Brief

Doe v. Chao - Brief (Merits)

Docket Number

No. 02-1377

Supreme Court Term

2003 Term

Type

Merits Stage Brief

Court Level

Supreme Court

No. 02-1377

In the Supreme Court of the United States

BUCK DOE, PETITIONER

ELAINE L. CHAO, SECRETARY OF LABOR

ON WRIT OF CERTIORARI
TO THE UNITED STATES COURT OF APPEALS
FOR THE FOURTH CIRCUIT

THEODORE B. OLSON
Solicitor General
Counsel of Record
PETER D. KEISLER
Assistant Attorney General
EDWIN S. KNEEDLER
Deputy Solicitor General
MALCOLM L. STEWART
PATRICIA A. MILLETT
Assistants to the Solicitor
General
LEONARD SCHAITMAN
ANTHONY A. YANG
Attorneys
Department of Justice
Washington, D.C. 20530-0001
(202) 514-2217

BRIEF FOR THE RESPONDENT

HOWARD M. RADZELY
Acting Solicitor of Labor
ALLEN H. FELDMAN
Associate Solicitor
NATHANIEL I. SPILLER
Deputy Associate Solicitor
MICHAEL P. DOYLE
Attorney
Department of Labor
Washington, D.C. 20210

QUESTION PRESENTED

Whether an individual who has been subjected to an "intentional or willful" violation of the Privacy Act, 5 U.S.C. 552a, must prove that he suffered "actual damages" to be awarded $1000 under Section 552a(g)(4) of the Act.

In the Supreme Court of the United States

No. 02-1377

BUCK DOE, PETITIONER

ELAINE L. CHAO, SECRETARY OF LABOR

ON WRIT OF CERTIORARI
TO THE UNITED STATES COURT OF APPEALS
FOR THE FOURTH CIRCUIT

BRIEF FOR THE RESPONDENT

OPINIONS BELOW

The opinion of the court of appeals (Pet. App. 3a-60a) is reported at 306 F.3d 170. The decision of the district court (Pet. App. 61a-68a), adopting in part the report and recommendation of the magistrate judge (Pet. App. 69a-104a), is unreported.

JURISDICTION

The court of appeals entered its judgment on September 20, 2002. A petition for rehearing and rehearing en banc was denied on November 15, 2002 (Pet. App. 1a-2a). On January 23, 2003, the Chief Justice extended the time within which to file a petition for a writ of certiorari to and including March 15, 2003, and the petition was filed on March 14, 2003. The jurisdiction of this Court rests on 28 U.S.C. 1254(1).

STATUTORY PROVISIONS INVOLVED

The civil remedies provision of the Privacy Act, 5 U.S.C. 552a(g), provides:

(1) CIVIL REMEDIES.-Whenever any agency

(A) makes a determination under subsection (d)(3) of this section not to amend an individual's record in accordance with his request, or fails to make such review in conformity with that subsection;

(B) refuses to comply with an individual request under subsection (d)(1) of this section;

(C) fails to maintain any record concerning any individual with such accuracy, relevance, timeliness, and completeness as is necessary to assure fairness in any determination relating to the qualifications, character, rights, or opportunities of, or benefits to the individual that may be made on the basis of such record, and consequently a determination is made which is adverse to the individual; or

(D) fails to comply with any other provision of this section, or any rule promulgated thereunder, in such a way as to have an adverse effect on an individual,

the individual may bring a civil action against the agency, and the district courts of the United States shall have jurisdiction in the matters under the provisions of this subsection.

(2)(A) In any suit brought under the provisions of subsection (g)(1)(A) of this section, the court may order the agency to amend the individual's record in accordance with his request or in such other way as the court may direct. In such a case the court shall determine the matter de novo.

(B) The court may assess against the United States reasonable attorney fees and other litigation costs reasonably incurred in any case under this paragraph in which the complainant has substantially prevailed.

(3)(A) In any suit brought under the provisions of subsection (g)(1)(B) of this section, the court may enjoin the agency from withholding the records and order the production to the complainant of any agency records improperly withheld from him. In such a case the court shall determine the matter de novo, and may examine the contents of any agency records in camera to determine whether the records or any portion thereof may be withheld under any of the exemptions set forth in subsection (k) of this section, and the burden is on the agency to sustain its action.

(4) In any suit brought under the provisions of subsection (g)(1)(C) or (D) of this section in which the court determines that the agency acted in a manner which was intentional or willful, the United States shall be liable to the individual in an amount equal to the sum of-

(A) actual damages sustained by the individual as a result of the refusal or failure, but in no case shall a person entitled to recovery receive less than the sum of $1,000; and

(B) the costs of the action together with reasonable attorney fees as determined by the court.

(5) An action to enforce any liability created under this section may be brought in the district court of the United States in the district in which the complainant resides, or has his principal place of business, or in which the agency records are situated, or in the District of Columbia, without regard to the amount in controversy, within two years from the date on which the cause of action arises, except that where an agency has materially and willfully misrepresented any information required under this section to be disclosed to an individual and the information so misrepresented is material to establishment of the liability of the agency to the individual under this section, the action may be brought at any time within two years after discovery by the individual of the misrepresentation. Nothing in this section shall be construed to authorize any civil action by reason of any injury sustained as the result of a disclosure of a record prior to September 27, 1975.

STATEMENT

1. a. The Privacy Act (the Act), 5 U.S.C. 552a, generally regulates federal agencies' disclosure of personal information, including social security numbers, to other governmental components and to the public. More specifically, the Privacy Act establishes requirements for Executive Branch agencies in their collection, maintenance, use, and dissemination of "records" containing information about an "individual" when those records are maintained as part of a "system of records." 5 U.S.C. 552a(a)(1)-(5) and (b). The Privacy Act defines a "record" as "any item, collection, or grouping of information" about a United States citizen or lawful permanent resident alien that is maintained by an agency and contains an individual identifier, such as the individual's name, identifying number, or symbol. 5 U.S.C. 552a(a)(2) and (4).

The Privacy Act prohibits certain agency disclosures of records that are contained within a "system of records" without "the prior written consent of[] the individual to whom the record pertains," 5 U.S.C. 552a(b), and allows an individual to gain access to certain records about himself and request that information in such records be amended if it is not "accurate, relevant, timely, or complete." 5 U.S.C. 552a(d). The Act further requires an agency that maintains certain systems of records to follow specific statutory requirements, including the requirement that the agency maintain records that are used to make determinations about an individual with the accuracy, relevance, timeliness, and completeness that are reasonably necessary to assure fairness to the individual in the determination. 5 U.S.C. 552a(e)(5).

The Privacy Act also regulates the use of social security numbers by federal agencies. Among other things, the Act directs that, if any government agency requests an individual to disclose his social security number, the agency "shall inform that individual whether that disclosure is mandatory or voluntary, by what statutory or other authority such number is solicited, and what uses will be made of it." 5 U.S.C. 552a note (Pub. L. No. 93-579, § 7(b), 88 Stat. 1909).

b. The Privacy Act authorizes private civil actions to enforce its terms. If an agency fails to amend a record in response to an individual's request, 5 U.S.C. 552a(g)(2), or fails to provide an individual proper access to his record, 5 U.S.C. 552a(g)(3), the Act makes the agency subject to a suit for injunctive relief and reasonable attorney's fees. If an agency's failure to maintain a record about an individual with the requisite accuracy, relevance, timeliness, or completeness results in a determination that is "adverse" to the individual, 5 U.S.C. 552a(g)(1)(C), or if an agency "fails to comply with any other provision" of Section 552a or its implementing regulations in such a way as to "have an adverse effect on an individual," 5 U.S.C. 552a(g)(1)(D), the Act allows that individual to bring a civil action against the agency for money damages. More particularly, if the agency's failure was "intentional or willful," the Act provides that

the United States shall be liable to the individual in an amount equal to the sum of--

(A) actual damages sustained by the individual as a result of the refusal or failure, but in no case shall a person entitled to recovery receive less than the sum of $1,000; and

(B) the costs of the action together with reasonable attorney fees as determined by the court.

5 U.S.C. 552a(g)(4). The Privacy Act also establishes criminal penalties for willful violations of its terms. 5 U.S.C. 552a(i).1

2. Since the inception of the federal government's Black Lung Benefits program in 1969, see 30 U.S.C. 901 et seq., the Social Security Administration, and its successor administering agency, the Department of Labor's Office of Workers' Compensation Programs, have used the voluntarily provided social security numbers of claimants seeking black lung benefits as internal case numbers in the processing of their claims. C.A. App. 108-110. Following passage of the Privacy Act, the Department of Labor published, under 5 U.S.C. 552a(a)(7), (b)(3) and (e)(4)(D), a notice of "routine use" of information compiled in the administration of black lung benefits. See 58 Fed. Reg. 49,548, 49,597 (1993). As relevant here, the notice advised black lung claimants that the administration of the benefit program entails the routine disclosure of claimants' records to persons associated with the claimant's case, including mine operators who may be liable for the claim, relevant insurance companies, and the legal representatives of relevant parties. See id. at 49,597-49,598. The notice further cautioned that the records subject to such disclosure may include a claimant's social security number. Id. at 49,597.

Prior to this litigation, administrative law judges responsible for black lung benefit cases frequently mailed multi-captioned hearing notices containing those same black-lung claim numbers-that is, the claimants' social security numbers-to claimants, their attorneys, coal companies, and insurance carriers. See Pet. App. 5a. Each multi-captioned hearing notice encompassed approximately 15 to 20 different cases and the parties associated with them. C.A. App. 88.2

3. In February 1997, petitioner and six other black lung claimants filed lawsuits, using pseudonyms, against the Secretary of Labor under the Privacy Act, alleging that the Department's practice of disclosing claimants' social security numbers to third parties while processing black lung benefits claims violated the Privacy Act. Pet. App. 5a-6a. The cases were consolidated, and the Department of Labor promptly consented to the entry of a stipulated order under which it agreed to discontinue its use of social security numbers on multi-captioned hearing notices. Id. at 6a; J.A. 12-13.

In support of a claim for damages, petitioner submitted an affidavit in which he stated that the disclosure of his social security number on multi-captioned hearing notices had "torn me all to pieces," and that "no amount of money could compensate me for worry and fear of not knowing when someone would use my name and Social Security number." J.A. 15. At the same time, petitioner acknowledged that his social security number had been on his driver's license until more than a year after his suit was filed, and that it "probably" was pre-printed on all of his checks. J.A. 1, 17, 23. No other plaintiff identified any adverse consequence arising from the Department's dissemination of his social security number. Pet. App. 18a n.7, 22a.

The plaintiffs then sought to certify a class of "all claimants for Black Lung Benefits through the United States Department of Labor since the passage of the Privacy Act." C.A. App. 79, 81; Pet. App. 6a. The plaintiffs asserted that there were "thousands of members of the class," C.A. App. 80, noting that there were nearly 23,000 active claims for black lung benefits pending during the relevant time period, and that many of those claimants "would have an identical claim for violations of the Privacy Act," id. at 88. The plaintiffs further estimated that close to 100,000 black lung cases had been scheduled for hearings, and that if each multi-captioned hearing notice had been distributed to 40 or 50 strangers, then there would have been "approximately four to five million" Privacy Act violations. See Mem. in Opp. to Def.'s Supp. Summ. J. Mot. 17. Asserting that each class member had an automatic entitlement to a minimum $1000 award for each violation of the Act, the plaintiffs concluded that the "multiplication is mind-boggling" and that, however large those numbers may be, the Department of Labor "is liable in the appropriate, corresponding amount." Id. at 14, 17; see also C.A. App. 95.

