CONDITIONS OF DISCLOSURE TO THIRD PARTIES

B. Twelve Exceptions to the "No Disclosure Without Consent" Rule

3. 5 U.S.C. § 552a(b)(3) (routine uses)

"for a routine use as defined in subsection (a)(7) of this section and described under subsection (e)(4)(D)."

Cross-references:

Subsection (e)(4)(D) requires Federal Register publication of "each routine use of the records contained in the system, including the categories of users and the purpose of such use."

Subsection (a)(7) defines the term "routine use" to mean "with respect to the disclosure of a record, the use of such record for a purpose which is compatible with the purpose for which it was collected."

comment --

The routine use exception, because of its potential breadth, is one of the most controversial provisions in the Act. See Privacy Commission Report at 517-18. The trend in recent cases is toward a narrower construction of the exception. President Clinton directed the Office of Management and Budget to issue additional guidance regarding the routine use exception in an executive memorandum on privacy issued two years ago. Memorandum on Privacy and Personal Information in Federal Records, 34 Weekly Comp. Pres. Doc. 870 (May 14, 1998), available in Westlaw, 1998 WL 241263 (May 14, 1998).

By its terms, this exception sets forth two requirements for a proper routine use disclosure: (1) Federal Register publication, thereby providing constructive notice; and (2) compatibility. See Britt v. Naval Investigative Serv., 886 F.2d 544, 547-50 (3d Cir. 1989); Shannon v. General Elec. Co., 812 F. Supp. 308, 316 (N.D.N.Y. 1993).

However, the Court of Appeals for the Ninth Circuit has engrafted a third requirement onto this exception: Actual notice of the routine use under subsection (e)(3)(C) (i.e., at the time of information collection from the individual). Covert v. Harrington, 876 F.2d 751, 754-56 (9th Cir. 1989) (discussed below). Subsequently, the Court of Appeals for the District of Columbia Circuit cited this aspect of Covert with approval and remanded a case for determination as to whether (e)(3)(C) notice was provided, stating that "[a]lthough the statute itself does not provide, in so many terms, that an agency's failure to provide employees with actual notice of its routine uses would prevent a disclosure from qualifying as a 'routine use,' that conclusion seems implicit in the structure and purpose of the Act." United States Postal Serv. v. National Ass'n of Letter Carriers, 9 F.3d 138, 146 (D.C. Cir. 1993).

Federal Register Constructive Notice

The routine use exception's notice requirement "is intended to serve as a caution to agencies to think out in advance what uses [they] will make of information." 120 Cong. Rec. 40,881 (1974), reprinted in Source Book at 987. Indeed, it is possible for a routine use to be deemed facially invalid if it fails to satisfy subsection (e)(4)(D)--i.e., if it does not specify "the categories of users and the purpose of such use." See Britt, 886 F.2d at 547-48 (dictum) (suggesting that routine use (50 Fed. Reg. 22,802-03 (1985)) permitting disclosure to "federal regulatory agencies with investigative units" is overbroad as it "does not provide adequate notice to individuals as to what information concerning them will be released and the purposes of such release"); cf. Krohn v. United States Dep't of Justice, No. 78-1536, slip op. at 4-7 (D.D.C. Mar. 19, 1984) ("to qualify as a 'routine use,' the agency must . . . publish in the Federal Register . . . 'each routine use of the records contained in the system, including the categories of users and the purpose of such use'"), reconsideration granted & vacated in nonpertinent part (D.D.C. Nov. 29, 1984) (discussed below).

