Case Information
*1 UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLUMBIA ____________________________________
)
IN RE: U.S. OFFICE OF )
PERSONNEL MANAGEMENT )
DATA SECURITY BREACH )
LITIGATION ) Misc. Action No. 15-1394 (ABJ) ____________________________________) MDL Docket No. 2664
)
This Document Relates To: )
)
ALL CASES )
____________________________________)
MEMORANDUM OPINION
INTRODUCTION
In June of 2015, millions of unsuspecting federal employees sat down at their computers, opened up their email, and received some very disconcerting news.
I am writing to inform you that the U.S. Office of Personnel Management (OPM) recently became aware of a cybersecurity incident affecting its systems and data that may have exposed your personal information.
Over time, OPM revealed that data breaches at the agency and at one of its contractors affected more than twenty-one million people, and that the stolen information included such sensitive data as names, birthdates, current and former addresses, and Social Security numbers. After those announcements, a number of plaintiffs filed separate lawsuits in courts across the country, and they were consolidated into two complaints in the multidistrict action assigned to this Court.
The first complaint is a class action lawsuit filed by thirty-eight individuals and a union, the American Federation of Government Employees (“AFGE”). See Consolidated Amended Complaint [Dkt. # 63] (“CAC”). Plaintiffs allege that the breaches resulted from gross negligence on the part of officials entrusted with the responsibility of protecting the private details that job seekers submit to OPM in connection with the background investigations they are required to *2 undergo. They have sued on behalf of the 21.5 million current and former federal employees, job applicants, contractors, and relatives whose information was compromised, and they seek statutory damages under the Privacy Act, contract damages under the Little Tucker Act, and declaratory and injunctive relief under the Administrative Procedure Act. These plaintiffs have also sued KeyPoint Government Solutions, a government contractor that performed background investigations for OPM. KeyPoint’s computer systems were also breached, and plaintiffs seek damages from the company under multiple federal and state statutory and common law theories. Defendants have moved to dismiss the entire case on the grounds that plaintiffs lack standing to bring it, the claims are barred by sovereign immunity, and the factual allegations are not sufficient to state valid claims under any of the statutes or common law theories plaintiffs have invoked.
The second complaint before the Court was filed by three individuals and the National Treasury Employees Union (“NTEU”). Am. Compl. [Dkt. # 75] (“NTEU Compl.”). These plaintiffs sued the OPM Acting Director only, and they claim that their constitutional right to informational privacy was violated. Defendant has moved to dismiss that case as well, on both standing grounds and the basis that the plaintiffs have failed to allege a constitutional violation that is recognized by the courts.
The OPM breaches have been the subject of considerable public interest and multiple Congressional hearings and reports. The fact that the breaches occurred is not disputed, and the identities of the individuals whose information was compromised are known. There is no doubt that something bad happened, and many people are understandably chagrined and concerned. In these lawsuits, plaintiffs seek to demonstrate that the agency’s failures were willful – that the defendants were on notice that hackers regularly targeted their systems, but they failed to design *3 and maintain adequate safeguards. Plaintiffs also contend that their sensitive information remains subject to a continuing risk of additional exposure due to an ongoing failure to secure it.
This opinion will not get into the merits of those contentions. At this stage of the proceedings, the Court is required to accept all of plaintiffs’ factual assertions as true, and nothing that follows should be read as any indication of the Court’s view of the strength of plaintiffs’ troubling allegations.
Before the parties can explore the facts, though, the Court is required to answer a foundational question: whether plaintiffs have set forth a cause of action that a court has the power to hear. The judiciary does not operate as a freestanding advisory board that can opine about the conduct of the executive branch as a general matter or oversee how it manages its internal operations. The Court’s authority is derived from Article III of the U.S. Constitution, and a federal court may only consider live cases or controversies based on events that caused actual injuries or created real threats of imminent harm to the particular individuals who brought the case. In other words, before a court may proceed to the merits of any claim, the plaintiffs must demonstrate that they have constitutional “standing” to sue. Also, a court may not entertain an action against the United States if the government has not expressly waived its sovereign immunity, that is, unless it has given its consent to be sued in that particular situation. And once a plaintiff overcomes those hurdles, he or she must state a valid legal claim.