The district court denied class certification and granted summary judgment for the Department with respect to all claims for damages, except for petitioner's. Pet. App. 61a-68a; see also id. at 69a-104a (report and recommendation of magistrate judge). The court first concluded that the Department's mailing of multi-captioned hearing notices containing a claimant's social security number to persons not associated with the claimant's case violated the Privacy Act's non-disclosure provision (5 U.S.C. 552a(b)), and that the practice constituted an "intentional or willful" violation of the Act. Pet. App. 86a-92a, 94a-97a. With respect to petitioner, the district court agreed with the government that proof of actual damages was required. Id. at 66a & n.2. The court concluded, however, that petitioner had submitted "sufficient incontrovertible evidence * * * that he suffered 'actual damages,' in the form of emotional distress," and it awarded him the "statutory minimum amount" of damages of $1000. Id. at 66a-67a. With respect to the other named plaintiffs, the court adopted the magistrate judge's finding that none of them had identified any adverse effect resulting from the Department of Labor's inclusion of their social security numbers on the multi-captioned hearing notices. Id. at 65a-67a, 99a-100a.

4. a. The court of appeals reversed the district court's grant of summary judgment to petitioner, and otherwise affirmed the district court's grant of summary judgment to the Department. Pet. App. 3a-60a. The court rejected petitioner's argument that he was automatically entitled to an award of $1000 for having proved an intentional or willful violation of the Privacy Act, holding that the Privacy Act's remedial provision requires plaintiffs to demonstrate some "actual damages" before they may obtain the statutory minimum award of $1000. Id. at 9a.

The court of appeals first noted that Congress has restricted the minimum $1000 damages award to a "person entitled to recovery," 5 U.S.C. 552a(g)(4). By placement of that phrase within a subparagraph "the sole and entire purpose of which is to limit the liability of the United States to actual damages sustained," Pet. App. 9a, the court explained, "Congress has defined 'recovery' (albeit indirectly) by its express limitation of the Government's liability to actual damages sustained." Ibid. The provision thus serves only to "provide[] for a 'statutory minimum' to actual damages" in cases "where actual damages are greater than $0 but less than $1,000." Ibid. That reading "gives effect to the eminently reasonable * * * presumption that the legislature correlated the plaintiff's recovery entitlement with the defendant's liability by limiting the plaintiff's recovery to actual damages and by providing, by way of incentive to suit, for at least a minimum recovery even where actual damages are minimal." Id. at 10a. At the same time, the court concluded, Congress's decision only "to augment damages awards for persons able to demonstrate some 'actual damages' * * * serve[d] a competing objective: preventing the imposition of potentially substantial liability for violations of the Act which cause no 'actual damages' to anyone." Id. at 11a n.2.

The court also found its reading to be compelled "as a grammatical matter," because, "having just defined the recovery that will be permitted against the United States" in terms of actual damages, "it would torture all grammar to conclude that the phrase 'a person entitled to recovery' references anyone other than one who has sustained actual damages." Pet. App. 10a (emphasis omitted). Had Congress intended to allow an automatic award of $1000, without any showing of actual damages, the court explained, it could have done so "unequivocally" through "clear" language. Id. at 10a-11a.

Finally, because the Privacy Act's remedial provisions are a limited waiver of sovereign immunity, the court concluded that the scope of the waiver must be "strictly construed . . . in favor of the sovereign." Pet. App. 13a-14a.

Having found that petitioner's entitlement to the $1000 award depended on a showing of actual damages, the court concluded that petitioner's allegations of emotional upset, which did not include "any evidence of tangible consequences stemming from his alleged angst over the disclosure of his [social security number]," Pet. App. 17a, did not constitute sufficient evidence of actual damages to sustain an award under Section 552a(g)(4)(A).3

b. Judge Michael dissented from the majority's holding that an individual must prove actual damages to receive an award of $1000 under Section 552a(g)(4)(A). Pet. App. 24a-60a. Admitting that the "question is somewhat close," id. at 30a, and that his reading of the statute "is not inevitable," id. at 45a, Judge Michael would have held that a plaintiff "can recover statutory damages of $1,000 upon proof that he has suffered an adverse effect as a result of an intentional or willful violation of the Privacy Act, § 552a(g)(1)(D), (g)(4)." Id. at 25a. In Judge Michael's view, that reading better comports with "policy considerations" and "Congress's purposes." Id. at 47a.

SUMMARY OF ARGUMENT

The Privacy Act permits individuals whose rights have been violated to sue to recover "actual damages sustained by the individual * * *, but in no case shall a person entitled to recovery receive less than the sum of $1,000." 5 U.S.C. 552a(g)(4)(A). The court of appeals correctly held that the remedial language does not authorize an automatic award of $1000 in the absence of a showing of actual damages. Rather, the $1000 award provides a guaranteed minimum recovery for individuals who have demonstrated actual damages, while allowing them and the court to avoid the resource-intensive process of precisely quantifying those damages when their relatively small amount renders such an effort not worth the candle.

Because the Privacy Act's remedial provisions constitute a limited waiver of the United States' sovereign immunity, the question is not whether the statutory text could be read to provide for automatic statutory damages. The question is whether the statutory text clearly and unequivocally compels that conclusion. It does not. By its terms, the Privacy Act makes the minimum $1000 award available not to every individual who establishes the existence of an intentional or willful violation, but only to a "person entitled to recovery." The word "recovery" is most naturally understood to refer to compensation awarded as a remedy for prior wrongs -and, in the present context, to the "actual damages" specifically authorized by Section 552a(g)(4)(A). Absent proof of the type of harm that would support an "actual damages" award, a Privacy Act plaintiff therefore is not a "person entitled to recovery" under the Act, even if he can demonstrate the commission of an intentional or willful violation.

If Congress had wanted to demarcate the $1000 payment as a distinct form of automatic statutory damages, available even to a plaintiff who has failed to establish any "actual damages," it could easily have achieved that result. Congress could simply have provided for "actual damages or statutory damages of $1000, whichever is greater." Alternatively, Congress could have authorized the payment of "statutory" or "liquidated" damages in its own subsection, separate and apart from the "actual damages" provision. Such labeling or distinct itemization of statutory and liquidated damages is how Congress has provided for such awards in more than a dozen other statutes, including a number of privacy laws. Congress's decision to take a different course in the Privacy Act, and instead to restrict the $1000 minimum award to "person[s] entitled to recovery," therefore must be given meaningful effect by the courts.

Although petitioner discusses at length the Act's legislative history and policy considerations, sovereign immunity can be waived only by duly enacted statutory text. Neither committee reports nor unidimensional notions of good policy can open the federal Treasury to monetary awards that Congress did not expressly authorize. In any event, the legislative history undermines petitioner's argument. Both the House and the Senate repeatedly failed to enact versions of the remedial provision that would have expressly authorized awards of liquidated or statutory damages even in the absence of any actual damages. The legislative compromise that produced the Privacy Act, moreover, eschewed expanding the government's monetary liability beyond actual damages, choosing instead to task a newly formed Commission with studying the need for some form of automatic damages.

Petitioner's policy arguments fare no better. Congress did not legislate with a single-minded focus on encouraging Privacy Act damage claims. It sought to balance the need for effective remedies with responsible fiscal judgments. Congress struck that reasonable balance by allowing actual damages-with a guaranteed minimum recovery to obviate proof difficulties and simplify litigation for many of the small claims that Privacy Act violations can produce-while tabling the inclusion of further remedies pending further study.

ARGUMENT

THE PRIVACY ACT REQUIRES A PLAINTIFF TO DEMONSTRATE ACTUAL DAMAGES BEFORE HE MAY OBTAIN THE STATUTORILY PRESCRIBED MINIMUM AWARD OF $1000 UNDER 5 U.S.C. 552a(g)(4)(A)

The Privacy Act establishes a carefully calibrated damages remedy against federal agencies for intentional or willful violations of certain provisions of the Act, including the improper disclosure of a social security number. Specifically, the Privacy Act provides that, in such a suit,

the United States shall be liable to the individual in an amount equal to the sum of-

(A) actual damages sustained by the individual as a result of the refusal or failure, but in no case shall a person entitled to recovery receive less than the sum of $1,000; and

(B) the costs of the action together with reasonable attorney fees as determined by the court.

5 U.S.C. 552a(g)(4). The question in this case is whether the Privacy Act entitles every individual who demonstrates an intentional or willful violation of the relevant Privacy Act provisions to an automatic payment of $1000 from the federal Treasury even if he suffered no damages whatsoever, or whether, instead, such payments are restricted to individuals who have demonstrated some actual damages.

That question of statutory construction concerns the scope of Congress's waiver of the United States' sovereign immunity from money damages and, in particular, the amount and type of monetary liability to which Congress decided to open the federal Treasury. Under established interpretive principles, any doubt regarding the scope of Congress's waiver must be resolved in favor of preserving sovereign immunity. To obtain the automatic damages that he seeks, petitioner thus must show not simply that his own reading of the pertinent language is a plausible one, but that the statutory text clearly and unequivocally compels that reading. Petitioner cannot make that showing.

A. Congress's Waiver Of Sovereign Immunity For Automatic, Statutory Damages Must Be Clear And Unequivocal

It is a "common rule, with which [this Court] presume[s] congressional familiarity," that the United States government is immune from suit unless it has expressly waived its sovereign immunity. Department of Energy v. Ohio, 503 U.S. 607, 615 (1992); see also Lane v. Pena, 518 U.S. 187, 192 (1996).4 Any waiver of immunity, moreover, must be "unequivocally expressed" and "not enlarged beyond what the language requires." United States v. Nordic Vill., Inc., 503 U.S. 30, 33-34 (1992) (internal alterations and quotation omitted).

The sovereign immunity of the United States encompasses not only immunity from suit, but also the authority to establish the terms upon which suit may proceed. See, e.g., Lehman v. Nakshian, 453 U.S. 156, 160 (1981); United States v. Testan, 424 U.S. 392, 399 (1976) ("It has long been established, of course, that the United States, as sovereign, 'is immune from suit save as it consents to be sued . . . and the terms of its consent to be sued in any court define that court's jurisdiction to entertain the suit.'") (quoting United States v. Sherwood, 312 U.S. 584, 586 (1941)). Accordingly, even where the United States has generally waived its sovereign immunity from suit, the availability of monetary relief, interest, and jury trial depend upon an additional express and particularized waiver by Congress. See, e.g., Nordic Vill., 503 U.S. at 34-37 (monetary claims unavailable); Library of Congress v. Shaw, 478 U.S. 310, 318-319 (1986) (Title VII's general waiver of immunity does not authorize interest); Lehman, 453 U.S. at 160 (jury trial unavailable); see also United States v. John Hancock Mut. Life Ins. Co., 364 U.S. 301, 308 (1960) (despite the general waiver of immunity from suit in 28 U.S.C. 2410, "the United States is not subject to local statutes of limitations"). Any "limitations and conditions upon which the Government consents to be sued must be strictly observed and exceptions thereto are not to be implied." Lehman, 453 U.S. at 161; see also Department of the Army v. Blue Fox, Inc., 525 U.S. 255, 261 (1999) (a statutory waiver must "be strictly construed, in terms of its scope, in favor of the sovereign").

