the individuals protected create no implication of an intent to confer rights on a particular class of persons.” Alexander, 532 U.S. at 289 (internal quotations omitted); see also Anderson, 818 F.2d at 54 (“phrasing a statute in general terms rather than specifically identifying the benefitted class indicates a lack of intent to create a private right of action”). Although ultimately, Section 114(f) is intended to benefit the traveling public, that is insufficient to confer a right of action on Plaintiffs. See, e.g., AFGE v. Hawley, 481 F. Supp. 2d 72, 95 (D.D.C. 2006) (concluding that plaintiffs had no claim under Section 110(c)(1) of ATSA because that provision “was meant to protect the interests of the traveling public, and not the employment of the screeners”); Springs v. Stone, 362 F. Supp. 2d 686, 705 (E.D. Va. 2005) (concluding that a “mere modicum of common sense reveals that the purpose of § 110(c)(1) was to ensure that a sufficient airport security apparatus was put in place as soon as possible, and not to extend any form of civil relief in the event that the benchmark was not attained”). Since Congress did not indicate an intent to permit an implied right of action under Section 114(f), Plaintiffs’ ATSA claim should be dismissed. Case 1:07-cv-00855-HHK Document 3 Filed 07/10/2007 Page 8 of 27 9 II. THE COURT LACKS JURISDICTION OVER PLAINTIFFS’ PRIVACY ACT CLAIM BECAUSE PLAINTIFFS CANNOT ESTABLISH STANDING. Plaintiffs’ Privacy Act claim should be dismissed for lack of standing. A plaintiff’s standing is a “predicate to any exercise of [this Court’s] jurisdiction.” Florida Audubon Soc’y v. Bentsen, 94 F.3d 658, 663 (D.C. Cir. 1996). “The ‘judicial power’ of the United States . . . is not an unconditioned authority” but is limited by Article III of the Constitution. Valley Forge Christian College v. Americans United for Separation of Church & State, 454 U.S. 464, 471 (1982). That Article “confines the federal courts to adjudicating actual ‘cases’ and ‘controversies.’” Allen v. Wright, 468 U.S. 737, 750 (1984). Standing is “an essential and unchanging part of the case-or-controversy requirement.” Lujan v. Defenders of Wildlife, 504 U.S. 555, 560 (1992). Therefore, as this Court previously has recognized, it must “insist[] on strict compliance with th[e] jurisdictional standing requirement.” Chenoweth v. Clinton, 997 F. Supp. 36, 38 (D.D.C. 1998) (quoting Raines v. Byrd, 521 U.S. 811, 819 (1997)). Such compliance here compels dismissal of Plaintiffs’ Privacy Act claim. A. The Privacy Act Precludes an Action for Its Violation by Other Than an “Individual.” The Privacy Act does not confer standing on the union Plaintiffs. See Committee in Solidarity with People of El Salvador v. Sessions, 738 F. Supp. 544, 547 (D.D.C. 1990) (holding that “the Privacy Act does not confer standing upon organizations on their own or purporting to sue on behalf of their members”). That Act’s civil remedies provision provides, in relevant part, that “[w]henever any agency . . . fails to comply with any [] provision of this section . . . in such a way as to have an adverse effect on an individual, the individual may bring a civil action against the agency, and the district courts of the United States shall have jurisdiction in the matters under Case 1:07-cv-00855-HHK Document 3 Filed 07/10/2007 Page 9 of 27 10 the provisions of this subsection.” 5 U.S.C. § 552a(g)(1)(D) (emphasis added). As an express waiver of sovereign immunity, that language must be strictly construed in favor of the sovereign and “not enlarge[d ] beyond what the language requires.” Cummings v. Department of Navy, 279 F.3d 1051, 1055 (D.C. Cir. 2002); Tomasello v. Rubin, 167 F.3d 612, 618 (D.C. Cir. 1999). So construed, the Privacy Act’s waiver plainly extends only to actions brought by an “individual” as defined under the Act. The Act defines “individual” as “a citizen of the United States or an alien lawfully admitted for permanent residence.” 