It is well settled that the "scope of [a] routine use is confined to the published definition." Doe v. Naval Air Station, Pensacola, Fla., 768 F.2d 1229, 1231 (11th Cir. 1985); see also Parks v. IRS, 618 F.2d 677, 681-82 (10th Cir. 1980); Quilico v. United States Navy, No. 80-C-3568, 1983 U.S. Dist. LEXIS 14090, at **9-12 (N.D. Ill. Sept. 2, 1983); Local 2047, AFGE v. Defense Gen. Supply Ctr., 423 F. Supp. 481, 484-86 (E.D. Va. 1976), aff'd, 573 F.2d 184 (4th Cir. 1978). In other words, a particular disclosure is unauthorized if it does not fall within the clear terms of the routine use. See, e.g., Swenson v. United States Postal Serv., 890 F.2d 1075, 1078 (9th Cir. 1989) (47 Fed. Reg. 1203 (1982) held inapplicable to agency's disclosure of record referencing employee's EEO complaints to her congressmen as their inquiries were not "made at the request of" employee); Tijerina v. Walters, 821 F.2d 789, 798 (D.C. Cir. 1987) (47 Fed. Reg. 24,012 (1982) held inapplicable to VA's unsolicited letter notifying state board of bar examiners of possible fraud committed by bar applicant because no violation of state law was "reasonably imminent," and letter was not in response to "official request"); Doe v. DiGenova, 779 F.2d 74, 86 (D.C. Cir. 1985) (43 Fed. Reg. 44,743 (1978) held inapplicable to VA psychiatric report because disclosed record itself did not "indicate a potential violation of law"); Greene v. VA, No. C-76-461-S, slip op. at 3-6 (M.D.N.C. July 3, 1978) (40 Fed. Reg. 38,105 (1975) held inapplicable to VA's disclosure of medical evaluation to state licensing bureau because routine use permitted disclosure only to facilitate VA decision); see also Covert, 667 F. Supp. at 736-39 (discussed below).

Note that an agency's construction of its routine use should be entitled to deference. See Department of the Air Force, Scott Air Force Base, Ill. v. FLRA, 104 F.3d 1396, 1402 (D.C. Cir. 1997); FLRA v. United States Dep't of the Treasury, 884 F.2d 1446, 1455-56 (D.C. Cir. 1989). But see NLRB v. United States Postal Serv., 790 F. Supp. 31, 33 (D.D.C. 1992) (rejecting Postal Service's interpretation of its own routine use).

Compatibility

The precise meaning of the term "compatible" is quite uncertain and must be assessed on a case-by-case basis. According to OMB, the "compatibility" concept encompasses (1) functionally equivalent uses, and (2) other uses that are necessary and proper. OMB Guidelines, 52 Fed. Reg. 12,990, 12,993 (1987).

The leading case on "compatibility" is Britt v. Naval Investigative Serv., 886 F.2d at 547-50, in which the Court of Appeals for the Third Circuit ruled that the Naval Investigative Service's gratuitous disclosure of records, describing a then-pending criminal investigation of a Marine Corps reservist, to that individual's civilian employer (the Immigration and Naturalization Service), was not "compatible" with the "case-specific purpose for collecting" such records. Id. In holding that the employment/suitability purpose for disclosure was incompatible with the criminal law enforcement purpose for collection, the Third Circuit deemed it significant that "the [Immigration and Naturalization Service] was not conducting its own criminal investigation of the same activity or any other activity" by the subject, and that the records at issue concerned "merely a preliminary investigation with no inculpatory findings." Id. at 549-50. Employing especially broad language, the Third Circuit pointedly condemned the agency's equating of "compatibility" with mere "relevance" to the recipient entity, observing that "[t]here must be a more concrete relationship or similarity, some meaningful degree of convergence, between the disclosing agency's purpose in gathering the information and in its disclosure." Id. (citing Covert, 876 F.2d at 755 (dictum); Mazaleski v. Truesdale, 562 F.2d 701, 713 n.31 (D.C. Cir. 1977) (dictum)); accord Swenson, 890 F.2d at 1078; cf. Quinn v. Stone, 978 F.2d 126, 139 (3d Cir. 1992) (Nygaard, J., dissenting) (concluding that disclosure was authorized by routine use because disclosure was compatible with one of the purposes for collection, even if not with main purpose for collection).

More recently, the D.C. Circuit interpreted the term "compatibility" in considering a routine use providing for disclosure to labor organizations as part of the collective bargaining process. The court stated that application of the "common usage" of the word would require simply that "a proposed disclosure would not actually frustrate the purposes for which the information was gathered." United States Postal Serv. v. National Ass'n of Letter Carriers, 9 F.3d 138, 144 (D.C. Cir. 1993). The D.C. Circuit recognized the "far tighter nexus" that was required by the Third and Ninth Circuits in Britt and Swenson, and that is consistent with the legislative history, but stated:

Whatever the merit of the decisions of prior courts that have held . . . that a finding of a substantial similarity of purpose might be appropriate in the non-labor law context in order to effectuate congressional intent, the compatibility requirement imposed by section 552a(a)(7) cannot be understood to prevent an agency from disclosing to a union information as part of the collective bargaining process.