Petitioner contends (Br. 24-25) that this Court should eschew a strict construction of the Privacy Act's text because Congress clearly waived the United States' immunity from suit and from some form of damages remedy. That argument fails for two reasons.

1. First and foremost, this Court's long-established precedent is flatly to the contrary. In Price v. United States, 174 U.S. 373 (1899), the question before the Court was whether a particular waiver of the government's immunity from suit for actual damages for property taken by Indians also encompassed a waiver of immunity for consequential damages-that is, "damages to other property which resulted as a consequence of the taking." Id. at 375. The Court held that the determination of what type of damages Congress had authorized directly implicated the United States' sovereign immunity and, as such, "its liability in suit cannot be extended beyond the plain language of the statute authorizing it." Id. at 376. The Court stressed that the jurisdiction of the court to award damages-including the specification of "contingencies in which the liability of the government is submitted to the courts," ibid.- "is a matter resting in [Congress's] discretion," id. at 377, and "cannot be enlarged by implication," regardless of what "may seem to this court equitable, or what obligation we may deem ought to be assumed by the government." Id. at 375. Similarly here, the question whether the $1000 minimum award is available to a Privacy Act plaintiff who has failed to establish any "actual damages" must be resolved through application of the canon requiring narrow construction of waivers of sovereign immunity.

Department of Energy, supra, in which the Court held that the federal government was not subject to punitive liability, is to the same effect. Congress, in the Clean Water Act, had waived the government's immunity from suit and authorized monetary "sanction[s]" against the federal government as "civil penalties" for violating the Act's federal-facilities provisions. 503 U.S. at 615, 620-627. The Court held, however, that the explicit waiver of sovereign immunity from monetary "sanctions," and Congress's use of "a seemingly expansive phrase like 'civil penalties arising under federal law,'" were not enough to prevent application of the "rule of narrow construction." Id. at 626-627. To the contrary, application of that traditional rule led the Court to "take[] the waiver no further than" authorizing fines as sanctions to assure the government's prospective compliance. Id. at 627. The Court acknowledged the "unresolved tension" in the statutory scheme, which suggested that punitive sanctions may have been intended by Congress, but held that "under our rules"-with which "congressional familiarity" is presumed-"that tension is resolved by the requirement that any statement of waiver be unequivocal" and narrowly construed to favor the sovereign. Id. at 615, 626-627. See also Missouri Pac. R.R. v. Ault, 256 U.S. 554, 563-564 (1921) (applying principles of sovereign immunity, the Court construed the scope of a waiver of immunity for damages to be limited to compensatory damages, and not to include additional "double damages" for delayed payment).

Likewise, in Ruckelshaus v. Sierra Club, 463 U.S. 680 (1983), the Court applied the canon of strict construction in addressing Congress's express waiver of sovereign immunity from attorney's fees in lawsuits brought under the Clean Air Act "whenever [a court] determines that such an award is appropriate." 42 U.S.C. 7607(f). The Court held that, notwithstanding Congress's waiver of immunity from suit and its clear authorization of some monetary relief, the term "appropriate" must be narrowly construed to prevent judicial enlargement of the available relief beyond what Congress clearly authorized. Ruckelshaus, 463 U.S. at 681-682, 685-686.

2. Petitioner's contention (Br. 24-26) that, once Congress opens the door to some monetary liability, courts are free to infer or imply broader monetary liability ignores the separation of powers principles that animate the rule of strictly construing congressional waivers of sovereign immunity. The power to waive sovereign immunity resides exclusively in the hands of Congress. Neither the Executive Branch nor the Judicial Branch can effect a waiver through the exercise of its respective powers. See OPM v. Richmond, 496 U.S. 414, 424-434 (1990); United States v. Shaw, 309 U.S. 495, 501-502 (1940). The Executive Branch's Article II powers and the Judicial Branch's Article III powers are "limited by a valid reservation of congressional control over funds in the Treasury." OPM v. Richmond, 496 U.S. at 425; see U.S. Const. Art. I, § 9, Cl. 7 ("No Money shall be drawn from the Treasury, but in Consequence of Appropriations made by Law."). This Court's strict construction of statutory waivers of immunity thus ensures that courts do not mistakenly impose burdens on the public fisc that Congress did not authorize, and that "public funds will be spent [only] according to the letter of the difficult judgments reached by Congress as to the common good." 496 U.S. at 428, 432; see also INS v. St. Cyr, 533 U.S. 289, 299 n.10 (2001) ("In traditionally sensitive areas, . . . the requirement of [a] clear statement assures that the legislature has in fact faced, and intended to bring into issue, the critical matters involved in the judicial decision.") (quoting Gregory v. Ashcroft, 501 U.S. 452, 461 (1991), and citing Nordic Vill., supra).

For that reason, this Court has been "particularly alert to require a specific waiver of sovereign immunity before the United States may be held liable" for "monetary exactions." United States v. Idaho, 508 U.S. 1, 8-9 (1993). Accordingly, "[w]here a cause of action is authorized against the federal government, the available remedies are not those that are 'appropriate,'" Lane, 518 U.S. at 197, or those that a court can plausibly infer from the statutory text, "but only those for which sovereign immunity has been expressly waived" by Congress itself, ibid. Accordingly, absent the clearest indications to the contrary, the Court should assume that "Congress had no intent to subject the United States to an enforcement mechanism that could deplete the federal fisc regardless of a responsible officer's willingness and capacity to comply in the future," and regardless of the fact that no individual suffered actual harm as a result of the government's improper conduct. Department of Energy, 503 U.S. at 628.5

Petitioner's reliance (Br. 25-26) on Canadian Aviator, Ltd. v. United States, 324 U.S. 215 (1945), and American Stevedores, Inc. v. Porello, 330 U.S. 446 (1947), is misplaced. Both cases involved construction of the terms of Congress's "broad statutory language authorizing suit" against the government under the Public Vessels Act, ch. 428, 43 Stat. 1112, to obtain damages caused by the negligent operation of public vessels by government employees. Canadian Aviator, 324 U.S. at 222. In Canadian Aviator, the Court declined to restrict an express waiver for "damages caused by a public vessel" to those damages that were caused by a collision involving such a vessel, holding that "Congressional adoption of broad statutory language authorizing suit was deliberate and is not to be thwarted by an unduly restrictive interpretation." Ibid. In Porello, the Court likewise construed the unqualified waiver of immunity for tort "damages" to reach both injury to property and injury to the person. 330 U.S. at 450. In both cases, moreover, the Court stressed that the unqualified language used by Congress to effect the broad waiver had an established meaning at law. Porello, 330 U.S. at 450 (noting "historical[]" meaning of damages, "a fact too well-known to have been overlooked by the Congress"); Canadian Aviator, 324 U.S. at 224 (Congress used "customary legal terminology").6

Those cases thus stand for the unremarkable proposition that, when Congress's waiver of immunity is clear and unequivocal, the Court has no license to protect the public purse by narrowing the waiver's scope with judicially crafted, extra-textual limitations. The Privacy Act's calibrated and closely tailored civil remedial scheme, which specifies particular forms of injunctive relief for two types of claims, and only "actual damages" for the remaining claims, is the antithesis of the broad and unqualified waiver of immunity for "damages" at issue in Canadian Aviator and Porello.

West v. Gibson, 527 U.S. 212 (1999), does nothing to strengthen petitioner's hand. Contrary to petitioner's contention (Br. 25), West did not hold the canon of narrow construction to be inapplicable to determinations of the types of damages that Congress authorized to be paid out of the federal Treasury. West held only that a clear waiver of immunity for "compensatory damages" applied to both the administrative and judicial phases of Title VII litigation against a federal agency. Id. at 222. The Court reached that decision because the statutory scheme at issue met the traditional "specially strict standard" of statutory construction. Ibid. While the Court suggested that the rule of narrow construction might not apply to subsidiary questions of "how [a] waived damages remedy is to be administered," ibid., the Court did not resolve that issue and the language discussing it was dictum. In any event, that dictum has little relevance to the quintessential sovereign immunity question of whether a particular category of plaintiffs-that is, individuals whose rights under the Privacy Act are violated, but who have suffered no "actual damages"-are entitled to a monetary award from the federal Treasury at all.

B. The Statutory Text And Structure Restrict The Award Of $1000 To Persons Who Have Suffered Actual Damages

In light of the sovereign immunity rule of narrow construction, the question in this case is not whether the statutory text could be read to support an award of automatic damages, regardless of actual injury. The question is whether the statutory text compels that reading. The answer is no. To the contrary, a straightforward reading of the text of the Privacy Act's remedial provision restricts the award of $1000 to a claimant who has sustained "actual damages" and who thus is a "person entitled to recovery."

1. The statutory text provides that the government "shall be liable to the individual" whose rights were violated "in an amount equal to the sum of" two things: (A) "actual damages sustained by the individual," and (B) costs and reasonable attorney fees. 5 U.S.C. 552a(g)(4). As petitioner appears to acknowledge (Br. 30-32), the term "actual damages" does not, in legal practice or common parlance, embrace the concept of liquidated damages or an automatic statutory payment regardless of actual harm. The follow-on clause in subparagraph (A), providing $1000 to a "person entitled to recovery," appears only after the statute has confined the remedy available to aggrieved individuals to "actual damages." The phrase is thus not logically or naturally read to disavow the very precondition to recovery-a showing of "actual damages"-that Congress just imposed. Instead, the structure of the sentence requires a plaintiff first to demonstrate some "actual damages sustained," and only then to become eligible for a minimum award of $1000.

That reading fully comports with the statement of congressional purpose in the Privacy Act, which expressed Congress's intent that federal agencies "be subject to civil suit for any damages which occur as a result of willful or intentional action which violates any individual's rights under th[e] Act." 5 U.S.C. 552a note (Pub. L. No. 93-579, § 2(b)(6), 88 Stat. 1896) (emphasis added). That statement stresses Congress's intent to provide a damages remedy for, and only for, losses which actually "occur."

2. That same understanding is consonant with Congress's use of the term "recovery" in conjunction with the "actual damages" requirement. The most common meaning of the term "recover" now, and at the time of the Privacy Act's enactment, is "to get or win back." Webster's Third New Int'l Dictionary 1898 (1966). That is precisely what actual damages do. They represent a "recovery" of money or resources lost due to the government's violation of the Privacy Act. By contrast, an automatic statutory payment of damages would not reflect a "recovery" of anything; it would be a freestanding award of money. Such automatic awards are designed, in petitioner's own words (Br. 29), not to effectuate a "recovery," but to provide an "incentive to enforce the Act" and to "deter future agency violations." Thus, the phrase "person entitled to recovery" is most sensibly read as referring to a person "entitled to recover[]" actual damages, as opposed to a person who has demonstrated agency error but is not "recover[ing]" anything.7

Petitioner's contention (Br. 15-16) that the $1000 minimum award is itself the "recovery" to which he is "entitled" is anomalous in another respect as well. The phrase "person entitled to recovery" can meaningfully define eligibility for the $1000 minimum award only if an individual plaintiff's "entitle[ment] to recovery" can be determined without reference to the availability of the $1000 award itself. If the Act did not provide for such a minimum award, petitioner could not plausibly claim to be a "person entitled to recovery": petitioner has not challenged the court of appeals' holding that he failed to prove actual damages (Pet. App. 18a), and the Privacy Act does not provide for any other form of compensatory relief. Under petitioner's theory, however, it is precisely and only his purported eligibility for a $1000 award that makes him a "person entitled to recovery." That wholly circular argument overlooks that the statutory text makes the payment of $1000 a consequence of being a "person entitled to recovery."