This case implicates the constitutional limits on the Court’s jurisdiction imposed by both the standing doctrine and the doctrine of sovereign immunity, and it involves unique factual circumstances. Neither the Supreme Court nor the U.S. Court of Appeals for the D.C. Circuit has held that the fact that a person’s data was taken is enough by itself to create standing to sue; a plaintiff who claims an actual injury must be able to connect it to the defendant’s actions, and a *4 person who is pointing to a threat of future harm must show that the harm is certainly impending or that the risk is substantial. The fact that this is not just a data breach case, but that it is a data breach arising out of a particular sort of cyberattack against the United States, differentiates it from the majority of the legal precedent that arises in the context of retail establishments or other financial entities. Courts in those cases often make certain assumptions about the likelihood of future harm in order to find that the elements needed to initiate a case have been satisfied. Here, the usual assumptions about why the information was stolen and what is likely to be done with it in the future do not apply and cannot fill the gap. As for those plaintiffs who allege that they have already experienced an actual misuse of their credit card numbers or personal information, they cannot tie those disparate incidents to this breach. It may well be that the Supreme Court or the D.C. Circuit will someday announce that given the potential for harm inherent in any cyberattack, breach victims automatically have standing even if the harm has yet to materialize, and even if the purpose behind the breach and the nature of any future harm have yet to be discerned. But that has not happened yet, and the Court is not empowered to expand the limits of its own authority, so it cannot find that plaintiffs have standing based on this record.
Even if the Court were inclined to anticipate that this is where the law is heading, the problem runs deeper than standing. The right to bring a claim for damages under the Privacy Act is expressly limited to those who can demonstrate that they have suffered actual economic harm as a result of the government’s statutory violation. The law is clear that the statute does not create a cause of action for those who have been merely aggrieved by, or are even actively worried about, the fact that their information has been taken. Neither the Administrative Procedure Act nor the Little Tucker Act supplies a cause of action against the government to enforce its information *5 security obligations, and no court has expressly recognized a right to data security arising under the Constitution.
Therefore, defendants’ motions to dismiss will be granted, and both cases will be dismissed in their entirety. The Court finds, applying the case law it is required to follow, that neither set of plaintiffs has pled sufficient facts to demonstrate that they have standing. Moreover, even if they had the right to enter the courthouse, they did not bring a claim with them that the Court can hear. Plaintiffs have failed to overcome the arguments that the federal defendants are immune from suit under the Privacy Act and the Administrative Procedure Act, and that KeyPoint is shielded by government contractor immunity, so the Court lacks subject matter jurisdiction to hear those claims. Moreover, the Court finds that plaintiffs have failed to state claims upon which relief can be granted. Plaintiffs seek damages for improper disclosure of information and for a failure to maintain adequate safeguards under the Privacy Act, but they have not alleged that private information was “disclosed,” as opposed to stolen, and they have not alleged facts to show that their claimed injuries were the result of the agency’s failures. Plaintiffs have not stated a claim for breach of contract under the Little Tucker Act since they have not shown that OPM entered into a contract with them or that any contract was breached, and they have not alleged any violation of the United States Constitution.