Id. at 145. In a concurring opinion, Judge Williams agreed with the disposition of the case, but noted that he did not share the "belief that the meaning of 'compatible' . . . may depend on the identity of the entity to which the information is being disclosed." Id. at 147 n.1 (Williams, J., concurring). Rather, seeing "no conflict between the purposes for which the information was collected and those for which it will be disclosed," he found the disclosure compatible without further inquiry. Id. at 146-47.

There are two examples of "compatible" routine uses that frequently occur in the law enforcement context. First, in the context of investigations/prosecutions, law enforcement agencies may routinely share law enforcement records with each other. See OMB Guidelines, 40 Fed. Reg. at 28,955 (proper routine use is "transfer by a law enforcement agency of protective intelligence information to the Secret Service"); see also 28 U.S.C. § 534 (1994 & Supp. III 1997) (authorizing Attorney General to exchange criminal records with "authorized officials of the Federal Government, the States, cities, and penal and other institutions"). Second, agencies may routinely disclose any records indicating a possible violation of law (regardless of the purpose for collection) to law enforcement agencies for purposes of investigation/prosecution. See OMB Guidelines, 40 Fed. Reg. at 28,953; 120 Cong. Rec. 36,967, 40,884 (1974), reprinted in Source Book at 957-58, 995 (remarks of Congressman Moorhead); see also 28 U.S.C. § 535(b) (1994) (requiring agencies of the executive branch to expeditiously report "[a]ny information, allegation, or complaint" relating to crimes involving government officers and employees to United States Attorney General). These kinds of routine uses have been criticized on the ground that they circumvent the more restrictive requirements of subsection (b)(7). See Privacy Commission Report at 517-18; see also Britt, 886 F.2d at 548 n.1 (dictum); Covert, 667 F. Supp. at 739, 742 (dictum). Yet they have never been successfully challenged on that basis. Cf. Nwangoro v. Department of the Army, 952 F. Supp. 394, 398 (N.D. Tex. 1996) (disclosure by Military Police of financial records obtained in ongoing criminal investigation to foreign customs officials likewise involved in investigation of possible infractions of foreign tax and customs laws was "permitted by the 'routine use' exception and d[id] not constitute a violation of the Privacy Act"); Little v. FBI, 793 F. Supp. 652, 655 (D. Md. 1992) (disclosure did not violate Privacy Act prohibition because it was made pursuant to routine use that allows disclosure of personnel matters to other government agencies when directly related to enforcement function of recipient agency), aff'd on other grounds, 1 F.3d 255 (4th Cir. 1993).

In Covert v. Harrington, 667 F. Supp. at 736-39, however, the district court held that a routine use permitting the Department of Energy's Inspector General to disclose to the Justice Department relevant records when "a record" indicates a potential violation of law, 47 Fed. Reg. 14,333 (1982), did not permit the disclosure of personnel security questionnaires submitted by the plaintiffs because such questionnaires did not on their face reveal potential violations of law. The court rejected the agency's argument that disclosure was proper because each questionnaire was disclosed as part of a prosecutive report that (when viewed as a whole) did reveal a potential violation of law. Id. at 736-37. Further, the court found that the Inspector General's disclosure of the questionnaires to the Justice Department (for a criminal fraud prosecution) was not compatible with the purpose for which they were originally collected by the Department of Energy (for a security-clearance eligibility determination), notwithstanding the fact that the questionnaires were subsequently acquired by the Inspector General--on an intra-agency "need to know" basis pursuant to 5 U.S.C. § 552a(b)(1)--for the purpose of a fraud investigation. Id. at 737-39.

On cross-appeals, a divided panel of the Court of Appeals for the Ninth Circuit affirmed the district court's judgment on other grounds. Covert, 876 F.2d at 754-56. The panel majority held that the Department of Energy's failure to provide actual notice of the routine use on the questionnaires at the time of original collection, under subsection (e)(3)(C), precluded the Department of Energy from later invoking that routine use under subsection (b)(3). Id. at 755-56; see also United States Postal Serv. v. National Ass'n of Letter Carriers, 9 F.3d at 146 (citing Covert with approval and remanding case for factual determination as to whether (e)(3)(C) notice was given). No other court had ever so held. See the additional discussion under subsection (e)(3), below.