3. Congress's employment of the unique phrase "person entitled to recovery" reinforces that reading. Petitioner surmises (Br. 16) that the phrase "person entitled to recovery" refers to a plaintiff who has established an intentional or willful violation under Section 552a(g)(4) and the adverse effect required by Section 552a(g)(1)(D) as a prerequisite to suit. The Privacy Act's text demonstrates otherwise. Throughout the remedial provision, a plaintiff whose rights have been violated is referred to as an "individual," not a "person entitled to recovery." Indeed, Section 552a(g)(4) makes the government liable "to the individual" and requires the payment of actual damages sustained "by the individual." See also 5 U.S.C. 552a(g)(1)(A), (B), (C) and (D); 5 U.S.C. 552a(g)(2)(A). The phrase "person entitled to recovery" appears for the first and only time in the entire Act in the "actual damages" subparagraph of Section 552a(g)(4), and thus functionally serves to describe that particular class of individuals who have established some level of actual damages. When Congress "seemingly goes out of its way to avoid [a] standard term," employing in its place an "entirely novel phrase" or "neologism," the Court must give effect to that judgment. BFP v. Resolution Trust Corp., 511 U.S. 531, 537 (1994); see also Department of Energy, 503 U.S. at 619 ("Such differences in treatment within a given statutory text are reasonably understood to reflect differences in meaning intended."). To read "person entitled to recovery" as nothing more than the "individual" who establishes an adverse effect from intentional or willful conduct, as petitioner advocates, would ignore Congress's pointed use of distinct terminology.

4. Subparagraph (A) of Section 552a(g)(4) introduces the clause permitting an award of $1000 with the conjunction "but." As petitioner's cited authority explains, the word "but" "frequently means * * * 'except (that)' when used as a conjunction." Fowler's Modern English Usage 121 (R.W. Burchfield ed., 3d ed. 1996). When used in that manner, moreover, the exception refers back to the immediately preceding clause. See ibid. (providing illustrative examples). The guaranteed minimum recovery for a "person entitled to recovery" thus grammatically refers back to the "individual" identified at the opening of the subparagraph, who has sustained "actual damages." It does not, as petitioner argues (Br. 16), reach outside subparagraph (A) entirely and refer all the way back to the individual who has established an intentional or willful violation under the introductory clause in Section 552a(g)(4).

Petitioner stresses (Br. 16-17) that the word "but" is used as an adversative term limiting the operation of the "actual damages" provision. It certainly is. But that simply begs the question of what the payment of $1000 to a "person entitled to recovery" is meant to qualify-the obligation to show actual damages at all, or the obligation to quantify the actual damages sustained. That question is answered by the structure of the statutory provision. Congress itemized the two forms of relief it wished to allow under Section 552a(g)(4) in two distinct and separately set out subparagraphs-one for actual damages and one for costs and fees. Subparagraph (A) thus should be read as a self-contained, single remedial unit, designed to guarantee a minimum award for a person who sustains actual damages.

Given the structure adopted by Congress, it stands to reason that, if Congress wanted instead to add a third form of relief-automatic, statutory damages-it would have done so through a third, self-contained and distinctly demarcated subparagraph. Indeed, that is what Congress has done in a number of other statutes, making clear its desire to ensure an award of purely statutory damages. In the Right to Financial Privacy Act of 1978, 12 U.S.C. 3401 et seq., for example, Congress provided that federal agencies that improperly disclose financial records shall be "liable * * * in an amount equal to the sum of-(1) $100 * * *; [and] (2) any actual damages sustained * * *," 12 U.S.C. 3417(a), with the two subsections itemizing statutory and actual damages physically set off from each other in the statutory text. See also Electronic Communications Privacy Act of 1986, 18 U.S.C. 2520(c)(2) (allowing, in subsection (A), "actual damages," and separately in subsection (B), "statutory damages of whichever is the greater of $100 a day for each day of violation or $10,000").

In other statutes, where Congress has not independently identified statutory damages as an element of relief in a separate subsection, Congress nevertheless has expressly denominated such an element of an award as "liquidated" or "statutory" damages. Provisions using those terms, moreover, do not restrict the availability of "liquidated" or statutory" damages to "persons entitled to recovery," and they typically contain other language making clear that the availability of "liquidated" or "statutory" damages does not depend upon proof of actual damages. See, e.g., Electronic Communications Privacy Act of 1986, 18 U.S.C. 2520(c)(1)(A) (authorizing an award of "the greater of the sum of actual damages suffered by the plaintiff, or statutory damages of not less than $50 and not more than $500"), 2520(c)(1)(B) (authorizing an award of "the greater of the sum of actual damages suffered by the plaintiff, or statutory damages of not less than $100 and not more than $1000"); Video Privacy Protection Act of 1988, 18 U.S.C. 2710(c)(2)(A) (authorizing an award of "actual damages but not less than liquidated damages in an amount of $2,500"); Driver's Privacy Protection Act of 1994, 18 U.S.C. 2724(b)(1) (authorizing an award of "actual damages, but not less than liquidated damages in an amount of $2,500"); Freedom of Access to Clinic Entrances Act of 1994, 18 U.S.C. 248(c)(1)(B) (allowing plaintiff to elect "in lieu of actual damages, an award of statutory damages in the amount of $5,000 per violation"); Trademark Act of 1946, 15 U.S.C. 1117(c) (authorizing an award of "actual damages" or "statutory damages"), 1117(d) (authorizing plaintiff to elect receiving, "instead of actual damages and profits, an award of statutory damages in the amount of not less than $1,000 and not more than $100,000"); 17 U.S.C. 504(c)(1) (authorizing plaintiff to elect receiving "instead of actual damages and profits, an award of statutory damages"); Copyright Remedy Clarification Act, 17 U.S.C. 511(b) (allowing award of "actual damages and profits and statutory damages"); Semiconductor Chip Protection Act of 1984, 17 U.S.C. 911(c) (allowing plaintiff to elect, instead of "actual damages and profits as provided by subsection (b), an award of statutory damages for all infringements involved in the action"); Migrant and Seasonal Agricultural Worker Protection Act, 29 U.S.C. 1854(c)(1) (authorizing award of "actual damages, or statutory damages of up to $500 per plaintiff per violation").8

Congress hewed to that same drafting pattern in other legislation safeguarding privacy rights at the time of the Privacy Act's enactment. See 18 U.S.C. 2520(a) (1970) (amended 1986) (authorizing "actual damages but not less than liquidated damages computed at the rate of $100 a day for each day of violation or $1,000, whichever is higher"); 15 U.S.C. 1681n(1)-(3) (1970) (amended 1996) (structurally separating the different types of damages authorized).

In short, when Congress wishes to authorize statutory or liquidated damages, it does so plainly by referring specifically to "statutory" or "liquidated" damages, or otherwise structurally demarcating such damages as available separate and apart from actual damages. Moreover, in none of the statutes-either those contemporaneous with or those postdating the Privacy Act- did Congress employ the unique phrase "person entitled to recovery" to describe a party entitled to receive liquidated or statutory damages. As petitioner himself insists (see Br. 20-23), such evidence of consistent congressional practice is highly relevant to the interpretive question presented here. Accordingly, the presence in the Privacy Act of the phrase "person entitled to recovery"-and the absence of either a similar structure separately itemizing the $1000 award in its own subparagraph or using one of the descriptive phrases "liquidated damages" or "statutory damages"-speaks volumes.

In response, petitioner offers (Br. 20-21) a tax law that was repealed 21 years ago, 26 U.S.C. 7217(c) (Supp. II 1978) (repealed 1982), but petitioner's argument either proves nothing or proves our point. Section 7217 authorized suits against private persons and government officials in their personal capacities, see 26 U.S.C. 7217(a) (1976) and 7701(a)(1); Vermont Agency of Natural Resources v. United States, 529 U.S. 765, 780-781 & n.9 (2000), for the improper disclosure of tax return information. The damages provision, 26 U.S.C. 7217(c) (Supp. II 1978), employed language similar to that in the Privacy Act.9 The existence of that now-repealed provision proves nothing, however, because its text was never authoritatively interpreted by this Court; nor was it analyzed by the courts of appeals with the care required for waivers of sovereign immunity because it did not authorize suit against the United States.10 The repealed statutory language thus, at best, raises the same question presented here; it does not answer it.

The evolution of Section 7217(c), in fact, proves our point. When Congress repealed Section 7217(c) and, instead, made the United States a defendant in such actions, Congress replaced the ambiguous actual damages provision with a new provision that follows the pattern identified above of structurally demarcating statutory damages as distinct from actual damages. See 26 U.S.C. 7431(c)(1) (subsection (A) permits the award of "$1,000 for each act of unauthorized inspection or disclosure," while subsection (B) authorizes "actual damages"). That change indicates Congress's understanding that the predecessor language in Section 7217(c) either did not authorize automatic statutory damages, or was sufficiently unclear as to require a clarifying amendment in order to impose monetary liability upon the United States. The successor law thus "illustrates Congress' ability to craft a clear waiver of the Federal Government's sovereign immunity against particular remedies for violations of the Act." Lane, 518 U.S. at 194. That clear language and structure are notably absent from the Privacy Act.11

5. Limiting damages payments to individuals who have demonstrated some actual harm from the government's violation of the Privacy Act promotes structural equity among the different remedial schemes authorized by Congress in the Privacy Act. Section 552a(g) includes three different remedial provisions. Section 552a(g)(2) authorizes a civil action for injunctive relief, costs, and attorney fees when an agency fails to amend or correct an individual's record. Section 552a(g)(3) likewise authorizes a civil action for injunctive relief, costs, and attorney fees when an agency fails to provide an individual with access to his record. Section 552a(g)(4) authorizes actual damages for certain violations of the Privacy Act's other requirements. In neither (g)(2) nor (g)(3) did Congress deem it necessary to authorize automatic monetary relief in order to provide an "incentive to enforce the Act" or to "deter future agency violations" (Pet. Br. 29). There is thus no reason to believe that Congress would have thought additional incentives or sanctions, beyond the award of actual damages, were necessary to enforce the other rights protected by the Privacy Act either. See Memphis Comm. Sch. Dist. v. Stachura, 477 U.S. 299, 310 (1986) ("[D]amages that compensate for actual harm ordinarily suffice to deter constitutional violations."); Carey v. Piphus, 435 U.S. 247, 254-255 (1978) (the "cardinal principle of damages in Anglo-American law is that of compensation for" injury caused by a defendant's breach of duty).

6. Petitioner's textual arguments to the contrary fail. Petitioner first argues (Br. 13-15) that limiting recovery to actual damages (with a guaranteed minimum recovery of such damages) conflicts with the statutory text stating that the agency "shall be liable" whenever an intentional or willful violation is proven. No such conflict exists. Congress did not establish liability in the air. It established liability only for "actual damages sustained." There is thus nothing counter-textual about requiring the plaintiff to show not just that the agency committed an intentional or willful violation of the Privacy Act, but also that he sustained actual damages. That is exactly what Congress commanded. If the Act had simply provided that "an agency that commits an intentional or willful violation shall be liable for actual damages," petitioner could not plausibly argue that the unavailability of any monetary award in cases where no actual damages were shown would somehow subvert Congress's determination that the agency "shall be liable." The fact that in the Privacy Act, individuals who have established some actual damages are also guaranteed a minimum award does not introduce incongruity; it simply eases or avoids quantification and other proof problems at trial. See Pet. Br. 12 (noting that the amount of damages can be "inherently difficult to quantify").

