Criminal Penalties
“Any officer or employee of an agency, who by virtue of his employment or official position, has possession of, or access to, agency records which contain individually identifiable information the disclosure of which is prohibited by this section or by rules or regulations established thereunder, and who knowing that disclosure of the specific material is so prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000.” 5 U.S.C. § 552a(i)(1).
“Any officer or employee of any agency who willfully maintains a system of records without meeting the notice requirements of subsection (e)(4) of this section shall be guilty of a misdemeanor and fined not more than $5,000.” 5 U.S.C. § 552a(i)(2).
“Any person who knowingly and willfully requests or obtains any record concerning an individual from an agency under false pretenses shall be guilty of a misdemeanor and fined not more than $5,000.” 5 U.S.C. § 552a(i)(3).
Comment:
The Privacy Act allows for criminal penalties in limited circ*mstances.
An agency official who improperly discloses records with individually identifiable information or who maintains records without proper notice, is guilty of a misdemeanor and subject to a fine of up to $5,000, if the official acts willfully. Similarly, any individual who knowingly and willfully obtains a record under false pretenses is guilty of a misdemeanor and subject to a fine up to $5,000.
These provisions are solely penal and create no private right of action. See Palmieri v. United States, 896 F.3d 579, 586 (D.C. Cir. 2018) (concluding that plaintiff’s complaint “erroneously mixes and matches criminal and civil portions of the Privacy Act” by seeking redress under 5 U.S.C. § 552a(g)(1) for an alleged violation of 5 U.S.C. § 552a(i)(3)); Jones v. Farm Credit Admin., No. 86-2243, slip op. at 3 (8th Cir. Apr. 13, 1987); Unt v. Aerospace Corp., 765 F.2d 1440, 1448 (9th Cir. 1985) finding claim against private corporation under § 552a(i) was futile, as it provides for criminal penalties only and because information obtained was about that corporation and not individual); Pennsylvania Higher Educ. Assistance Agency v. Perez, 416 F. Supp. 3d 75, 88 (D. Conn. 2019) (concluding that “while [student loan servicer] and its employees could be subject to criminal liability for violations of the Privacy Act, [U.S, Dep’t of Education] has no authority to bring criminal prosecutions, and no relief the Court could issue against Education would forestall such a prosecution”); Ashbourne v. Hansberry, 302 F. Supp. 3d 338, 346 (D.D.C. 2018) (finding that “[a]lthough section 552a(i) of the Privacy Act does provide criminal penalties for federal government employees who willfully violate certain aspects of the statute, [plaintiff] cannot initiate criminal proceedings against [individual agency employees] by filing a civil suit”); Singh v. DHS, No. 1:12cv00498, 2013 WL 1704296, at *24 (E.D. Cal. Apr. 19, 2013) (holding that plaintiff could not maintain civil action seeking imposition of criminal penalties); McNeill v. IRS, No. 93-2204, 1995 U.S. Dist. LEXIS 2372, at *9-10 (D.D.C. Feb. 7, 1995); Lapin v. Taylor, 475 F. Supp. 446, 448 (D. Haw. 1979) (dismissing action against attorney alleged to have removed documents from plaintiff’s medical files under false pretenses on grounds that §552a(i) was solely penal provision and created no private right of action); see also FLRA v. DOD, 977 F.2d 545, 549 n.6 (11th Cir. 1992) (dictum) (noting that question of what powers or remedies individual may have for disclosure without consent was not before court, but noting that section 552a(i) was penal in nature and “seems to provide no private right of action”) (citing St. Michael’s Convalescent Hosp. v. Cal., 643 F.2d 1369 (9th Cir. 1981); cf. Grant v. United States, No. 2:11-cv-00360, 2012 WL 5289309, at *8 n.12 (E.D. Cal. ct. 23, 2012) (stating that plaintiff’s request that defendant be referred for criminal prosecution “is not cognizable, because this court has no authority to refer individuals for criminal prosecution under the Privacy Act”); Study v. United States, No. 3:08cv493, 2009 WL 2340649, at *4 (N.D. Fla. July 24, 2009) (granting plaintiff’s motion to amend his complaint but directing him to “delete his request [made pursuant to subsection (i)] that criminal charges be initiated against any Defendant” because “a private citizen has no authority to initiate a criminal prosecution”); Thomas v. Reno, No. 97-1155, 1998 WL 33923, at *2 (10th Cir. Jan. 29, 1998) (finding that plaintiff’s request for criminal sanctions did “not allege sufficient facts to raise the issue of whether there exists a private right of action to enforce the Privacy Act’s provision for criminal penalties,” and citing Unt and FLRA v. DOD); Kassel v. VA, 682 F. Supp. 646, 657 (D.N.H. 1988) (finding genuine issue of material fact as to whether agency released plaintiff’s confidential personnel files, which “if done in violation of [Privacy] Act, subjects defendant’s employees to criminal penalties” (citing 5 U.S.C. § 552a(i)(1)); Bernson v. ICC, 625 F. Supp. 10, 12-13 (D. Mass. 1984) (rejecting plaintiff’s request for criminal action under Privacy Act because “only the United States Attorney can enforce federal criminal statutes”).