In Doe v. Stephens, 851 F.2d 1457, 1465-67 (D.C. Cir. 1988), the Court of Appeals for the District of Columbia Circuit held that a VA routine use--permitting disclosure of records "in order for the VA to respond to and comply with the issuance of a federal subpoena [47 Fed. Reg. 51,841 (1982)]"--was invalid under the Administrative Procedure Act because it was inconsistent with the Privacy Act as interpreted in Doe v. DiGenova, 779 F.2d at 78-84--where the court had found that disclosures pursuant to subpoenas were not permitted by the subsection (b)(11) court order exception. In light of Doe v. Stephens, the decision in Fields v. Leuver, No. 83-0967, slip op. at 5-7 (D.D.C. Sept. 22, 1983) (upholding routine use permitting disclosure of payroll records "in response to a court subpoena"), is unreliable. But cf. Osborne v. United States Postal Serv., No. 94-30353, slip op. at 6-9 (N.D. Fla. May 18, 1995) (holding on alternative ground that disclosure of plaintiff's injury-compensation file to retired employee who had prepared file and who had been subpoenaed by plaintiff and was expecting to be deposed on matters documented in file was proper pursuant to routine use that "'specifically contemplates that information may be released in response to relevant discovery and that any manner of response allowed by the rules of the forum may be employed'").

A particular area of controversy concerns whether the routine use exception can be invoked to publicly file records in court. The Act's legislative history recognizes the "compatibility" of this type of disclosure. See 120 Cong. Rec. 40,405, 40,884 (1974), reprinted in Source Book at 858, 995 (routine use appropriate where Justice Department "presents evidence [tax information from IRS] against the individual" in court); see also Schuenemeyer v. United States, No. SA-85-773, slip op. at 4 (W.D. Tex. Mar. 31, 1988) (permitting disclosure of litigant's medical records to Justice Department and U.S. Claims Court for use "in preparing the position of the USAF before the [court]").

In Krohn, No. 78-1536, slip op. at 4-7 (D.D.C. Mar. 19, 1984), however, the court invalidated an FBI routine use allowing for "dissemination [of records] during appropriate legal proceedings," finding that such a routine use was impermissibly "vague" and was "capable of being construed so broadly as to encompass all legal proceedings." In response to Krohn, OMB issued guidance to agencies in which it suggested a model routine use--employing a "relevant and necessary to the litigation" standard--to permit the public filing of protected records with a court. OMB Memorandum for the Senior Agency Officials for Information Resources Management 2-4 (May 24, 1985) (unpublished). Many agencies, including the Justice Department, have adopted "post-Krohn" routine uses designed to authorize the public filing of relevant records in court. See, e.g., 63 Fed. Reg. 8665, 8666 (1998) (routine use [number 7] applicable to records in Justice Department's "Civil Division Case File System"); 63 Fed. Reg. 8666, 8667-68 (1998) (routine uses [letters "o" and "p"] applicable to records in U.S. Attorney's Office's "Civil Case Files").

It should be noted that none of the "post-Krohn" routine uses--such as the ones cited above which employ an "arguably relevant to the litigation" standard--have yet been successfully challenged in the courts. Cf. Russell v. GSA, 935 F. Supp. 1142, 1145-46 (D. Colo. 1996) (without analyzing propriety of routine use, finding disclosure in public pleadings of information regarding investigation of plaintiff was permissible under routine use providing for disclosure in proceeding before court where agency is party and records are determined "to be arguably relevant to the litigation"); Osborne, No. 94-30353, slip op. at 6-9 (N.D. Fla. May 18, 1995) (holding on alternative ground that disclosure of plaintiff's injury-compensation file to retired employee who had prepared file and who had been subpoenaed by plaintiff and was expecting to be deposed on matters documented in file was proper pursuant to routine use providing for disclosures "incident to litigation" and "in a proceeding before a court" because "deposition was a proceeding before [the] Court"); Sheptin v. United States Dep't of Justice, No. 91-2806, 1992 U.S. Dist. LEXIS 6221, at **6-7 (D.D.C. Apr. 30, 1992) (no wrongful disclosure where agency routine uses permit use of presentence report during course of habeas proceeding). Such challenges may be expected, either based upon an argument that the routine use does not satisfy the "compatibility" requirement of subsection (a)(7) of the Act, cf. Britt, 886 F.2d at 547-50 (mere "relevance" to recipient entity held to be improper standard for a "compatible" routine use disclosure), or based upon an argument that the routine use effectively circumvents the more restrictive, privacy-protective requirements of subsection (b)(11), cf. Doe v. Stephens, 851 F.2d at 1465-67 (agency cannot use routine use exception to disclose records in response to subpoena where court had earlier ruled that such disclosure was improper under subsection (b)(11)).

