Georgia Andrews, Erin Brett, Frances E. Cassle, B.J. Durham, Maureen Engert, Mary Fox, Maxine Griffin, Betty Grubb, Ruth Holmes, Lucille Hoppe, Dorothy Homyak, Sharon K. Kaiser, Chandra K. Lillemoen, Carolyn O'brien, Deloris O'brien, Mary Jane Prysock, Laura Russell, Laura Scherr, Joan Schick, Brenda Schulz, Victoria Smith, Kathryan Toulouse, Margaret Wickham, Norman Wilde, and All Others Similarly Situated v. Veterans Administration of the United States of America, American Federation of Government Employees, Afl-Cio, Amicus Curiae
Docket: 85-2351
Court: Court of Appeals for the Tenth Circuit; January 27, 1988; Federal Appellate Court
The Veterans Administration (VA) appeals a district court ruling that found it violated the Privacy Act by disclosing personnel records of registered nurses at a VA Medical Center in Cheyenne, Wyoming. The case arose from a June 4, 1984, request by union president Pat Sanchez for proficiency reports (job performance evaluations) for nurses from 1982-1984, which she indicated needed to be sanitized to protect identities. Despite objections from some nurses against the release of their records, VA personnel advised that the Federal Service Labor-Management Relations Act (FSLRA) mandated disclosure, provided that the reports were sanitized to maintain anonymity. VA Chief of Personnel Service, Hazel Gilligan, attempted to sanitize the reports, involving her assistant and the head nurse for additional review. On June 19, she released the sanitized reports to Sanchez, who reviewed them with two other nurses. However, on June 20, Gilligan informed all nurses of the release, including an inadequately sanitized report of nurse Laura Scherr, which allowed co-workers to potentially identify her. The Appeals Court ultimately reversed the district court's decision.
Reports released by the VA were not utilized in any grievance or union activity, leading the district court to conclude that Mrs. Sanchez's actions were motivated by personal grievances. Registered nurse plaintiffs sought to prevent the VA and Medical Center from releasing personnel records in a sanitized or improperly sanitized manner, alleging violations of the Privacy Act of 1974. They claimed damages for mental distress and embarrassment, seeking $1,000 per plaintiff plus attorneys’ fees. During discovery, plaintiffs identified themselves in the reports, with varying success among them. The Medical Center was dismissed from the case, and the VA's motion to dismiss was denied.
The court found that ten plaintiffs could be recognized by third parties from the reports, while indirect evidence suggested four others could have been identified but were not. Conversely, three plaintiffs could not be identified from their reports. The court concluded that while all plaintiffs experienced mental anguish, none suffered financial loss. The release of the reports negatively impacted the Medical Center’s proficiency reporting system, increasing workplace tensions.
In evaluating the VA's culpability, the court determined that Ms. Gilligan acted negligently but in good faith, failing to properly balance privacy and union interests. The court characterized the Washington VA personnel's lack of training as gross negligence and a willful or intentional violation of the Privacy Act.
The district court concluded that if the subjects of reports can be identified, their privacy interests are violated. It determined that while the numerical ratings in the reports contained sensitive information that could be removed for disclosure, the narrative portions included identifying details that were too intertwined with other materials to be segregated without compromising privacy. The court found the VA had erred by not balancing the privacy interests against the union's interest before disclosing the reports. It assessed the violation of the nurses' privacy as substantial, while the union's interest was minimal, leading to the conclusion that disclosing inadequately sanitized reports to Ms. Sanchez was an unwarranted invasion of privacy, violating the Privacy Act. Although the court denied injunctive relief, it awarded $1,000 to each plaintiff for emotional trauma and granted $5,000 in attorneys' fees to the plaintiffs as prevailing parties.
The VA appealed, claiming the plaintiffs did not demonstrate a willful violation of the Privacy Act, arguing its actions were negligent but not intentional. The VA also contested the judgment for four plaintiffs whose identities were concealed from their co-plaintiffs. The appeal references relevant provisions of the Privacy Act, FOIA, and FSLRA, noting that the Privacy Act aims to protect individuals' privacy from misuse by federal agencies and prohibits disclosing records without the subjects' consent, unless required by FOIA.
The Privacy Act allows individuals to sue agencies for civil remedies if the agency fails to comply with its provisions, causing adverse effects. If a court finds the agency's actions intentional or willful, the individual is entitled to actual damages (at least $1,000) and reasonable attorney fees. Under the Freedom of Information Act (FOIA), there is a general requirement for public disclosure of agency information, with exceptions for personnel and medical files that would result in a clearly unwarranted invasion of personal privacy. Agencies must attempt to segregate sensitive from non-sensitive information, but if exempt materials are intertwined with non-exempt materials, the entire document may be exempt from disclosure. If the disclosure of personnel files would invasively affect privacy, they are protected under the Privacy Act. The Federal Service Labor-Management Relations Act (FSLRA) outlines the obligation of agencies to negotiate in good faith with exclusive representatives, which includes providing necessary data unless prohibited by law. There is a consensus among the parties that the Privacy Act does not completely prevent disclosures to union representatives under FSLRA, and the FOIA exemption applies here, allowing necessary disclosures.