Petitioner next argues (Br. 17-18) that restricting damages awards under Section 552a(g)(4) to those persons who have shown actual harm would render "superfluous" the requirement in Section 552a(g)(1)(D) that plaintiffs demonstrate an "adverse effect" arising from the agency's failure to comply with the Privacy Act's terms as a prerequisite to suit. The required showing of an adverse effect, however, is not a remedial standard. It establishes the individual's standing to bring suit under the Privacy Act, just as it does under the Administrative Procedure Act, see 5 U.S.C. 702. See Director, Office of Workers' Comp. Programs v. Newport News Shipbuilding & Dry Dock Co., 514 U.S. 122, 126 (1995) ("The phrase 'person adversely affected or aggrieved' is a term of art used in many statutes to designate those who have standing to challenge or appeal an agency decision, within the agency or before the courts."); cf. S. Rep. No. 1183, 93d Cong., 2d Sess. 83 (1974) (describing function of Senate's "aggrieved person" language). The showing of an adverse effect demonstrates both the "injury in fact" and causation components of Article III standing, see Vermont Agency, 529 U.S. at 771 (discussing Article III standing requirements), and further demonstrates that the plaintiff's alleged injury falls within the "zone of interests" sought to be protected by the Privacy Act. See Lujan v. National Wildlife Fed'n, 497 U.S. 871, 883 (1990); Clarke v. Securities Indus. Ass'n, 479 U.S. 388, 399-400 (1987).12

The type of threshold allegation or showing needed to bring suit at all is a far cry from the proof of actual damages needed to obtain monetary relief at the end of the lawsuit. Indeed, this Court's cases "firmly establish[]" that the "possibility that the [plaintiff's] averments might fail to state a cause of action on which [he] could actually recover" has no effect on the plaintiff's standing or the court's jurisdiction. See Steel Co. v. Citizens for a Better Env't, 523 U.S. 83, 89 (1998) (quoting Bell v. Hood, 327 U.S. 678, 682 (1946)). For standing purposes, it is sufficient if a plaintiff establishes an injury in fact that is "fairly traceable" to the agency's allegedly unlawful action, that falls within the zone of interests protected by the Act, and that likely would be redressed if the plaintiff were to obtain "the requested relief" of actual damages. See Steel Co., 523 U.S. at 103; see also id. at 96 (past injury is redressable "if the relief requested" is "money damages").

Petitioner argues lastly (Br. 18-19) that reading Section 552a(g)(4)(A) to permit money judgments against the United States only upon a showing of actual damages would create a potential "constitutional defect" in the law because it would permit the award of attorney's fees even if no actual damages were awarded. The notion that every statute authorizing monetary damages and attorney's fees is unconstitutional unless it guarantees that, at the end of the day, every plaintiff goes home with some damages payment is breathtakingly broad. It is also incorrect. As an initial matter, a plaintiff who fails to allege any basis for a damages recovery at the outset will lack standing to pursue a damages claim under Section 552a(g)(4) because he will have failed to satisfy the redressability prong of standing. Lujan v. Defenders of Wildlife, 504 U.S. 555, 560 (1992). In those circumstances, the individual would be limited to pursuing injunctive relief under the Administrative Procedure Act, 5 U.S.C. 706, to halt any ongoing agency violation of the Privacy Act (if he is able to demonstrate that he is affected adversely by the agency's practice, 5 U.S.C. 702; City of Los Angeles v. Lyons, 461 U.S. 95 (1983)). That, in fact, was the basis for the injunction issued, by consent, in this case.13

Beyond that, if the plaintiff alleges, but then ultimately fails to prove, any actual damages, he will not be entitled to attorney's fees. That is because the Privacy Act permits an award only of "reasonable" attorney's fees. 5 U.S.C. 552a(g)(4)(B). The most critical factor in determining the reasonableness of an attorney fee award is the degree of success obtained. See Farrar v. Hobby, 506 U.S. 103, 114-115 (1992). For a plaintiff who enjoys no success in prosecuting his claim, "the only reasonable fee" is "no fee at all." Ibid. ("only reasonable fee" for successful but nominal award "is usually no fee at all").

C. The Legislative History Of The Privacy Act, Congress's Overall Purpose, And Policy Considerations Confirm That Congress Did Not Authorize Any Damages Award For Plaintiffs Who Have Failed To Prove Actual Damages

Petitioner argues (Br. 29-31) that the Privacy Act's legislative history reveals a desire on Congress's part to provide statutory damages to plaintiffs who have suffered no actual harm from the agency's violation. The short answer is that "the 'unequivocal expression' of elimination of sovereign immunity that [the Court] insist[s] upon is an expression in statutory text. If clarity does not exist there, it cannot be supplied by a committee report." Nordic Vill., 503 U.S. at 37; see also Lane, 518 U.S. at 192 ("A statute's legislative history cannot supply a waiver that does not appear clearly in any statutory text."). The long answer is that the legislative history "no more supports" petitioner's reading of the Privacy Act's damages provision "than does the statutory language itself." Lehman, 453 U.S. at 165.

1. Draft bills that expressly provided for liquidated damages and did not use the phrase "person entitled to recovery" were considered and rejected in both the House and the Senate. A direct predecessor to H.R. 16373, 93d Cong., 2d Sess. (1974), the amended provisions of which became the Privacy Act, specifically provided for liquidated damages. See H.R. 13872, 93d Cong., 2d Sess., § 552a(g)(1) (1974) (providing that any agency committing a violation of the act shall be liable in an amount equal to "actual and general damages but not less than liquidated damages computed at the rate of $1,000 for each" violation plus "punitive damages" where appropriate). That provision did not survive consideration by a subcommittee, and it was soon replaced by H.R. 16373, which provided only that the United States "shall be liable" for "actual damages sustained by the individual as a result of" a "willful, arbitrary, or capricious" violation. See H.R. 16373, supra, § 552a(g)(3) (Oct. 2, 1974) (as reported by committee); see also H.R. Rep. No. 1416, 93d Cong., 2d 11 (1974). The absence of any liquidated damages provision, moreover, was not an oversight. Ten committee members expressly advocated that inclusion of a provision for "liquidated damages is essential" because "[a]ctual damages resulting from an agency's misconduct will, in most cases, be difficult to prove." Id. at 38 (Additional Views); see also 120 Cong. Rec. 36,645 (1974) (Rep. Abzug) (expressing the view that one of the "basic weaknesses" of H.R. 16373 was its failure to provide "liquidated" damages).

In the Senate as well, two bills that received specific consideration in committee provided for liquidated damages and had no limitation to "persons entitled to recovery." See S. 2810, 93d Cong., 1st Sess., § 7(c)(1) (1973) (agency liable for "any actual damages sustained by the individual aggrieved as a result of the * * * violation, but not less than liquidated damages of $100"); S. 3633, 93d Cong., 2d Sess., § 11(b)(1) (1974) (agencies liable for "any actual damages sustained by an individual plus $100 per violation"); see S. Rep. No. 1183, supra, at 3-4; 120 Cong. Rec. at 19,003, 23,450, 23,456 (Sen. Ervin); cf. S. 2963, 93d Cong., 2d Sess., § 308(e) (1974) (person aggrieved "shall be entitled to a $100 recovery for each violation plus actual and general damages"). Neither bill was reported out of committee.

2. The House-Senate compromise that resulted in passage of the Privacy Act reveals a congressional intent to proceed cautiously by permitting recovery only by individuals who sustained actual damages, while studying the need to permit additional forms of damages relief. The bill passed by the House permitted the award of "actual damages" only. See H.R. 16373, supra, § 552a(g)(3)(A) (Oct. 2, 1974) (as reported by committee); 120 Cong. Rec. at 36,976, 39,204, 40,398-40,400 (passage by full House on Nov. 21, 1974). The Senate bill, by contrast, authorized the award of both "actual and general damages." See S. 3418, 93d Cong., 2d Sess., § 303(c) (Nov. 22, 1974) (as amended); 120 Cong. Rec. at 36,917-36,921 (passage by full Senate). The "general damages" provision likely derived from the common law tort of invasion of privacy, where "general damages" may be awarded as "presumed damages" without proof of harm.14 After each bill was reported out of committee, President Ford expressed "enthusiastic support" for H.R. 16,373, supra, but expressed his view that S. 3418, supra, still required "major technical and substantive amendments." 120 Cong. Rec. at 34,838; see also id. at 36,892 (Sen. Ervin).15

With the 93d Congress drawing to a close, the members of the committees that reported the bills determined that there was not sufficient time to "resolve the complex differences between the two bills in a conference committee." 120 Cong. Rec. at 40,880.16 Proceeding through a process of informal compromise, members of the two committees agreed to "retain the basic thrust of the House version," but also to "include important segments of the Senate measure." Ibid. That compromise eliminated the authorization for general or "presumed" damages and, instead, created a Privacy Protection Study Commission to study and report back to Congress on provisions "not included in the compromise" bill, including "whether the Federal government should be [made] liable for general damages." Id. at 40,881; see also Privacy Act of 1974, Pub. L. No. 93-579, § 5(c)(2)(B)(iii), 88 Stat. 1907. That approach was consistent with Congress's final determination, given the press of time, to proceed cautiously by enacting a law containing basic, broadly agreed-upon protections for privacy, while leaving other more controversial matters for further study and debate. See Privacy Protection Study Comm'n, Personal Privacy in an Information Society: Report of the Privacy Protection Study Commission 530 (1977) (Congress "restrict[ed] recovery [under the Act] to specific pecuniary losses until the Commission could weigh the propriety of extending the standard of recovery.").17 Petitioner's effort to obtain the very type of automatic damages payment for which Congress deferred consideration, due to the controversy surrounding that form of relief, thus ignores the legislative compromise that brought the Privacy Act into being.18

3. Petitioner argues (Br. 27) that allowing automatic damages would help "fulfill[] the Act's purpose[]" of protecting privacy. Perhaps so, but an argument based on "policy, no matter how compelling, is insufficient, standing alone, to waive [sovereign] immunity." Library of Congress, 478 U.S. at 321. Beyond that, "no legislation pursues its purposes at all costs," and "[d]eciding what competing values will or will not be sacrificed to the achievement of a particular objective is the very essence of legislative choice." Rodriguez v. United States, 480 U.S. 522, 525-526 (1987) (per curiam). To "assume that whatever furthers the statute's primary objective must be the law" "frustrates rather than effectuates legislative intent" by failing to reserve for Congress the difficult trade-offs inherent in nearly all legislative decisions. Id. at 526; see also Newport News, 514 U.S. at 136 ("Every statute proposes, not only to achieve certain ends, but also to achieve them by particular means-and there is often a considerable legislative battle over what those means ought to be.").19

The legislative history, in fact, documents that, in considering the competing remedial provisions before it, Congress did not proceed with a single-minded focus on encouraging Privacy Act litigation, to the exclusion of the fiscal consequences attending the authorization of broad damages awards:

[W]e are trying to balance two great interests here. We are trying to balance the necessity of balancing the budget, and we are trying to protect the Government from undue liability.

