578 F.Supp.3d 18
D.D.C.2022Background
- Plaintiff Major David Stewart, a physician assistant in the California Air National Guard, sustained injuries in an accident, developed a psychiatric condition, and sought a medical waiver to continue service.
- Lt. Col. Sean Haugh, a supervisor who harbored animus toward Stewart, accessed Stewart's records in the Air Force Aeromedical Information Management Waiver Tracking System (AIMWTS), downloaded psychiatric treatment notes and a waiver narrative, and delivered them to Congresswoman Anna Eshoo's office.
- A Command Directed Investigation concluded Haugh violated the Privacy Act; Stewart first learned of the breach during the CDI and alleges resulting distress and that he began paying out-of-pocket for non‑military mental‑health treatment and lost wages for appointments.
- Stewart sued the Air Force and the National Guard Bureau under the Privacy Act seeking reimbursement for out‑of‑pocket mental‑health costs and lost wages; defendants moved to dismiss under Rule 12(b)(1) and (b)(6).
- Defendants argued Stewart failed to plead "actual damages" under the Privacy Act because emotional distress is not recoverable and Stewart lacks standing for pecuniary mitigation costs absent a substantial risk of future breach.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Whether emotional/mental‑distress damages qualify as "actual damages" under the Privacy Act | Stewart alleges severe distress and resulting harms from the unlawful disclosure. | Emotional or mental distress are not "actual damages" under the Privacy Act. | Court: Emotional distress is not cognizable; Privacy Act waiver does not cover non‑pecuniary emotional harms. |
| Whether Stewart's out‑of‑pocket mitigation costs (private therapy, lost wages) satisfy Article III standing and constitute "actual damages" to waive sovereign immunity | Stewart paid for private treatment to avoid repeat breaches and alleges lost wages; these are pecuniary losses. | Such mitigation costs require a substantial risk of future harm; here the alleged repeat breach risk is speculative. | Court: Pecuniary mitigation costs fail Article III injury‑in‑fact because plaintiff did not plausibly allege a substantial risk of a future breach; no standing. |
| Whether the court has subject‑matter jurisdiction under the Privacy Act (sovereign immunity waiver) | Stewart invokes the Privacy Act as a waiver of sovereign immunity for his damages. | Waiver applies only to "actual damages" (pecuniary losses); without cognizable actual damages sovereign immunity bars suit. | Court: Lacks subject‑matter jurisdiction because damages alleged are either non‑cognizable (emotional) or unsupported for standing (pecuniary). |
| Other defenses (failure to state a claim, timeliness) | Stewart opposes dismissal on merits. | Defendants also argued Rule 12(b)(6) failure and timeliness. | Court: Did not reach these issues after resolving lack of jurisdiction. |
Key Cases Cited
- FAA v. Cooper, 566 U.S. 284 (Privacy Act "actual damages" limited to pecuniary losses)
- Clapper v. Amnesty Int'l USA, 568 U.S. 398 (standing requires substantial risk of imminent harm; speculative future harms insufficient)
- Attias v. Carefirst, Inc., 865 F.3d 620 (D.C. Cir.) (data breach plaintiffs plausibly alleged substantial risk of identity theft supporting mitigation costs as injury)
- In re United States Office of Personnel Management Data Security Breach Litigation, 928 F.3d 42 (D.C. Cir.) (widespread data breach created substantial risk supporting mitigation‑cost standing)
- Lujan v. Defenders of Wildlife, 504 U.S. 555 (standing elements)
- Spokeo, Inc. v. Robins, 578 U.S. 330 (concreteness and imminence requirements for injury‑in‑fact)
- FDIC v. Meyer, 510 U.S. 471 (sovereign immunity principles)
- Chichakli v. Tillerson, 882 F.3d 229 (D.C. Cir.) (elements of a Privacy Act claim)