5 U.S.C. § 552a(a)(2). That definition clearly does not encompass a union acting on its own behalf or on behalf of its members. See Committee in Solidarity, 738 F. Supp. at 547; see also Ridgeley v. Merchants State Bank, 699 F. Supp. 100, 102 (N.D. Tex. 1988) (construing Right to Financial Privacy Act’s protection of “customer” strictly as “protect[ing] individuals in whose name the financial account is held” and not an organization purportedly representative of many individuals (emphasis by court)). Since unions are not expressly included in the definition of “individual,” they are necessarily excluded from the permissible plaintiffs who may bring an action under the Privacy Act. See id. (concluding that non-profit organization was “not a ‘customer’ within the meaning of [] Act” and to hold otherwise “would circumvent the purpose of the Act in protecting the financial records of only individuals and small partnerships”). The union Plaintiffs therefore are not proper plaintiffs in this action and should be dismissed. Case 1:07-cv-00855-HHK Document 3 Filed 07/10/2007 Page 10 of 27 As discussed in the next section, however, the individual Plaintiffs lack standing and3 therefore the union Plaintiffs also fail that element of associational standing. 11 B. The Union Plaintiffs Lack Standing to Bring a Privacy Act Claim Because That Claim Requires the Participation of the Individual Union Members. This Court alternatively should dismiss the union Plaintiffs for failure to satisfy the requirements for associational standing. Those requirements are well established: 1) the association “seeks to protect [interests that] are germane to the organization’s purpose”; 2) the association’s “members would otherwise have standing to sue in their own right”; and 3) “neither the claim asserted nor the relief requested requires the participation of the individual members in the lawsuit.” Hunt v. Washington State Apple Advertising Comm’n, 432 U.S. 333, 343 (1977); United Food & Commercial Workers Union Local 751 v. Brown Group, Inc., 517 U.S. 544, 552- 53 (1996). The failure to satisfy any one of these elements requires dismissal. See American Chem. Council v. Department of Transp., 468 F.3d 810, 815 (D.C. Cir. 2006) (concluding that failure to satisfy one element of associational standing made it unnecessary for court to address other elements). Since the union Plaintiffs’ Privacy Act claim requires the participation of the affected individual members, this Court need not consider the remaining factors.3 1. Individual Questions Are Central to This Court’s Liability Determination. This Court’s liability determination under the Privacy Act is clearly individualized. Plaintiffs must demonstrate that each Plaintiff suffered an adverse effect because Defendants intentionally or willfully failed to establish appropriate safeguards for Plaintiffs’ records and disclosed their records in violation of the Privacy Act. See 5 U.S.C. § 552a(g)(1). Those determinations necessarily require the Court to give individual consideration to each Plaintiff’s Case 1:07-cv-00855-HHK Document 3 Filed 07/10/2007 Page 11 of 27 12 particular situation. See Schmidt v. United States Dep’t of Veterans Affairs, 218 F.R.D. 619, 637 (E.D. Wis. 2003) (concluding that “whether the VA actually disclosed the records of individual . . . [in] violation of Section 552a(b)” and “whether . . . the individual . . . suffered an adverse effect as a result of the VA’s failure to comply with either Section 552a(b) or (e)(10)” were “individual questions of fact”); see also Lyon v. United States, 94 F.R.D. 69, 76 (W.D. Okla. 1982) (noting that “[i]ndividual considerations would have to be given to each [plaintiff] with respect to the requirements of [a Privacy Act violation]”). The union Plaintiffs’ Privacy Act claim therefore requires the participation of their allegedly affected members. 2. Individual Questions Are Central to This Court’s Damages Determination. Plaintiffs’ requested damages also necessitate that participation. See Compl. at 14 (requesting “judgment against Defendants for all actual damages incurred as a result of the Defendants’ Privacy Act violations” and “judgment against Defendants in an amount of at-least $1,000.00 for each individual who was adversely affected by Defendants’ Privacy Act violations”). The Privacy Act provides that, for an intentional or willful violation of the Act, the “United States shall be liable to the individual in an amount equal to the sum of – (A) actual damages sustained by the individual as a result of the refusal or failure, but in no case shall a person entitled to recovery receive less than the sum of $1000; and (B) the costs of the action together with reasonable attorney fees as determined by the court.” 