Numerous types of information sharing between agencies and with organizations or individuals have been upheld as valid routine uses. See, e.g., Pippinger v. Rubin, 129 F.3d 519, 531-32 (10th Cir. 1997) (disclosure of plaintiff's personnel information to MSPB in deposition testimony in another individual's related MSPB proceeding, and to the other individual, his attorney, and court reporter in conjunction with MSPB proceeding); Taylor v. United States, 106 F.3d 833, 836-37 (8th Cir. 1997) (disclosure of federal taxpayer information collected for purpose of federal tax administration to state tax officials for purpose of state tax administration), aff'g Taylor v. IRS, 186 B.R. 441, 446-47, 453-54 (N.D. Iowa 1995); Mount v. United States Postal Serv., 79 F.3d 531, 534 (6th Cir. 1996) (disclosure of plaintiff's medical information to union official representing him in administrative action in which his mental health was central issue); Alphin v. FAA, No. 89-2405, 1990 WL 52830, at *1 (4th Cir. Apr. 13, 1990) (disclosure of enforcement investigation final report to subject's customers); Hastings v. Judicial Conference of the United States, 770 F.2d 1093, 1104 (D.C. Cir. 1985) (disclosure of criminal investigative records to judicial committee investigating judge); United States v. Miller, 643 F.2d 713, 715 (10th Cir. 1981) (records submitted by individual to parole officer became part of Justice Department files and Department's use in criminal investigation constitutes routine use); United States v. Collins, 596 F.2d 166, 168 (6th Cir. 1979) (HEW's disclosure of plaintiff's Medicaid cost reports to Justice Department for use in criminal case against plaintiff); Puerta v. HHS, No. EDCV 94-0148, slip op. at 7 (C.D. Cal. Jan. 5, 1999) (disclosure of grant application to qualified expert for opinion as part of application review and award process) (appeal pending); Jones v. Runyon, 32 F. Supp. 2d 873, 876 (N.D. W. Va. 1998) (disclosure to credit reporting service of information about plaintiff when requesting employment reports in course of routine investigation of possible workers' compensation fraud), aff'd, 173 F.3d 850 (4th Cir. 1999) (unpublished table decision); Blazy v. Tenet, 979 F. Supp. 10, 26 (D.D.C. 1997) (CIA's disclosure of information about employee to FBI while FBI was investigating employee's application for FBI employment), summary affirmance granted, No. 97-5330, 1998 WL 315583 (D.C. Cir. May 12, 1998); Magee v. United States Postal Serv., 903 F. Supp. 1022, 1029 (W.D. La. 1995) (disclosure of employee's medical records to clinical psychologist hired by agency to perform fitness-for-duty examination on employee), aff'd, 79 F.3d 1145 (5th Cir. 1996) (unpublished table decision); McNeill v. IRS, No. 93-2204, 1995 U.S. Dist. LEXIS 2372, at *6 (D.D.C. Feb. 7, 1995) (disclosure of IRS personnel records to prospective federal agency employer); Harry v. United States Postal Serv., 867 F. Supp. 1199, 1206-07 (M.D. Pa. 1994) (disclosure of documents regarding individual's employment history, including details of settlement agreement, in response to congressional inquiries "made at the prompting of that individual"); Lachenmyer v. Frank, No. 88-2414, slip op. at 4 (C.D. Ill. July 16, 1990) (disclosure of investigative report to persons at arbitration hearing held proper under routine use permitting disclosure of "record relating to a case or matter" in a "hearing in accordance with the procedures governing such proceeding or hearing"); Choe v. Smith, No. C-87-1764R, slip op. at 10-11 (W.D. Wash. Apr. 20, 1989) (INS's disclosure to its informant during investigation "to elicit information required by the Service to carry out its functions and statutory mandates"), aff'd, 935 F.2d 274 (9th Cir. 1991) (unpublished table decision); Brown v. FBI, No. 87-C-9982, 1988 WL 79653, at *1 (N.D. Ill. July 25, 1988) (disclosure of rap sheet to local police department); Ely v. Department of Justice, 610 F. Supp. 942, 945-46 (N.D. Ill. 1985) (disclosure to plaintiff's lawyer), aff'd, 792 F.2d 142 (7th Cir. 1986) (unpublished table decision); Kimberlin v. United States Dep't of Justice, 605 F. Supp. 79, 82-83 (N.D. Ill. 1985) (Bureau of Prisons' disclosure of prisoner's commissary account record to probation officer), aff'd, 788 F.2d 434 (7th Cir. 1986); Burley v. DEA, 443 F. Supp. 619, 623-24 (M.D. Tenn. 1977) (transmittal of DEA records to state pharmacy board); Harper v. United States, 423 F. Supp. 192, 198-99 (D.S.C. 1976) (IRS's disclosure of plaintiff's identity to other targets of investigation); see also Gowan v. United States Dep't of the Air Force, 148 F.3d 1182, 1187, 1194 (10th Cir.) (disclosure of information regarding individual to Members of Congress in response to inquiries made pursuant to individual's letters requesting assistance; stating that such disclosure is not "incompatible" and thus "would likely be protected under the routine use exception"), cert. denied, 525 U.S. 1042 (1998).