TABLE OF CONTENTS
FACTUAL BACKGROUND ......................................................................................................... 7
I. The Data Breaches .............................................................................................................. 7 II. The Targeted Systems and Compromised Information ...................................................... 8 III. OPM’s Knowledge of the Deficiencies and Response to the Breaches.............................. 9 IV. Plaintiffs’ Alleged Harm ................................................................................................. 111 A. Actual Identity Theft or Credit Card Fraud ................................................................ 11 *6 B. Risk of Future Identity Theft and Other Harm Associated with that Risk ................. 12
PROCEDURAL HISTORY.......................................................................................................... 12 STANDARD OF REVIEW .......................................................................................................... 14
I. Lack of Subject Matter Jurisdiction .................................................................................. 14 II. Failure to State a Claim..................................................................................................... 16
ANALYSIS ................................................................................................................................... 17
I. Plaintiffs Do Not Have Standing. ..................................................................................... 17 A. Legal Framework ........................................................................................................ 18 1. Individual Standing ......................................................................................... 18 2. Organizational Standing.................................................................................. 19
B. Plaintiffs have Failed to Show that They have Article III Standing ........................... 20 1. Injury in Fact ................................................................................................... 21 a. Theft of Private Information Without More ..............................................21 b. Actual Identity Theft or Fraudulent Credit Card Activity .........................32 c. Future Identity Theft and Other Future Harms ..........................................35
2. Causation......................................................................................................... 48 II. Plaintiffs’ Claims Cannot Proceed. ................................................................................... 53 A. Claims Against OPM .................................................................................................. 53 1. Plaintiffs’ Privacy Act claims must be dismissed. .......................................... 53 a. All but two CAC plaintiffs fail to plead actual damages, and therefore the Court lacks subject matter jurisdiction to hear their claims. ................................................................................................53 b. The disclosure provision claim fails because OPM did not intentionally or willfully disclose plaintiffs’ information within the meaning of the Act. ..............................................................................55 *7 c. While plaintiffs have alleged a willful violation of the safeguards provision of the Privacy Act, their claim fails because they do not allege sufficient facts to show that their injuries were “a result of” OPM’s conduct. .........................................................................................56 2. Plaintiffs fail to state a claim under the Little Tucker Act. ............................. 58 3. The Court lacks subject matter jurisdiction to hear plaintiffs’ claim under the APA................................................................................................. 60 4. The NTEU plaintiffs fail to state a constitutional claim. .............................. 622
B. Claims Against KeyPoint ............................................................................................ 67 1. KeyPoint has derivative immunity because it was a government contractor. ....................................................................................................... 68 2. Plaintiffs do not adequately identify a portion of KeyPoint’s contract with OPM that KeyPoint breached. ................................................................ 69 3. Even if KeyPoint acted negligently, it did not lose its sovereign immunity. ........................................................................................................ 71 C. Claims against both defendants for declaratory judgment and injunctive relief will be dismissed for lack of subject matter jurisdiction. ........................................... 73 CONCLUSION ............................................................................................................................. 73
FACTUAL BACKGROUND
Defendant OPM is a federal agency that handles portions of the federal employee recruitment process. CAC ¶ 52; NTEU Compl. ¶¶ 10–11. [1] Defendant KeyPoint Government Solutions is a private contractor that conducts background investigations and security clearance checks on behalf of OPM. CAC ¶ 53.
I. The Data Breaches
The CAC plaintiffs allege that four breaches occurred in 2013 and 2014. 1 The NTEU complaint named OPM’s Acting Director as the defendant in that case but sued her solely in her official capacity. NTEU Compl. ¶ 9. The Court will refer to the federal defendants named in the two complaints collectively as “OPM.”
• On November 1, 2013, hackers “infiltrated” OPM’s systems and stole “security system documents and electronic manuals” about the agency’s systems, although no individual personal information was stolen. CAC ¶ 125; see also CAC ¶ 3. • About a month later, in about December 2013, KeyPoint experienced a breach. “[A]n unknown person or persons obtained the user log-in credentials of a KeyPoint employee,” and the credentials were used to “steal the personnel records of tens of thousands of Department of Homeland Security employees” from KeyPoint’s systems. CAC ¶ 4.
• On May 7, 2014, hackers used “stolen KeyPoint credentials” to access OPM’s network and install malware, creating “a conduit through which data could be exfiltrated.” CAC ¶ 127. This breach “resulted in the theft of nearly 21.5 million background investigation records,” which included “questionnaire forms containing highly sensitive personal, family, financial, medical, and associational information of Class members.” CAC ¶ 129; see also NTEU Compl. ¶ 19. • Finally, “[n]o later than October 2014,” hackers attacked “OPM systems maintained in an Interior Department shared-services data center.” CAC ¶ 131; see also NTEU Compl. ¶ 14. Hackers “use[d] the stolen KeyPoint credentials to access systems within OPM’s network at will” and maintained access to OPM’s network for “several months,” removing “millions of personnel records,” resulting in “the loss of approximately 4.2 million federal employees’ personnel files.” CAC ¶¶ 131, 133.