I think it is wrong to make the Government of the United States and this congressional budget subject to an absolutely incalculable amount of liquidated damages. If we had a hundred lawsuits and if we had a hundred verdicts of $1 million each, there would be no guarantee that this Congress could protect itself against that liability.

120 Cong. Rec. at 36,659 (Rep. McCloskey) (commenting on an amendment to authorize punitive damages); see also id. at 36,956 (Rep. Erlenborn) (opposing an amendment that would have provided damages

for any violation of the Act because it "expose[d] the Government to undue liability" which "[w]e just cannot afford"); id. at 36,659 (Rep. McCloskey) ("[I]s it not true that there would be no way of ascertaining in advance of any one year, when this Congress is ascertaining the budget, what might possibly be the amount of damages that might be awarded?"); id. at 36,644 (Rep. Moorhead) ("We have tried to tailor this bill so that it will protect individual rights and at the same time permit the Government to operate responsibly and perform its functions without unjustifiable impediments.").

The remedial text that Congress ultimately enacted -which includes no reference to "general," "liquidated," "statutory," or "presumed" damages-reflects that compromise by limiting monetary recoveries to those who have sustained "actual damages," while at the same time providing those same persons a guaranteed minimum award. That minimum guarantee, in turn, obviates the proof difficulties that frequently arise in quantifying damages precisely, streamlines the proof of multiple, minor damages claims, and provides an incentive to prove the existence of actual damages even when they are small in amount.

In short, the legislative history makes clear that, when Members of Congress favored some form of automatic damages payment, they said so explicitly. The history also reveals that such provisions were controversial because of their budgetary implications. The resulting compromise bill enacted the remedies provision on which there was common ground-one allowing "actual damages"-and deferred to a later day the consideration of other types of damages. Petitioner's reading of the statutory language thus attempts to obtain through judicial interpretation what was lost in the inevitable "give-and-take of the legislative process." Bell v. Maryland, 378 U.S. 226, 317 (1964) (Goldberg, J., concurring).

4. Finally, petitioner invokes (Br. 33-34) the Office of Management and Budget's Privacy Act Guidelines in support of his broad reading of the damages provision. The Privacy Act charges the Office of Management and Budget (OMB) to "develop and, after notice and opportunity for public comment, prescribe guidelines and regulations for the use of agencies in implementing the provisions of [the Privacy Act]," and to "provide continuing assistance to and oversight of the implementation of [the Privacy Act] by agencies." 5 U.S.C. 552a(v). Guidelines issued by OMB in 1975 state that an agency will be required to pay "[a]ctual damages or $1,000, whichever is greater," when it is found to have committed an intentional or willful violation of the provisions of the Privacy Act for which an actual damages award is permitted. 40 Fed. Reg. at 28,970.

OMB has informed this Office that, in recognition of the principle that waivers of sovereign immunity must be strictly construed, OMB does not interpret its Guideline to require the payment of $1000 to plaintiffs who have sustained no actual damages from a violation of the Act. Furthermore, even if the relevant Guideline provision unambiguously supported petitioner's position, it would not be entitled to judicial deference, because it concerns a provision of the Act that is administered solely by the courts, not by OMB or any other federal agency. See Adams Fruit Co. v. Barrett, 494 U.S. 638, 649-650 (1990).

More importantly, OMB's Guidelines are irrelevant to the sovereign immunity question before this Court. Any waiver of sovereign immunity must be clearly and unequivocally expressed in the statutory text. Nordic Vill., 503 U.S. at 33, 37. If the text is clear, "that is the end of the matter; for the court, as well as the agency, must give effect to the unambiguously expressed intent of Congress." Chevron U.S.A. Inc. v. Natural Res. Def. Council, Inc., 467 U.S. 837, 842-843 (1984). If the statutory text is ambiguous and susceptible of competing interpretations, then the canon of narrow construction of waivers of sovereign immunity dictates that immunity is not waived. Nordic Vill., 503 U.S. at 37. OMB could not, through the issuance of interpretative guidance, effect a waiver of sovereign immunity that Congress did not unambiguously enact. See OPM v. Richmond, 496 U.S. at 424-434 (Executive Branch official cannot bind government to monetary payment absent congressional appropriation); Shaw, 309 U.S. at 501. The Privacy Act's text contains no unambiguous authorization for statutory or liquidated damages absent proof of actual damages, and that is the end of the matter.

CONCLUSION

The judgment of the court of appeals should be affirmed.

Respectfully submitted.

BRIEF FOR THE RESPONDENT

HOWARD M. RADZELY
Acting Solicitor of Labor
ALLEN H. FELDMAN
Associate Solicitor
NATHANIEL I. SPILLER
Deputy Associate Solicitor
MICHAEL P. DOYLE
Attorney
Department of Labor

OCTOBER 2003

1 Damages awards under the Privacy Act are paid out of general treasury funds, rather than agency funds. See 31 U.S.C. 1304(a); Office of Mgmt. & Budget, Privacy Act Guidelines, 40 Fed. Reg. 28,968 (1975) (concluding that Privacy Act judgments "would appear to be payable from public funds rather than agency funds") (citing 28 U.S.C. 2414 and 31 U.S.C. 724a (1970), the predecessor to 31 U.S.C. 1304(a)).

2 The Privacy Act permitted the Office of Workers' Compensation Programs to use the claimants' voluntarily provided social security numbers as internal identification numbers, and the Act's routine use provision (5 U.S.C. 552a(b)(3)) permitted the Office to disclose the numbers to parties associated with each claimant's individual case. However, the external disclosure of a claimant's social security number to the numerous persons involved in other cases listed on the multi-captioned hearing notice violated the Privacy Act's limitations on agency disclosures. Cf. 5 U.S.C. 552a(b).

3 Petitioner did not seek this Court's review of that aspect of the court of appeals' holding. The court of appeals reserved "the issue of whether the term 'actual damages' as used in the Act encompasses damages for non-pecuniary emotional distress." Pet. App. 17a-18a. Accordingly, that issue, on which the courts of appeals have entered conflicting decisions, is not before the Court either. Compare Hudson v. Reno, 130 F.3d 1193, 1207 n.11 (6th Cir. 1997) ("actual damages" is limited to pecuniary losses), cert. denied, 525 U.S. 822 (1998), disapproved in part not relevant by Pollard v. E.I. du Pont de Nemours & Co., 532 U.S. 843 (2001), and Fitzpatrick v. IRS, 665 F.2d 327, 330-331 (11th Cir. 1982) (same), with Johnson v. Department of Treasury, IRS, 700 F.2d 971, 974-986 (5th Cir. 1983) ("actual damages" includes non-pecuniary emotional distress damages). In any event, even if some forms of emotional distress are compensable under the Privacy Act's damages provision, petitioner's alleged fear of future harm, unaccompanied by any other current injury, is not traditionally compensable. Cf. Metro-North Commuter R.R. v. Buckley, 521 U.S. 424, 432 (1997) (common-law courts generally deny relief to individual who is exposed to hazardous substance and fears that he will become diseased in the future, but who suffers no current physical impairment).

4 In drafting the Privacy Act, Congress legislated with that principle in mind. 120 Cong. Rec. 36,660 (1974) (Rep. Erlenborn) ("As I believe most of the lawyers in the House know, it is a general principle of law that the Government, in exercising its governmental functions, is not liable.").

5 The potential fiscal consequences of petitioner's argument cast that concern in stark relief. The Department of Labor's Office of Administrative Law Judges conducted over three thousand black-lung hearings between February 1995 and February 1997 (see 5 U.S.C. 552a(g)(5) (two-year statute of limitations for Privacy Act claims)). Virtually all of those hearings were preceded by the issuance of multi-captioned hearing notices to 15 to 20 claimants and to their attorneys, responsible employers, and insurance companies. See J.A. 9-10; C.A. App. 36, 59, 88, 143; Gov't Opp. to Pls.' Req. for Att'ys Fees 11-12. Indeed, petitioner asserted below that there were over 1.2 million individual violations per year and perhaps "tens of millions of violations" in total. 10/4/00 Aff. of J. Wolfe, Esq. 3. If, as petitioner contended below, each disclosure amounted to an independent violation of the Privacy Act-and if each such violation, in turn, gave rise to a right to recover $1000- the payment of automatic damages for each violation could amount to well in excess of $170 million. Cf. Gov't Opp. to Pls.' Req. for Att'ys Fees 12; see also Mem. in Opp. to Def.'s Supp. Summ. J. Mot. 17 (asserting that there would have been "approximately four to five million" Privacy Act violations).

While the United States disagrees that the $1000 minimum award is available for each violation of the Privacy Act-the better reading authorizes a minimum damages payment to each "person entitled to recovery" in a Privacy Act suit-that statutory construction question has not yet been definitively resolved.

The instant suit, which involves large numbers of plaintiff class members each seeking the minimum $1000 recovery, is not unique. The federal Treasury faced exposure of over $100 billion in a Privacy Act class action that was certified to include over 100 million persons to whom the IRS mailed Form 1040 tax packages with mailing labels listing the recipient's name, address, and social security number. See Ingerman v. IRS, No. Civ.A.89-5396, 1990 WL 10029523 (D.N.J. July 16, 1990). The government currently faces potential liability in a pending suit against the Department of Veterans Affairs that seeks roughly $168 million ($1000 for each class member) for the Department's alleged disclosure of information and failure to establish appropriate safeguards to protect the security of such information in its computer system (5 U.S.C. 552a(b) and (e)(10)). See Schmidt v. Department of Veterans Affairs, No. 00-C-1093, 2003 WL 22346323 (E.D. Wis. Sept. 30, 2003), petition for permission to appeal denial of mot. for class certification pending, No. 03-8015 (7th Cir. filed Oct. 20, 2003).

6 The Public Vessels Act employed a broad waiver of immunity because Congress sought to equalize governmental and private liability for the same torts. Canadian Aviator, 324 U.S. at 218-219. See also Irwin v. Department of Veterans Affairs, 498 U.S. 89 (1990) (suits brought against the government under Title VII of the Civil Rights Act of 1964, 42 U.S.C. 2000e, are subject to the same presumption of equitable tolling that applies to Title VII suits against private defendants). The present case, by contrast, involves the imposition of damages liability exclusively on the federal government.

7 For example, a plaintiff who established the prerequisites for declaratory or injunctive relief would not naturally be characterized as a "person entitled to recovery"; a party does not "recover" an injunction or a declaratory judgment. Even though a declaratory or injunctive order might substantially benefit the plaintiff by reducing the likelihood of future violations, it would not represent a "recovery" because it would not compensate him for prior harms.

8 Other statutes referring to liquidated damages have used different formulations. See Privacy Protection Act of 1980, 42 U.S.C. 2000aa-6 (authorizing awards against the United States of "actual damages but not less than liquidated damages of $1,000"); Cable Communications Policy Act of 1984, 47 U.S.C. 551(f)(2)(A) (authorizing awards of "actual damages but not less than liquidated damages computed at the rate of $100 a day for each day of violation or $1,000, whichever is higher"); Foreign Intelligence Surveillance Act of 1978, 50 U.S.C. 1810(a) (authorizing the award of "actual damages, but not less than liquidated damages of $1,000 or $100 per day for each day of violation, whichever is greater"), 1828(1) (same).