5 U.S.C. § 552a(g)(4). Recovery of the statutory minimum $1000, however, is not automatic. Doe v. Chao, 540 U.S. 614, 620 (2004). Rather, “the minimum guarantee goes only to victims who prove some actual damages,” id., a showing that requires individual participation by the union Plaintiffs’ members. Case 1:07-cv-00855-HHK Document 3 Filed 07/10/2007 Page 12 of 27 For similar reasons, this action could not be maintained as a class action. See Compl.4 ¶¶ 15-23 (class allegations). The “questions affecting only individual members greatly outweigh questions of law and fact common to the class.” Lyon, 94 F.R.D. at 76; see also Schmidt, 218 F.R.D. at 637-38 (refusing to certify class in Privacy Act action because the “questions of fact . . . could not be resolved without conducting numerous mini-trials”). 13 See Lyon, 94 F.R.D. at 76 (noting the “individualized nature of the proof” in “Privacy Act damages actions”); Schmidt, 218 F.R.D. at 637 (same). Since the union Plaintiffs cannot maintain their Privacy Act claim without their members’ participation, the unions cannot satisfy the requirements for associational standing and, accordingly, on that independent ground, should be dismissed. See AFGE v. Stone, 2005 WL 1620402, at *7 (S.D. Ohio, July 6, 2005)4 (dismissing AFGE on standing grounds in case “where the nature of the claim and of the relief sought . . . make[s] the individual participation of each injured party indispensable”). C. The Individual Plaintiffs Lack Standing Because Their Allegations of Harm Are Speculative. The individual Plaintiffs also should be dismissed for lack of standing. The requirements of standing are well established. See Lujan, 504 U.S. at 560-61. “[A plaintiff] must show injury in fact that was caused by the conduct of the defendants and that can be redressed by judicial relief.” Public Citizen, Inc. v. National Highway Traffic Safety Admin. __ F.3d __, 2007 WL 1713334, at *7 (D.C. Cir., June 15, 2007). The absence of any one of these elements is sufficient to dismiss a claim on standing grounds. See US Ecology v. United States Dep’t of Interior, 231 F.3d 20, 24 (D.C. Cir. 2000) (“a deficiency on any one of the three [elements] suffices to defeat standing”). Indeed, “[u]ntil a judicially cognizable injury is shown no other inquiry is relevant to consideration of [] standing.” Schlesinger v. Reservists Comm. to Stop War, 418 U.S. 208, 227 n.16 (1974). Dismissal is required here because Plaintiffs have not alleged a cognizable injury. Case 1:07-cv-00855-HHK Document 3 Filed 07/10/2007 Page 13 of 27 Although the standard for judging claims of future injury is “somewhat unclear” in this5 Circuit – ranging from “fairly probable” to “certainly impending” – Plaintiffs’ claims satisfy none of the standards. See Does I Through III v. District of Columbia, 216 F.R.D. 5, 10 n.8 (D.D.C. 2003). 14 1. Plaintiffs’ Speculation About Possible Future Injuries Are Insufficient to Confer Standing. Plaintiffs’ concerns about future harm are too speculative to state a justiciable injury and therefore to confer standing. See Compl. ¶¶ 41-43. “Allegations of possible future injury do not satisfy the requirements of Article III.” Whitmore v. Arkansas, 495 U.S. 149, 158 (1990). Rather, the alleged injury “must be certainly impending,” id. (internal quotation marks and citations omitted), and “real and immediate,” City of Los Angeles v. Lyons, 461 U.S. 95, 102 (1983). Plaintiffs’ alleged future injury is neither. As Plaintiffs concede, the present location of5 the external hard drive is unknown. See Compl. ¶ 30. Neither Plaintiffs nor TSA have any evidence that “an unauthorized individual is using [their] personal information.” Compl. ¶ 31; see also Holmes Decl. ¶¶ 8-9 (explaining that TSA has not linked any reported identity thefts to the missing hard drive and “has no evidence of any misuse of the data on the hard drive”). Indeed, “[i]t is unclear at this stage whether the device is still within Headquarters or was stolen.” Holmes Decl. Att. 1. Plaintiffs’ fears of “damage to credit report,” “damage to financial suitability requirements in employment,” and “possibility of security breach at airports” thus depend on the hard drive coming into the possession of someone who recognizes it as a storage medium, who knows how to access their personal information and has the equipment to do so, and who has the criminal intent to steal Plaintiffs’ identity. Such a tenuous chain of events hardly demonstrates that Plaintiffs’ alleged future harm