Skip to main content
Blog Post

FOIA Update: FOIA Counselor: Discovery, the Privacy Act and FOIA

FOIA Update
Vol. III, No. 2

FOIA Counselor

Discovery, the Privacy Act and FOIA

In the last issue of FOIA Update, it was emphasized in this column that under existing law parties to litigation can freely use the Freedom of Information Act to duplicate, or even supplement, their discovery rights. We now turn to a related area that has recently been the subject of many questions from agency personnel: the production in discovery of information that is subject to protection under the Privacy Act of 1974, 5 U.S.C. § 552a. As will be seen, the correct resolution of such discovery requests requires that careful determinations be made under both the Privacy Act and the Freedom of Information Act.

It is not uncommon for agencies in litigation to receive discovery requests for information that is subject to the Privacy Act's disclosure prohibition, 5 U.S.C. § 552a(b). Such discovery can take the form of requests for the direct production of documents under Fed.R.Civ.P. 34, interrogatories seeking the disclosure of information contained in agency records under Fed.R.Civ.P. 33, requests for admissions seeking such information under Fed.R.Civ.P. 36, or even questions posed during the course of depositions. In any form, the disclosure of information contained in any agency "record" within a "system of records" that is "retrieved by reference to an individual name or some other personal identifier" is subject to regulation under the Privacy Act. 5 U.S.C. § 552a(a); Office of Management and Budget Privacy Act Implementation Guidelines and Responsibilities, 40 Fed. Reg. 28948, 28952 (July 9, 1975).

For example, an agency being sued by one of its employees for alleged discrimination will likely receive discovery requests for records (or derivative information) pertaining to the plaintiff's co-workers. Such records would doubtless be maintained in agency personnel files and would thus be subject to the Privacy Act. Subsection (b) of the Privacy Act prohibits disclosure of records subject to it, except under specified circumstances. See 5 U.S.C. § 552a(b)(l)-(11). Violation of this prohibition can subject an agency to civil penalties under subsection (g) of the Act, 5 U.S.C. § 552a(g), and can also subject individual agency employees to criminal penalties under subsection (i), 5 U.S.C. § 552a(i). Discovery thus prohibited by the Privacy Act is properly objected to on the ground of privilege under Fed.R.Civ.P. 26(b)(1). Cf. Baldrige v. Shapiro, 50 U.S.L.W. 4227, 4231 (U.S., Feb. 24, 1982).

Therefore, it is vitally important for an agency in receipt of a discovery request to determine whether the request seeks the disclosure of Privacy Act-protected information and, if so, whether disclosure is permitted by one of the 11 exceptions to subsection (b). These exceptions are for the most part highly specialized and are best examined on a case-by-ease basis.(*) One of the exceptions, however, warrants special attention because it permits disclosure of Privacy Act-protected information to the extent that such disclosure "is required under [the Freedom of Information Act]." 5 U.S.C. § 552a(b)(2).

Assuming that a discovery request for Privacy Act-protected information does not fall within one of the other ten exceptions to subsection (b), an agency is prohibited from complying with the request (and therefore may object to the discovery on the ground of privilege) only to the extent that the information at issue is not required to be disclosed under the FOIA. To determine this, the agency must act as if it had received a FOIA request for the information and determine whether it is exempt from disclosure under the FOIA.

Any information determined not to be exempt from disclosure would be "required" to be disclosed under the FOIA, would thus fall within subsection (b)(2) of the Privacy Act, would therefore not be prohibited from disclosure by the Privacy Act, and would not be privileged information subject to a valid discovery objection on that basis. On the other hand, any information determined to be exempt from disclosure would not be "required" to be disclosed under the FOIA, would therefore be prohibited from disclosure by the Privacy Act (if none of the other ten disclosure exceptions were applicable), and would be privileged.

A useful illustration of this analysis is set forth by the U.S. Court of Appeals for the Tenth Circuit in Weahkee v. Norton, 621 F.2d 1080 (10th Cir. 1980), where an agency was deemed to have raised a privilege objection to discovery insofar as the discovery inquired into matters exempt under the FOIA. Significantly, Weahkee also stands for the proposition that a district court cannot sustain such a discovery objection without first determining de novo--as would be determined in a FOIA lawsuit--that the information at issue is properly exempt under the FOIA and thus is not "required" to be disclosed within the meaning of this exception to the Privacy Act's disclosure prohibition. See 621 F.2d at 1082.

In sum, agencies in receipt of discovery requests will often be forced by the Privacy Act to assess the requested information according to FOIA standards to determine whether it is privileged, and they should be prepared to support their privilege claims as they would FOIA claims (e.g., with Vaughn affidavits or in camera submissions) if they want them to be sustained. (**)Only with careful attention to the applicability of the Privacy Act in discovery situations--and to the special interplay between the Privacy Act and the FOIA through Privacy Act subsection (b)(2)--can agencies ensure that they are properly responding to discovery requests.


* Questions concerning the construction and applicability of these Privacy Act provisions should be directed to the General Counsel's Office of the Office of Management and Budget, which is the "lead agency" for the Privacy Act.

** Where an agency has no true objection to responding to a discovery request, other than its interest in not violating the Privacy Act, it is often possible to have the matter resolved through the issuance of a court order (often a stipulated protective order) so that the disclosure is undertaken "pursuant to the order of a court of competent jurisdiction" in satisfaction of subsection (b)(11) of the Privacy Act. See, e.g., Clymer v. Grzegorek, 515 F. Supp. 938, 942 (E.D. Va. 1981), citing 5 U.S.C. § 552a(b)(11). In this connection, it should be noted that two courts have refused to regard a subpoena duces tecum as such an order. See Bruce v. United States, 621 F.2d 914, 916 (8th Cir. 1980); Stiles v. Atlanta Gas Light Co., 453 F- Supp. 798, 800 (N.D. Ga. 1978).

Go to: FOIA Update Home Page

Updated August 13, 2014