Four courts have required an agency to invoke its routine use to permit disclosure to unions of names of employees on the theory that refusal to so disclose was an unfair labor practice under the National Labor Relations Act. See NLRB v. United States Postal Serv., No. 92-2358, 1994 WL 47743, at **3-4 (4th Cir. Feb. 16, 1994); NLRB v. United States Postal Serv., 888 F.2d 1568, 1572-73 (11th Cir. 1989); NLRB v. United States Postal Serv., 841 F.2d 141, 144-45 & n.3 (6th Cir. 1988); NLRB v. United States Postal Serv., 790 F. Supp. 31, 33 (D.D.C. 1992); see also United States Postal Serv. v. National Ass'n of Letter Carriers, 9 F.3d 138, 141-46 (D.C. Cir. 1993) (holding that "if Postal Service could disclose the information under [its routine use] then it must disclose that information, because in the absence of a Privacy Act defense the arbitrator's award must be enforced," but remanding case for determination as to whether proper (e)(3)(C) notice was given before requiring invocation of routine use); FLRA v. United States Dep't of the Navy, 966 F.2d 747, 761-65 (3d Cir. 1992) (alternative holding) (en banc) (release to union of home addresses of bargaining unit employees pursuant to routine use was required under Federal Service Labor-Management Relations Act).

In addition, the Court of Appeals for the District of Columbia Circuit, in Department of the Air Force v. FLRA, granted enforcement of a Federal Labor Relations Authority decision requiring the Air Force to disclose to a union a disciplinary letter that was issued to a bargaining unit employee's supervisor. 104 F.3d 1396, 1399, 1401-02 (D.C. Cir. 1997). The court held that the Federal Management Relations Statute required disclosure of the letter, and that because the "union's request f[ell] within the Act's 'routine use' exception, the Privacy Act d[id] not bar disclosure," and the union was entitled to disclosure of the letter. Id. at 1401-02.

Apart from the FOIA (see subsection (b)(2)) and the Debt Collection Act (see subsection (b)(12)), the Privacy Act makes no provision for any nonconsensual disclosures that are provided for by other statutes. See, e.g., 42 U.S.C. § 653 (1994 & Supp. III 1997) (establishing "Parent Locator Service" and requiring agencies to comply with requests from Secretary of HHS for addresses and places of employment of absent parents "[n]otwithstanding any other provision of law"). Recognizing this difficulty, the OMB Guidelines note that "[s]uch disclosures, which are in effect congressionally mandated 'routine uses,' should still be established as 'routine uses' pursuant to subsections (e)(11) and (e)(4)(D)." OMB Guidelines, 40 Fed. Reg. at 28,954.

Go to Table of Contents || Previous Section Conditions of Disclosure to Third Parties: (required FOIA disclosure) || Next Section Conditions of Disclosure to Third Parties: (Bureau of the Census)