is certain and likely to occur. Case 1:07-cv-00855-HHK Document 3 Filed 07/10/2007 Page 14 of 27 15 2. Plaintiffs Cannot Establish Standing Based on Allegations of Harm by Third Parties. Plaintiffs’ allegations of injury are also not cognizable because they are dependent upon the criminal actions of third parties. Specifically, Plaintiffs allege that “[t]errorists and terrorist groups with access to the names, social security numbers, birthdates, and banking information of transportation security screeners can disrupt proper and vital airport screening by creating false identity badges to gain access to secure areas; steal the identity of transportation security screeners thereby gaining access to secure areas or TSA network systems; and disrupt the financial lives of transportation security screeners thus causing them to miss work to correct the problem or be distracted at work.” Compl. ¶ 34. Numerous courts, however, have held such “speculative claims dependent upon the actions of third parties” insufficient to establish standing. See Simon v. Eastern Kentucky Welfare Rights Organization, 426 U.S. 26, 41-42 (1976) (noting that Article III “requires that a federal court act only to redress injury that fairly can be traced to the challenged action of the defendant, and not injury that results from the independent action of some third party not before the court”); Gettman v. Drug Enforcement Admin., 290 F.3d 430, 435 (D.C. Cir. 2002) (noting that in “numerous” cases, “courts have reiterated that [] speculative claims dependent upon the actions of third parties do not create standing for the purposes of establishing a case or controversy under Article III”); Natural Resources Defense Council, Inc. v. Securities Exch. Comm’n, 606 F.2d 1031, 1043 n.11 (D.C. Cir. 1979) (“The existence of an independent third party in the causal chain has been a factor in some decisions denying standing on the ground that the injury alleged was too speculative”). The individual Plaintiffs, therefore, also should be dismissed for lack of standing. Case 1:07-cv-00855-HHK Document 3 Filed 07/10/2007 Page 15 of 27 16 III. THIS COURT LACKS JURISDICTION OVER PLAINTIFFS’ PRIVACY ACT CLAIM BECAUSE THAT CLAIM IS UNRIPE. This Court alternatively should dismiss this action because it is not ripe. The ripeness doctrine “shares the constitutional requirement of standing that an injury in fact be certainly impending,” which, as discussed earlier, is not present here. National Treas. Employees Union v. United States, 101 F.3d 1423, 1427 (D.C. Cir. 1996). Prudentially, however, the ripeness doctrine “prevent[s] the courts, through avoidance of premature adjudication, from entangling themselves in abstract disagreements.” Worth v. Jackson, 451 F.3d 854, 861 (D.C. Cir. 2006). By refusing to hear such disagreements, federal courts “enhance judicial economy, and ensure that a record adequate to support an informed decision exists when the case is heard.” Navegar, Inc. v. United States, 103 F.3d 994, 998 (D.C. Cir. 1997). Whether an issue “has sufficiently matured to be amenable to adjudication” requires an evaluation of “both the fitness of the issues for judicial decision and the hardship to the parties of refusing a decision.” Flynt v. Rumsfeld, 355 F.3d 697, 702 (D.C. Cir. 2004); see also National Treasury Employees, 101 F.3d at 1427 (same). Courts have repeatedly held that a claim is not ripe for adjudication if, as here,“it rests upon contingent future events that may not occur as anticipated, or indeed may not occur at all.” Texas v. United States, 523 U.S. 296, 300 (1998); see also Worth, 451 F.3d at 861. That conclusion is evident from the circumstance giving rise to this lawsuit, (see Compl. ¶¶ 28-31, 37-38, 41-43), a “data security incident” in which “an external hard drive containing personnel data . . . was discovered missing from a controlled area at the TSA Headquarters Office of Human Capital,” (Compl. ¶ 29). Neither Plaintiffs nor Defendants can “account for the present location of the external hard drive.” Compl. ¶ 30. “TSA has no evidence that an Case 1:07-cv-00855-HHK Document 3 Filed 07/10/2007 Page 16 of 27 17 unauthorized individual is using [Plaintiffs’] personal information,” (Compl. ¶ 31), and neither do Plaintiffs. None of the allegations in their Complaint would even permit the inference of an unauthorized use of their personal information. See Compl. ¶¶ 