9 The analogy is not perfect, however. Section 7217(c) consistently referred to the person receiving damages as the "plaintiff." It did not introduce (as the Privacy Act does) a new and distinct label, such as "person entitled to recovery," to describe the individual who had demonstrated actual damages.

10 Neither Johnson v. Sawyer, 120 F.3d 1307 (5th Cir. 1997), nor Rorex v. Traynor, 771 F.2d 383 (8th Cir. 1985) (each cited at Pet. Br. 21), analyzed the text of Section 7217. Johnson stated in dicta that Section 7217 provided "liquidated damages of $1,000 per disclosure," but the court did not specifically consider whether that $1000 sum should be awarded in the absence of other damages, because that question had been resolved in district court, was not contested by the parties on appeal, and thus was law of the case. See 120 F.3d at 1313, 1325 n.6. The Rorex court stated that a "statutory minimum award of $1,000" was available under Section 7217 for unlawful disclosures where neither actual nor punitive damages were awarded, but it did so without any analysis of the statutory text. See 771 F.2d at 387-388.

11 Petitioner's reliance (Br. 22-23) on 18 U.S.C. 2707(c) suffers from the same problem, compounded by the fact that the statute does not apply to the United States, 18 U.S.C. 2707(a), and thus says nothing about whether the text is sufficiently clear to waive sovereign immunity for money damages. Petitioner's reliance on 26 U.S.C. 6110(j)(2)(A) is even farther afield, because the relevant statutory language provides that, upon establishing an intentional or willful violation, a "person" shall "be entitled to receive [no] less than the sum of $1,000." Relief is not restricted to a sub-class of "person[s]"-those "entitled to recovery" of actual damages. In any event, petitioner acknowledges (Br. 22) that "[n]o court has interpreted this provision."

12 The courts of appeals uniformly have held that the "adverse effect" requirement speaks to an individual's standing to bring suit under the Privacy Act. See Pet. App. 18a n.7; Orekoya v. Mooney, 330 F.3d 1, 7 (1st Cir. 2003); Quinn v. Stone, 978 F.2d 126, 135-136 (3d Cir. 1992); Johnson v. Department of the Treasury, IRS, 700 F.2d 971, 976-977 & n.9 (5th Cir. 1983); cf. Albright v. United States, 732 F.2d 181, 186 (D.C. Cir. 1984); Parks v. IRS, 618 F.2d 677, 682-683 & n.2 (10th Cir. 1980).

13 See Dist. Ct. Mem. Op. (Mar. 18, 1998); see also Office of Mgmt. & Budget, Privacy Act Guidelines, 40 Fed. Reg. 28,968 (1975) (individuals may pursue civil remedies for Privacy Act violations under 5 U.S.C. 552a(g) as well as "judicial review under other provisions of the Administrative Procedure Act"). Such a suit is permissible, notwithstanding the Privacy Act's independent remedial scheme, because the Privacy Act itself is part of the Administrative Procedure Act. The Privacy Act's provisions principally derive from the House bill (H.R. 16373, 93d Cong., 2d Sess. (1974)). Compare H.R. 16373, supra, and 120 Cong. Rec. 40,398-40,400 (1974), with id. at 40,400-40,405 (compromise text). The House Bill was designed to protect personal privacy "within the framework of the Freedom of Information Act (5 U.S.C. 552)," H.R. Rep. No. 1416, 93d Cong., 2d Sess. 2 (1974), which itself was enacted as an amendment to Section 3 of the Administrative Procedure Act (Act of June 11, 1946, ch. 324, § 3, 60 Stat. 238). See Department of Justice v. Reporters Comm. for Freedom of the Press, 489 U.S. 749, 754 (1989). To do so, H.R. 16373 proposed amending Title 5 of the U.S. Code by inserting a Section 552a within the codified provisions of the Administrative Procedure Act immediately after the Freedom of Information Act. See H.R. Rep. No. 1416, supra, at 1, 27; Privacy Act of 1974, Pub. L. No. 93-579, §§ 3-4, 88 Stat. 1897-1905.

14 See Restatement (First) of Torts § 621 cmt. a (1939) (defamation); id. § 867 cmt. d (privacy tort); Johnson v. Department of Treasury, IRS, 700 F.2d 971, 982 & n.31 (5th Cir. 1983); cf. Gertz v. Robert Welch, Inc., 418 U.S. 323, 349 (1974) (defamation).

15 A memorandum (the origins of which are unclear) placed in the legislative record by Senator Ervin on the day that the Senate passed its version of the Privacy Act called for "a provision for liquidated damages of say $1,000." 120 Cong. Rec. at 36,891 (Sen. Ervin). No such "liquidated damages" provision ever appeared. See id. at 36,917, 36,921. Instead, the next day, the Senate passed an amendment to both the House and Senate bills that added a provision for "actual and general damages sustained by any person but in no case shall a person entitled to recovery receive less than the sum of $1,000." See H.R. 16373, supra, § 303(c)(1) (Nov. 22, 1974) (as passed by the Senate); see also 120 Cong. Rec. at 37,085 (Sen. Byrd) (amending engrossed Senate bill, S. 3418, supra). Petitioner contends (Br. 30) that the amendment must have been a response to the call in the memorandum submitted by Senator Ervin for liquidated damages. Because all prior Senate bills authorizing liquidated damages had explicitly identified the payments as "liquidated damages" or as "actual damages * * * plus" a specific dollar award, S. 2810, supra, § 7(c)(1); S. 3633, supra, § 11(b)(1); S. 2963, supra, § 308(e), consistent with the longstanding legislative practice discussed at pages 30-32, supra, the better reading of the amendment is that the "person entitled to recovery" of $1000 was the person who had proven actual or general damages. In any event, never-enacted language that simply "provides an unanswered question" does not suffice to demonstrate that the "law is clear." BFP, 511 U.S. at 547.

16 The congressional proponents of a broader bill were under considerable pressure to defer their more controversial provisions. Had Congress failed to reach a compromise in the few remaining weeks after its Thanksgiving recess, it was understood that President Ford planned to issue an executive order "nearly identical" to the House bill, but containing no civil remedies at all, and, by doing so, to "steal the thunder" of privacy reform from the Congress. See 120 Cong. Rec. at 35,763; id. at 36,644 (Rep. Moorhead).

17 See also 120 Cong. Rec. at 36,895 (Sen. Percy) ("This bill is certainly not the final word on privacy. There will be additional laws needed to solve particular problems * * *. But this bill is a historic beginning."); id. at 36,967 (Rep. Moorhead) ("It is not a perfect bill: But it is a start and an important first step in the right direction."); ibid. (Rep. Holifield) ("It may not be as complete as some would want."); Privacy Act of 1974: Statement by the President upon Signing the Bill into Law, 11 Weekly Comp. Pres. Doc. 8 (Jan. 1, 1975) (noting that there will be "continuing legislative and executive efforts to reassess the proper balance between the privacy interests of the individual and those of society").

18 Indeed, even though it was the Senate that pressed for the most generous damages relief, the Senate itself rejected liquidated damages provisions of only $100. See S. 2810, supra, § 7(c)(1); S. 3633, supra, § 11(b)(1). It thus is implausible that a compromise with the more fiscally restrictive House version of the legislation would produce a liquidated damages provision ten times what the Senate itself had refused to enact.

19 Even though relief is restricted to those who have suffered actual damages, the monetary remedies provided by the Privacy Act are not parsimonious compared with the remedies available for other statutory violations. The Administrative Procedure Act, which provides the usual basis for challenging federal agency action, specifically excludes "money damages" from the available forms of relief. 5 U.S.C. 702. In suits against the United States, the availability of retrospective monetary relief is therefore the exception rather than the rule. To permit monetary awards even without proof of actual damages would be more unusual still. Though Congress has, on occasion, authorized such awards (see p. 34, supra), a decision to do so cannot be said to follow naturally or typically from Congress's decision to prohibit particular agency conduct.

APPENDIX A

Section 552a of Title 5, United States Code, provides in pertinent part as follows:

Records maintained on individuals

(a) DEFINITIONS.-For purposes of this section-

(1) the term "agency" means agency as defined in section 552(e) of this title;

(2) the term "individual" means a citizen of the United States or an alien lawfully admitted for permanent residence;

(3) the term "maintain" includes maintain, collect, use, or disseminate;

(4) the term "record" means any item, collection, or grouping of information about an individual that is maintained by an agency, including, but not limited to, his education, financial transactions, medical history, and criminal or employment history and that contains his name, or the identifying number, symbol, or other identifying particular assigned to the individual, such as a finger or voice print or a photograph;

(5) the term "system of records" means a group of any records under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual;

(6) the term "statistical record" means a record in a system of records maintained for statistical research or reporting purposes only and not used in whole or in part in making any determination about an identifiable individual, except as provided by section 8 of title 13;

(7) the term "routine use" means, with respect to the disclosure of a record, the use of such record for a purpose which is compatible with the purpose for which it was collected;

* * * * *

(b) CONDITIONS OF DISCLOSURE.-No agency shall disclose any record which is contained in a system of records by any means of communication to any person, or to another agency, except pursuant to a written request by, or with the prior written consent of, the individual to whom the record pertains, unless disclosure of the record would be-

(1) to those officers and employees of the agency which maintains the record who have a need for the record in the performance of their duties;

(2) required under section 552 of this title;

(3) for a routine use as defined in subsection (a)(7) of this section and described under subsection (e)(4)(D) of this section;

(4) to the Bureau of the Census for purposes of planning or carrying out a census or survey or related activity pursuant to the provisions of title 13;

(5) to a recipient who has provided the agency with advance adequate written assurance that the record will be used solely as a statistical research or reporting record, and the record is to be transferred in a form that is not individually identifiable;

(6) to the National Archives and Records Administration as a record which has sufficient historical or other value to warrant its continued preservation by the United States Government, or for evaluation by the Archivist of the United States or the designee of the Archivist to determine whether the record has such value;

(7) to another agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States for a civil or criminal law enforcement activity if the activity is authorized by law, and if the head of the agency or instrumentality has made a written request to the agency which maintains the record specifying the particular portion desired and the law enforcement activity for which the record is sought;

(8) to a person pursuant to a showing of compelling circumstances affecting the health or safety of an individual if upon such disclosure notification is transmitted to the last known address of such individual;

(9) to either House of Congress, or, to the extent of matter within its jurisdiction, any committee or subcommittee thereof, any joint committee of Congress or subcommittee of any such joint committee;

(10) to the Comptroller General, or any of his authorized representatives, in the course of the performance of the duties of the General Accounting Office;

(11) pursuant to the order of a court of competent jurisdiction; or

(12) to a consumer reporting agency in accordance with section 3711(e) of title 31.