The dispute involves the VA's alleged failure to balance disclosure obligations under the Freedom of Information Act (FOIA) and the Privacy Act. It is argued that the Privacy Act should not entirely prevent the sharing of relevant information with unions as this could support federal labor-management relations by providing necessary data for union representation. If the reports in question are considered personnel files that would invade personal privacy under FOIA, the Privacy Act would bar their disclosure without the nurses' consent, which would also limit disclosure to Ms. Sanchez under the Federal Service Labor-Management Relations Act (FSLRA).
The standard for liability under the Privacy Act requires intentional or willful misconduct, which the district court incorrectly equated with gross negligence in this case. The VA's alleged gross negligence stemmed from inadequate training or guidance provided to an employee regarding the Privacy Act and the FSLRA's mandates. However, legal precedent clarifies that "willful or intentional" conduct is distinct from gross negligence; it requires more than mere negligence but does not necessitate premeditated malice. Legislative history supports a lower standard of proof than "willful, arbitrary, or capricious" action, suggesting that something exceeding gross negligence is required, such as reckless behavior or knowing violations of the Act. Courts have affirmed that evidence of such conduct must be presented to establish liability under the Privacy Act.
Gross negligence has been deemed sufficient by some courts, referencing the case of Parks. For example, in Albright v. United States and Chapman v. National Aeronautics and Space Administration, gross negligence was equated with willfulness. However, courts have struggled to define "willful" or "intentional" conduct further. In Laningham v. United States Navy, "intentional or willful" was described as conduct that is "patently egregious and unlawful," suggesting that the actor should have known it was unlawful, echoing the sentiment in Wisdom v. Department of Housing and Urban Development. Albright clarified that willful conduct can be established if an act is committed without a belief in its lawfulness or if it flouts the rights of others. Greater misconduct beyond gross negligence necessitates evidence of reckless behavior or knowing violations. The definitions from the District of Columbia Circuit emphasize the need for conduct that is "patently egregious and unlawful." The conclusion drawn is that "willful or intentional" conduct necessitates actions exceeding gross negligence. Upon reviewing the case at hand, the court determined that the VA's actions did not meet the threshold for "willful or intentional" violations of the Privacy Act and even fell short of gross negligence.
The interpretation of the Federal Service Labor-Management Relations Act (FSLRA) indicates that the advice suggesting the release of reports in sanitized form does not constitute gross negligence in this case. There is insufficient evidence to claim that the Department of Veterans Affairs (VA) was grossly negligent for not providing Ms. Gilligan with adequate training or guidance, as she had received relevant training regarding the Privacy Act and had access to the Federal Personnel Manual, which includes guidelines for handling personnel file requests. Although neither Ms. Gilligan nor the VA personnel explicitly conducted a balancing process to weigh public disclosure interests against privacy concerns, Ms. Gilligan did attempt to sanitize the files based on directions from the Washington VA personnel. Despite not successfully removing all personally identifiable information, her efforts reflect a consideration for the plaintiff's privacy. Ms. Gilligan's lack of formal training in record sanitization does not elevate the VA's negligence to a level required for liability under the Privacy Act. Consequently, the court reverses the district court's finding of liability against the VA and the associated damages awarded to the plaintiffs. The district court acknowledged that Ms. Gilligan had not encountered a "blanket request" like the one in this case before and noted the structured nature of proficiency reports, which include ratings and narrative evaluations. Furthermore, the court found that the union's interest in the requested reports was minimal, as the request made by Ms. Sanchez was not tied to any active grievances.
The district court dismissed the VA's argument for disclosing reports under the Privacy Act as a "routine use," noting that the VA did not appeal this issue, so it was not further examined. The court emphasized the necessity of balancing individual privacy rights against the public's right to information when determining protections under FOIA exemption 6. Established case law supports the obligation of agencies to provide information to unions to facilitate grievance processing, regardless of whether the union pursues a specific grievance. The court concluded there was no willful or intentional violation of the Act, rendering it unnecessary to review the district court's assessment of public versus private interests. However, concerns were raised about whether the district court fully considered the public interest in disclosing personnel information to union representatives in this instance. The VA had no reason to doubt the legitimacy of the information request, which appeared relevant to the union's functions under the FSLRA. The court cautioned against agencies having to question the motives of authorized union representatives seeking necessary information. Additionally, findings indicated potential abuse of authority by Ms. Sanchez in her role, which, if substantiated, could lead to significant repercussions.