41-43. Instead, this Court must speculate along with Plaintiffs that their personal information has been disclosed and that the disclosure could result in airport security breaches or identity theft. The ripeness doctrine, however, was designed to prevent precisely such an action from proceeding. See Virginia v. Reno, 117 F. Supp. 2d 46, 51 (D.D.C. 2000) (explaining that ripeness promotes courts’ interest “in deciding issues in a concrete setting”); see also Navegar, Inc., 103 F.3d at 998 (noting that ripeness requirement ensures that the record before the court is “adequate to support an informed decision”). Plaintiffs, moreover, would not suffer any hardship from this Court’s refusal to consider their claim. The hardship inquiry “overlaps with the injury in fact facet of [the] standing doctrine.” Id. (internal quotations omitted). As already discussed, Plaintiffs have not alleged any injuries as a result of Defendants’ actions that are real and immediate. Instead, Plaintiffs have alleged “concern” for possible future injuries that may never occur. At this time, there is no evidence that the missing hard drive was stolen. See Holmes Decl. ¶¶ 8-9 & Att. 1. Even if the device has been stolen, Defendants have offered employees one year free credit monitoring from Identity Force and identity theft insurance up to $25,000. See Holmes Dec. ¶ 5. In addition, TSA’s investigative division continues to work with the U.S. Secret Service to find the hard drive. See Holmes Decl. ¶ 6. Thus, Plaintiffs will not suffer any present detriment from this Court’s refusal to hear their Privacy Act claim. See Simmonds v. Immigration & Naturalization Serv., 326 F.3d 351, 360 (2d Cir. 2003) (“The mere possibility of future injury, unless it is the Case 1:07-cv-00855-HHK Document 3 Filed 07/10/2007 Page 17 of 27 18 cause of some present detriment, does not constitute hardship.”); see also Arizona Pub. Serv. Co. v. Environmental Protection Agency, 211 F.3d 1280, 1297 (D.C. Cir. 2000) (“mere delay, absent other extenuating circumstances, in adjudication of a dispute cannot satisfy the hardship prong”). Plaintiffs’ Privacy Act claim therefore should be dismissed as unripe. IV. THIS COURT SHOULD DISMISS PLAINTIFFS’ PRIVACY ACT CLAIM FOR FAILURE TO STATE A CLAIM. Even if this Court determines that it has jurisdiction over Plaintiffs’ Privacy Act claim, dismissal nevertheless is warranted for failure to state a claim. See Fed. R. Civ. P. 12(b)(6). Dismissal under Rule 12(b)(6) of the Federal Rules of Civil Procedure is warranted where the complaint allegations are insufficient to state or infer a necessary element of a claim. See Wells v. United States, 851 F.2d 1471, 1473 (D.C. Cir. 1988) (“Assuming all factual allegations are true, a court must dismiss a complaint if the plaintiff fails to establish a right to relief based on the facts alleged in the complaint.”). Plaintiffs’ allegations are deficient in that respect as to three elements of their Privacy Act claim – the intentional and willful element, the adverse effect element, and the actual damages element. See White v. Office of Personnel Mgmt., 840 F.2d 85, 87 (D.C. Cir. 1988) (“dismissal of a damages claim under the Privacy Act is proper where the complaint fails to allege each of the elements of such a claim”). That claim accordingly should be dismissed. Case 1:07-cv-00855-HHK Document 3 Filed 07/10/2007 Page 18 of 27 19 A. Plaintiffs Have Failed to Allege Facts From Which This Court Could Infer Intentional or Willful Conduct. None of the allegations in Plaintiffs’ Complaint permit the Court to infer that Defendants’ alleged violations of the Privacy Act were intentional or willful. See Pilon v. United States Dep’t of Justice, 796 F. Supp. 7, 12 (1992) (“a valid claim is stated when it is properly pleaded that the agency has acted in a manner which was intentional or willful”). “An agency is liable for damages under the Privacy Act only if the court determines that the agency acted in a manner which was intentional or willful.” Clark v. Bureau of Prisons, 407 F. Supp. 2d 127, 130 (D.D.C. 2005) (emphasis added); 5 U.S.C. § 552a(g)(4). The Act does not “make the Government strictly liable for every affirmative or negligent action that might be said technically to violate the Privacy Act’s provisions.” Laningham v. United States, 813 F.2d 1236, 1242 (D.C. Cir. 1987); see also Albright v. United States, 732 F.2d 181, 