* * * * *

(d) ACCESS TO RECORDS.-Each agency that maintains a system of records shall-

(1) upon request by any individual to gain access to his record or to any information pertaining to him which is contained in the system, permit him and upon his request, a person of his own choosing to accompany him, to review the record and have a copy made of all or any portion thereof in a form comprehensible to him, except that the agency may require the individual to furnish a written statement authorizing discussion of that individual's record in the accompanying person's presence;

(2) permit the individual to request amendment of a record pertaining to him and-

(A) not later than 10 days (excluding Saturdays, Sundays, and legal public holidays) after the date of receipt of such request, acknowledge in writing such receipt; and

(B) promptly, either-

(i) make any correction of any portion thereof which the individual believes is not accurate, relevant, timely, or complete; or

(ii) inform the individual of its refusal to amend the record in accordance with his request, the reason for the refusal, the procedures established by the agency for the individual to request a review of that refusal by the head of the agency or an officer designated by the head of the agency, and the name and business address of that official;

(3) permit the individual who disagrees with the refusal of the agency to amend his record to request a review of such refusal, and not later than 30 days (excluding Saturdays, Sundays, and legal public holidays) from the date on which the individual requests such review, complete such review and make a final determination unless, for good cause shown, the head of the agency extends such 30-day period; and if, after his review, the reviewing official also refuses to amend the record in accordance with the request, permit the individual to file with the agency a concise statement setting forth the reasons for his disagreement with the refusal of the agency, and notify the individual of the provisions for judicial review of the reviewing official's determination under subsection (g)(1)(A) of this section;

(4) in any disclosure, containing information about which the individual has filed a statement of disagreement, occurring after the filing of the statement under paragraph (3) of this subsection, clearly note any portion of the record which is disputed and provide copies of the statement and, if the agency deems it appropriate, copies of a concise statement of the reasons of the agency for not making the amendments requested, to persons or other agencies to whom the disputed record has been disclosed; and

(5) nothing in this section shall allow an individual access to any information compiled in reasonable anticipation of a civil action or proceeding.

(e) AGENCY REQUIREMENTS.-Each agency that maintains a system of records shall-

(1) maintain in its records only such information about an individual as is relevant and necessary to accomplish a purpose of the agency required to be accomplished by statute or by executive order of the President;

(2) collect information to the greatest extent practicable directly from the subject individual when the information may result in adverse determinations about an individual's rights, benefits, and privileges under Federal programs;

(3) inform each individual whom it asks to supply information, on the form which it uses to collect the information or on a separate form that can be retained by the individual-

(A) the authority (whether granted by statute, or by executive order of the President) which authorizes the solicitation of the information and whether disclosure of such information is mandatory or voluntary;

(B) the principal purpose or purposes for which the information is intended to be used;

(C) the routine uses which may be made of the information, as published pursuant to paragraph (4)(D) of this subsection; and

(D) the effects on him, if any, of not providing all or any part of the requested information;

(4) subject to the provisions of paragraph (11) of this subsection, publish in the Federal Register upon establishment or revision a notice of the existence and character of the system of records, which notice shall include-

(A) the name and location of the system;

(B) the categories of individuals on whom records are maintained in the system;

(D) each routine use of the records contained in the system, including the categories of users and the purpose of such use;

(E) the policies and practices of the agency regarding storage, retrievability, access controls, retention, and disposal of the records;

(F) the title and business address of the agency official who is responsible for the system of records;

(G) the agency procedures whereby an individual can be notified at his request if the system of records contains a record pertaining to him;

(H) the agency procedures whereby an individual can be notified at his request how he can gain access to any record pertaining to him contained in the system of records, and how he can contest its content; and

(I) the categories of sources of records in the system;

(5) maintain all records which are used by the agency in making any determination about any individual with such accuracy, relevance, timeliness, and completeness as is reasonably necessary to assure fairness to the individual in the determination;

(6) prior to disseminating any record about an individual to any person other than an agency, unless the dissemination is made pursuant to subsection (b)(2) of this section, make reasonable efforts to assure that such records are accurate, complete, timely, and relevant for agency purposes;

(7) maintain no record describing how any individual exercises rights guaranteed by the First Amendment unless expressly authorized by statute or by the individual about whom the record is maintained or unless pertinent to and within the scope of an authorized law enforcement activity;

(8) make reasonable efforts to serve notice on an individual when any record on such individual is made available to any person under compulsory legal process when such process becomes a matter of public record;

(9) establish rules of conduct for persons involved in the design, development, operation, or maintenance of any system of records, or in maintaining any record, and instruct each such person with respect to such rules and the requirements of this section, including any other rules and procedures adopted pursuant to this section and the penalties for noncompliance;

(10) establish appropriate administrative, technical, and physical safeguards to insure the security and confidentiality of records and to protect against any anticipated threats or hazards to their security or integrity which could result in substantial harm, embarrassment, inconvenience, or unfairness to any individual on whom information is maintained;

(11) at least 30 days prior to publication of information under paragraph (4)(D) of this subsection, publish in the Federal Register notice of any new use or intended use of the information in the system, and provide an opportunity for interested persons to submit written data, views, or arguments to the agency; and

(12) if such agency is a recipient agency or a source agency in a matching program with a non-Federal agency, with respect to any establishment or revision of a matching program, at least 30 days prior to conducting such program, publish in the Federal Register notice of such establishment or revision.

(f) AGENCY RULES.-In order to carry out the provisions of this section, each agency that maintains a system of records shall promulgate rules, in accordance with the requirements (including general notice) of section 553 of this title, which shall-

(1) establish procedures whereby an individual can be notified in response to his request if any system of records named by the individual contains a record pertaining to him;

(2) define reasonable times, places, and requirements for identifying an individual who requests his record or information pertaining to him before the agency shall make the record or information available to the individual;

(3) establish procedures for the disclosure to an individual upon his request of his record or information pertaining to him, including special procedure, if deemed necessary, for the disclosure to an individual of medical records, including psychological records, pertaining to him;

(4) establish procedures for reviewing a request from an individual concerning the amendment of any record or information pertaining to the individual, for making a determination on the request, for an appeal within the agency of an initial adverse agency determination, and for whatever additional means may be necessary for each individual to be able to exercise fully his rights under this section; and

(5) establish fees to be charged, if any, to any individual for making copies of his record, excluding the cost of any search for and review of the record.

The Office of the Federal Register shall biennially compile and publish the rules promulgated under this subsection and agency notices published under subsection (e)(4) of this section in a form available to the public at low cost.

(g)(1) CIVIL REMEDIES.-Whenever any agency

(A) makes a determination under subsection (d)(3) of this section not to amend an individual's record in accordance with his request, or fails to make such review in conformity with that subsection;

(B) refuses to comply with an individual request under subsection (d)(1) of this section;

(D) fails to comply with any other provision of this section, or any rule promulgated thereunder, in such a way as to have an adverse effect on an individual,

the individual may bring a civil action against the agency, and the district courts of the United States shall have jurisdiction in the matters under the provisions of this subsection.

(A) actual damages sustained by the individual as a result of the refusal or failure, but in no case shall a person entitled to recovery receive less than the sum of $1,000; and

(B) the costs of the action together with reasonable attorney fees as determined by the court.

* * * * *

(i)(1) CRIMINAL PENALTIES.-Any officer or employee of an agency, who by virtue of his employment or official position, has possession of, or access to, agency records which contain individually identifiable information the disclosure of which is prohibited by this section or by rules or regulations established thereunder, and who knowing that disclosure of the specific material is so prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000.

(2) Any officer or employee of any agency who willfully maintains a system of records without meeting the notice requirements of subsection (e)(4) of this section shall be guilty of a misdemeanor and fined not more than $5,000.

(3) Any person who knowingly and willfully requests or obtains any record concerning an individual from an agency under false pretenses shall be guilty of a misdemeanor and fined not more than $5,000.

* * * * *

(v) OFFICE OF MANAGEMENT AND BUDGET RESPONSIBILITIES.-The Director of the Office of Management and Budget shall-

(1) develop and, after notice and opportunity for public comment, prescribe guidelines and regulations for the use of agencies in implementing the provisions of this section; and

(2) provide continuing assistance to and oversight of the implementation of this section by agencies.

APPENDIX B

The Privacy Act of 1974, Pub. L. No. 93-579, 88 Stat. 1896 (reproduced in part at 5 U.S.C. 552a note), provides in pertinent part as follows:

SEC. 2 (a) The Congress finds that-

(1) the privacy of an individual is directly affected by the collection, maintenance, use, and dissemination of personal information by Federal agencies;

(2) the increasing use of computers and sophisticated information technology, while essential to the efficient operations of the Government, has greatly magnified the harm to individual privacy that can occur from any collection, maintenance, use, or dissemination of personal information;

(3) the opportunities for an individual to secure employment, insurance, and credit, and his right to due process, and other legal protections are endangered by the misuse of certain information systems;

(4) the right to privacy is a personal and fundamental right protected by the Constitution of the United States; and

(5) in order to protect the privacy of individuals identified in information systems maintained by Federal agencies, it is necessary and proper for the Congress to regulate the collection, maintenance, use, and dissemination of information by such agencies.

(b) The purpose of this Act is to provide certain safeguards for an individual against an invasion of personal privacy by requiring Federal agencies, except as otherwise provided by law, to-

(1) permit an individual to determine what records pertaining to him are collected, maintained, used, or disseminated by such agencies;

(2) permit an individual to prevent records pertaining to him obtained by such agencies for a particular purpose from being used or made available for another purpose without his consent;

(3) permit an individual to gain access to information pertaining to him in Federal agency records, to have a copy made of all or any portion thereof, and to correct or amend such records;

(4) collect, maintain, use, or disseminate any record of identifiable personal information in a manner that assures that such action is for a necessary and lawful purpose, that the information is current and accurate for its intended use, and that adequate safeguards are provided to prevent misuse of such information;

(5) permit exemptions from the requirements with respect to records provided in this Act only in those cases where there is an important public policy need for such exemption as has been determined by specific statutory authority; and

(6) be subject to civil suit for any damages which occur as a result of willful or intentional action which violates any individual's rights under this Act.

* * * * *

SEC. 5. (a)(1) There is established a Privacy Protection Study Commision (hereinafter referred to as the "Commission" which shall be composed of seven members as follows:

(A) three appointed by the President of the United States,

(B) two appointed by the President of the Senate, and

* * * * *

(b) The Commission shall-

(1) make a study of the data banks, automated data processing programs, and information systems of governmental, regional, and private organizations, in order to determine the standards and procedures in force for the protection of personal information; and

(2) recommend to the President and the Congress the extent, if any, to which the requirements and principles of section 552a of title 5, United States Code, should be applied to the information practices of those organizations by legislation, administrative action, or voluntary adoption of such requirements and principles, and report on such other legislative recommendations as it may determine to be necessary to protect the privacy of individuals while meeting the legitimate needs of government and society for information.

* * * * *

(2) * * *

(B) The Commisson shall include in its examination a study of-

* * * * *

(iii) whether the Federal Government should be liable for general damages incurred by an individual as the result of a willful or intentional violation of the provisions of sections 552a(g)(1)(C) or (D) of title 5, United States Code[.]

* * * * *

SEC. 7. (a)(1) It shall be unlawful for any Federal, State or local government agency to deny to any individual any right, benefit, or privilege provided by law because of such individual's refusal to disclose his social security account number.

(2) the provisions of paragraph (1) of this subsection shall not apply with respect to-

(A) any disclosure which is required by Federal statute, or

(B) the disclosure of a social security number to any Federal, State, or local agency maintaining a system of records in existence and operating before January 1, 1975, if such disclosure was required under statute or regulation adopted prior to such date to verify the identity of an individual.

(b) Any Federal, State, or local government agency which requests an individual to disclose his social security account number shall inform that individual whether that disclosure is mandatory or voluntary, by what statutory or other authority such number is solicited, and what uses will be made of it.

Brief

2002-1377.mer.aa.pdf [PDF, ]

Updated October 21, 2014