II. The Targeted Systems and Compromised Information
The CAC plaintiffs allege that the nature and scope of the data breaches “indicate that the intrusion was sophisticated, malicious, and carried out to obtain sensitive data for improper use.” CAC ¶¶ 117, 128, 132. Both complaints allege that the cyberattacks removed data from OPM computer systems and databases, including OPM’s Electronic Official Personnel Folder system and the Central Verification System. See CAC ¶¶ 64–65, 74, 130; NTEU Compl. ¶¶ 10–12 (describing relevant OPM systems).
The Electronic Official Personnel Folder system stores personnel files of federal employees. CAC ¶¶ 74, 130. These files include “birth certificates, job performance reports, resumes, school transcripts, military service records, employment history and benefits, and job applications that contain Social Security numbers and birthdates.” CAC ¶ 74; NTEU Compl. ¶ 10.
The Central Verification System “contains most background and security clearance check information,” including information from the three forms – Standard Form (“SF”) 85, SF 85P, and SF 86 – that applicants for federal positions and security clearances must complete. [2] CAC ¶¶ 66, 69, 70. This system also contains information on security clearances, investigations, suitability determinations, background checks for those seeking access to federal facilities, and polygraph data. CAC ¶¶ 72, 73; NTEU Compl. ¶ 12.
III. OPM’s Knowledge of the Deficiencies and Response to the Breaches Both plaintiff groups allege that OPM “knew for several years” before the breaches that its “information security governance and management protocols contained material weaknesses that posed a significant threat to its systems.” CAC ¶ 90; NTEU Compl. at 3 (alleging OPM had been “on notice of serious flaws in its data system security”). The Consolidated Amended Complaint states that the OPM Inspector General’s annual audits of cybersecurity from 2007 to the present “found that OPM’s information security policies and practices suffered from material weaknesses” that “pose an immediate risk to the security of assets or operations.” CAC ¶¶ 81, 84, 86–88; NTEU Compl. at 3 (alleging the Inspector General’s office had “identified numerous significant deficiencies, including deficiencies related to OPM’s decentralized security governance structure, its failure to ensure that its information technology systems met applicable security standards, and 2 The federal government uses SF 85 for applicants seeking non-sensitive federal government or contractor positions and SF 85P for applicants seeking “public trust” federal government or contractor positions. CAC ¶¶ 69–70. It requires individuals who will need security clearances to complete the SF 86. CAC ¶ 66. SF 86 is a 127-page form and, according to the CAC, it seeks information about “applicants’ psychological and emotional health history, police records, illicit drug and alcohol use history, Social Security numbers, birthdates, financial histories and investment records, children’s and relatives’ names, foreign trips taken and contacts with foreign nationals, past residences, names of neighbors and close friends (such as college roommates and co-workers), and the Social Security numbers and birthdates of spouses, children, and other cohabitants.” CAC ¶ 67; see also NTEU Compl. ¶ 29.
its failure to ensure that adequate technical security controls were in place for all servers and databases”).
After learning of the breaches, OPM issued a series of announcements to the public and affected individuals. With each revelation, the reported scope of the breach and the number of people affected increased.
On April 27, 2015, OPM notified “more than 48,000 federal employees that their personal information might have been exposed in the KeyPoint Breach.” CAC ¶ 120. On June 4, 2015, it announced that it had experienced a data breach that “resulted in the exposure and theft of the [government investigation information] of approximately 4.2 million current, former, and prospective federal employees and contractors.” CAC ¶ 138. On June 12, 2015, OPM acknowledged that the scope of breach was broader than previously disclosed and that “as many as 14 million current, former, and prospective federal employees and contractors” were affected. CAC ¶ 139. On July 9, 2015, OPM announced that the information “of approximately 21.5 million people had been exposed and stolen in the May 2014 breach,” including the theft of 1.1 million fingerprints. CAC ¶ 140. Of the 21.5 million people affected, 19.7 million had undergone background checks. The other 1.8 million records concerned “mostly job applicants’ spouses, children, and other cohabitants.” CAC ¶ 140. On September 23, 2015, OPM announced that not 1.1 million, but approximately 5.6 million, fingerprints had been stolen. CAC ¶ 141.