189 (D.C. Cir. 1984) (same). Nor is “the mere fact that the government’s action in releasing the documents could not be characterized as ‘inadvertent’” sufficient. Laningham, 813 F.2d at 1242. Rather, the “high” standard that Plaintiffs must meet here is satisfied only by government conduct “so patently egregious and unlawful that anyone undertaking the conduct should have known it unlawful.” Id.; see also Clark, 407 F. Supp. 2d at 130 (defining intentional and willful as “act[ing] with something greater than gross negligence . . . without grounds for believing it to be lawful . . . or by flagrantly disregarding others’ rights under the Act”); Broaddrick v. Executive Office of President, 139 F. Supp. 2d 55, 63 (D.D.C. 2001) (same). Case 1:07-cv-00855-HHK Document 3 Filed 07/10/2007 Page 19 of 27 20 Thus, to withstand dismissal for failure to state a claim, Plaintiffs must “present[] some factual basis to support [their] allegation of willful or intentional conduct on the part of the agency.” Flowers v. Executive Office of President, 142 F. Supp. 2d 38, 47 (D.D.C. 2001); White, 840 F.2d at 87; see also Foncello v. United States Dep’t of Army, 2005 WL 2994011, at *4 (D. Conn., Nov. 7, 2005) (concluding that dismissal was warranted “because nothing in the complaint permits the inference that the alleged Privacy Act violations were intentional or willful”). Plaintiffs clearly have not done that. To the contrary, their allegations belie an inference that Defendants’ intentionally or willfully violated the Privacy Act. Plaintiffs’ Privacy Act claim is predicated on TSA’s discovery that an external hard drive was missing from a controlled area at TSA Headquarters – a circumstance that alone precludes such an inference. TSA’s notification to affected employees explained: It is unclear at this stage whether the device is still within Headquarters or was stolen. . . . We are notifying you out of an abundance of caution . . . TSA has no evidence that an unauthorized individual is using your personal information . . . We apologize that your information may be subject to unauthorized access and [] deeply regret this incident. Holmes Decl. Att. 1; Compl. ¶ 31. Thus, notwithstanding Plaintiffs’ conclusory allegation to the contrary, these facts clearly provide no basis for an inference of an intentional or willful violation of the Privacy Act. See Compl. ¶ 50 (“The Defendants’ violation was intentional or willful.”) In an apparent effort to bolster their allegation of intentional and willful conduct, Plaintiffs allege that “Defendants have been repeatedly informed of recurring, systemic, and fundamental deficiencies in its information security. See Office of Inspector General (OIG), Department of Homeland Security (DHS) report Improved Security Required for Transportation Security Administration Networks, OIG-05-31 (August 2005).” Compl. ¶ 35. That report, Case 1:07-cv-00855-HHK Document 3 Filed 07/10/2007 Page 20 of 27 21 however, does not support that allegation and thus this Court should not accept that allegation as true. See Kaempe v. Myers, 367 F.3d 958, 963 (D.C. Cir. 2004) (explaining that a court need not “accept as true the complaint’s factual allegations insofar as they contradict exhibits to the complaint or matters subject to judicial notice”). Indeed, although noting that “TSA can make further improvements to secure its networks,” the OIG Report concludes that “TSA has strengthened the security configurations on its servers and workstations” and “[a]s a result, we have detected significantly fewer security vulnerabilities.” Office of Inspector General (OIG), Department of Homeland Security (DHS), Improved Security Required for Transportation Security Administration Networks, OIG-05-31, at 1 (Aug. 2005) (emphasis added). Thus, there are no credible allegations in the Complaint that provide the requisite factual basis for an intentional and wilful inference. Accordingly, the Court should dismiss Plaintiffs’ Privacy Act claim for failure to state a claim. B. Plaintiffs Have Failed to Allege Facts From Which This Court Could Infer That They Have Been Adversely Affected. Plaintiffs’ allegations of adverse effects are similarly insufficient to withstand dismissal. See 5 U.S.C. § 552a(g)(1)(D) (authorizing claims by an individual whenever an agency fails to comply with a provision of the Privacy Act “in such a way as to have an adverse effect on [the] individual”). Even at the pleadings stage, Plaintiffs “cannot rely solely on conclusory allegations of injury.” Baur v. Veneman, 352 F.3d 625, 637 (2d Cir. 2003); see also Flowers, 142 F. Supp. 2d at 46 (“conclusory allegations unsupported by any factual assertions will not withstand a motion to dismiss”); id. (“even under the liberal pleading standards ‘sweeping and unwarranted averments of fact’ without any underlying factual basis will not be deemed admitted for purposes Case 1:07-cv-00855-HHK Document 3 Filed 07/10/2007 Page 21 of 27 22 of a motion to dismiss”). Such sweeping averments are at issue here. Although the individual Plaintiffs are clearly in a position to specify any adverse effects they allegedly have suffered, Plaintiffs rely instead on conclusory allegations of mental distress, concern, and embarrassment. See Compl. ¶ 43 (alleging that “the individually named Plaintiffs and the membership of the union Plaintiffs have and will continue to suffer tangible and intangible damages for the foreseeable future”); see also Compl. ¶¶ 41-42 . Indeed, certain of their allegations borrow directly from the text of the Privacy Act. Compare Compl. ¶ 41 (alleging that Plaintiffs have experienced adverse effects “including but not limited to embarrassment, inconvenience”) with 5 U.S.C. § 552a(e)(10) (requiring agency to establish appropriate safeguards to protect against threats to security that “could result in substantial harm, embarrassment, inconvenience, or unfairness”). Completely absent from their Complaint is the factual basis that would allow an inference that Plaintiffs have been adversely affected by Defendants’ alleged conduct. Plaintiffs have not described a single occasion on which they were embarrassed and inconvenienced or identified the nature and occasion of any affirmative step taken to recover peace of mind. See Compl. ¶¶ 41, 43. Since their conclusory allegations are not otherwise factually supported, Plaintiffs’ Privacy Act claim should be dismissed for failure to state a claim. Case 1:07-cv-00855-HHK Document 3 Filed 07/10/2007 Page 22 of 27 Although Plaintiffs purport to seek injunctive relief for Defendants’ alleged Privacy Act6 violations, that type of relief is not available for violations based on an unauthorized disclosure (Compl. ¶ 49) or failure to establish appropriate safeguards (Compl. ¶ 48). “The Act’s subsection on civil remedies authorizes entry of injunctive relief in only two specific situations” – neither applicable here – and “[i]n so doing . . . the Act precludes other forms of declaratory and injunctive relief . . . .” Doe v. Stephens, 851 F.2d 1457, 1463 (D.C. Cir. 1988); see also Haase v. Sessions, 893 F.2d 370, 374 (D.C. Cir. 1990). There is a split in authority in this District (and across circuits) over whether a plaintiff7 can recover under the Privacy Act for emotional damages. See, e.g., Montemayor v. Federal Bureau of Prisons, 2005 WL 3274508, at *5 (D.D.C., Aug. 25, 2005) (holding non-pecuniary injuries are appropriate basis for damages); Boyd v. Snow, 335 F. Supp. 2d 28, 39 (D.D.C. 2004) (same). For the reasons discussed in the text, however, the denial of recovery for such damages is proper here. 23 C. Plaintiffs Have Failed to Allege Facts From Which This Court Could Infer That They Have Sustained Actual Damages. Plaintiffs additionally have not stated a claim under the Privacy Act because they have not sufficiently plead actual damages. The Privacy Act entitles a recovery “only to plaintiffs6 who have suffered some actual damages.” Doe v. Chao, 540 U.S. at 627. Courts that have7 interpreted “actual damages” narrowly, as required in construing a waiver of sovereign immunity, have held that the term does not include emotional damages. See, e.g., Hudson v. Reno, 130 F.3d 1193, 1207 n.11 (6th Cir. 1997) (explaining that because “actual damages” “has no plain meaning or consistent legal interpretation, [] when it is being applied against the government it must be narrowly interpreted – here that requires finding that actual damages only mean out-of- pocket losses, not emotional distress”); Schmidt v. United States Dep’t of Veterans Affairs, 222 F.R.D. 592, 594 (E.D. Wis. 2004) (recognizing the Privacy Act as a limited waiver of sovereign immunity and therefore concluding that “to the extent there may be ambiguity concerning whether the term ‘actual damages’ includes emotional distress as