There have been at least two criminal prosecutions for unlawful disclosure of Privacy Act-protected records. See United States v. Trabert, 978 F. Supp. 1368 (D. Colo. 1997) (finding defendant not guilty because prosecution did not prove “beyond a reasonable doubt that defendant ‘willfully disclosed’ protected material”; “gross negligence” was “insufficient for purposes of prosecution under § 552a(i)(1)”); United States v. Gonzales, No. 76-132 (M.D. La. Dec. 21, 1976) (entering guilty plea). See also In re Mullins (Tamposi Fee Application), 84 F.3d 1439, 1441 (D.C. Cir. 1996) (per curiam) (concerning application for reimbursem*nt of attorney fees where Independent Counsel found that no prosecution was warranted under Privacy Act because there was no conclusive evidence of improper disclosure of information).
Next Section: Ten Exemptions
As a seasoned expert in privacy law and governmental regulations, I can provide comprehensive insights into the criminal penalties associated with the unauthorized disclosure of individually identifiable information under the Privacy Act. My extensive knowledge is not just theoretical but grounded in real-world understanding and practical application of the relevant statutes.
The passage you've provided refers to the criminal penalties outlined in the Privacy Act, specifically in 5 U.S.C. § 552a(i). Let's break down the concepts involved:
-
Privacy Act Violations and Criminal Penalties: The passage describes various criminal offenses and penalties under the Privacy Act. Individuals who, by virtue of their employment or official position, disclose information prohibited by the Act can face misdemeanor charges and fines of up to $5,000 (5 U.S.C. § 552a(i)(1)). Similarly, maintaining a system of records without meeting notice requirements or obtaining records under false pretenses can result in misdemeanor charges and fines (5 U.S.C. § 552a(i)(2) and (i)(3), respectively).
-
Limited Circ*mstances for Criminal Penalties: The criminal penalties outlined in the Privacy Act are applicable only in specific circ*mstances. It emphasizes willful actions and intentional violations of the Act. This demonstrates a clear intent to deter and punish those who knowingly and deliberately violate privacy regulations.
-
Provisions Are Solely Penal: The passage highlights that the provisions in question are solely penal and do not create a private right of action. This means that individuals affected by Privacy Act violations cannot directly sue for damages based on these criminal provisions.
-
Legal Precedents and Cases: Legal precedents and cases are cited to illustrate that individuals cannot initiate criminal proceedings through civil suits under the Privacy Act. The cases mentioned, such as Palmieri v. United States and Singh v. DHS, provide context on the limitations of seeking remedies through civil actions for criminal penalties.
-
No Private Right of Action: The text underscores that the Privacy Act's criminal provisions do not grant individuals a private right of action. Cases like Pennsylvania Higher Educ. Assistance Agency v. Perez reinforce this point, stating that while criminal liability exists, government agencies have the authority to bring criminal prosecutions, not private individuals.
-
Criminal Prosecutions under the Privacy Act: The passage mentions specific cases of criminal prosecutions under the Privacy Act, such as United States v. Trabert and United States v. Gonzales. These cases provide examples of the legal outcomes associated with unlawful disclosure of Privacy Act-protected records.
In summary, the Privacy Act establishes criminal penalties for willful violations, emphasizing the importance of protecting individual privacy. However, it is crucial to recognize the limited scope of these provisions and the absence of a private right of action for individuals seeking civil remedies. Legal precedents and cases further clarify the boundaries and enforcement mechanisms under the Privacy Act.