well as a pecuniary loss, the ambiguity must be resolved by construing the term narrowly”); Wiley v. Department of Veterans Case 1:07-cv-00855-HHK Document 3 Filed 07/10/2007 Page 23 of 27 24 Affairs, 176 F. Supp. 2d 747, 757-58 (E.D. Mich. 2001) (adopting narrow construction of “actual damages”); DiMura v. Federal Bureau of Investigation, 823 F. Supp. 45, 48 (D. Mass. 1993) (same). Other courts have concluded that the Privacy Act does not permit recovery for emotional damages based on its legislative history. See Pope v. Bond, 641 F. Supp. 489, 501 (D.D.C. 1986); Houston v. United States Dep’t of Treas., 494 F. Supp. 24, 30 (D.D.C. 1979). That history reflects Congress’s concern about the drain on the treasury from a rash of Privacy Act suits and rejection of provisions allowing “actual and general” damages – each a clear indication that “actual damages” is limited to “out-of-pocket” expenses. See Pope, 641 F. Supp. at 501 (concluding that Congress’s concern about drain on treasury indicates its intent to limit “actual damages” to “out-of-pocket” expenses); Houston, 494 F. Supp. at 30 (noting that limited definition of “actual damages” is further supported by “the fact that Congress removed early provisions [from the Act] allowing ‘actual and general’ damages”). Although these authorities further support dismissal here, that result is compelled by application of principles of sovereign immunity. Even the most favorable reading of Plaintiffs’ Complaint makes plain that they are not seeking recovery for any alleged out-of-pocket expenses. Instead, Plaintiffs seek damages for various emotional conditions such as “embarrassment, inconvenience, mental distress, concern for identity theft, concern for damage to credit report, concern for damage to financial suitability requirements in employment, and future substantial financial harm.” Compl. ¶ 41. Such allegations do not support an inference of “actual damages” as defined by the authorities properly construing that term narrowly. Since “actual damages” are necessary for any recovery here, Case 1:07-cv-00855-HHK Document 3 Filed 07/10/2007 Page 24 of 27 25 Plaintiffs have failed to state a claim under the Privacy Act. CONCLUSION For the foregoing reasons, Defendants respectfully request that the Court grant their motion and dismiss this action. Dated: July 10, 2007 Respectfully submitted, PETER D. KEISLER Assistant Attorney General, Civil Division JEFFREY A. TAYLOR United States Attorney JOHN R. TYLER Senior Trial Counsel Federal Programs Branch OF COUNSEL: s/ Jacqueline Coleman Snead AMY ALLEN RUGGERI JACQUELINE COLEMAN SNEAD Assistant Chief Counsel for Litigation (D.C. Bar No. 459548) Trial Attorney JANESSA GRADY FLEMING United States Department of Justice Senior Counsel Civil Division, Federal Programs Branch 20 Massachusetts Avenue, N.W., Rm 7214 TRANSPORTATION SECURITY Washington, DC 20530 ADMINISTRATION Tel: (202) 514-3418 Fax: (202) 616-8470 jacqueline.snead@usdoj.gov Counsel for Defendants Case 1:07-cv-00855-HHK Document 3 Filed 07/10/2007 Page 25 of 27 UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLUMBIA AMERICAN FEDERATION OF GOVERNMENT ) EMPLOYEES, et al. ) ) Plaintiffs ) ) v. ) Case No. 1:07CV00855-HHK ) KIP HAWLEY, et al. ) ) Defendants. ) ) ) PROPOSED ORDER Upon consideration of Defendants’ Motion to Dismiss, the opposition thereto, and the complete record in this action, it is hereby ORDERED that Defendant’s motion is GRANTED. This action is dismissed. SO ORDERED. HENRY H. KENNEDY United States District Judge Case 1:07-cv-00855-HHK Document 3 Filed 07/10/2007 Page 26 of 27 CERTIFICATE OF SERVICE I hereby certify that on July 10, 2007, a true and correct copy of the foregoing Motion to Dismiss was electronically filed through the U.S. District Court for the District of Columbia Electronic Document Filing System (ECF) and that the document is available for viewing on that system. s/ Jacqueline Coleman Snead JACQUELINE COLEMAN SNEAD Case 1:07-cv-00855-HHK Document 3 Filed 07/10/2007 Page 27 of 27 Case 1:07-cv-00855-HHK Document 3-2 Filed 07/10/2007 Page 1 of 6 Case 1:07-cv-00855-HHK Document 3-2 Filed 07/10/2007 Page 2 of 6 Case 1:07-cv-00855-HHK Document 3-2 Filed 07/10/2007 Page 3 of 6 Case 1:07-cv-00855-HHK Document 3-2 Filed 07/10/2007 Page 4 of 6 Case 1:07-cv-00855-HHK Document 3-2 Filed 07/10/2007 Page 5 of 6 Case 1:07-cv-00855-HHK Document 3-2 Filed 07/10/2007 Page 6 of 6