The agency notified each individual whose private information had been compromised and offered free identity theft protection services at “a combined cost of approximately $154 million . . . for either 18 months or three years, depending on the amount and sensitivity of the compromised [information].” CAC ¶¶ 148, 150.
IV. Plaintiffs’ Alleged Harm
The CAC plaintiffs allege that each of the thirty-eight named plaintiffs submitted sensitive personal information to the federal government that was compromised in the breaches. See CAC ¶¶ 10, 13–50; see also CAC ¶ 1. The NTEU plaintiffs allege that the three named plaintiffs and an unknown number of NTEU members were “identified by OPM as having been affected by the breaches.” NTEU Compl. ¶ 59. Plaintiffs assert that the data breaches occurred as a result of defendants’ failure to secure their systems, CAC ¶ 1, and that all of the putative class members are subject to a continuing risk of additional exposure since that failure is ongoing. CAC ¶ 7. The complaints allege that plaintiffs have sustained and will continue to sustain “economic loss and other harm,” CAC ¶ 163; that they have suffered “stress,” CAC ¶¶ 13, 18, 19, 22–25, 28, 30–31, 35, 37, 42–44, 46, 50; or a loss to their “sense of security,” NTEU Compl. ¶ 78; and that they face an increased risk of expending time and money dealing with such consequences as identity theft and fraud in the future. CAC ¶ 163.
The complaints contain a range of allegations concerning the nature of the particular harm suffered by class members.
A. Actual Identity Theft or Credit Card Fraud
A number of plaintiffs allege that they have experienced actual identity theft or credit card fraud.
• Fourteen CAC plaintiffs and one of the three NTEU plaintiffs allege that at some point after they were informed of the breaches, they learned that unauthorized charges had been made to their existing credit card accounts or that fraudulent accounts were opened in their names. See CAC ¶¶ 13, 16, 19, 22, 28–31, 38, 39, 41, 45, 49, 50; NTEU Compl. ¶ 84.
• Four CAC plaintiffs allege that they experienced unauthorized credit inquiries. CAC ¶¶ 13, 14, 29, 31.
• Six CAC plaintiffs and one NTEU plaintiff allege that fraudulent tax returns were filed in their names. CAC ¶¶ 14, 21, 24, 28, 31, 32; NTEU Compl. ¶ 79.
• Four CAC plaintiffs allege that there was some other improper use of their own or a family member’s Social Security number. CAC ¶¶ 14, 17, 41, 50.
B. Risk of Future Identity Theft and Other Harm Associated with that Risk Both sets of plaintiffs claim that they have suffered harm as result of the breaches because they face an increased risk of identity theft in the future. CAC ¶¶ 7, 210; NTEU Compl. ¶ 92. Nearly all of the named CAC plaintiffs – thirty-four out of thirty-eight – allege that after learning about the breaches, they devoted some time and effort to preventing future identity theft. See, e.g. , CAC ¶¶ 13–22, 25–34, 36–44, 46–50 (alleging that exposure to the breach caused plaintiffs to review their financial accounts or credit reports with greater frequency, or that they placed freezes on their credit). Of those plaintiffs, seven allege that they spent money to purchased credit monitoring and protection services or incurred other expenses to prevent future identity theft. See, e.g. , CAC ¶¶ 17, 21, 25, 34, 41. And numerous plaintiffs allege that they “suffer stress” due to their concerns about future identity theft or a sense of vulnerability to some other harm. See CAC ¶¶ 18–19, 22–25, 28, 35, 37, 43–44 (expressing concerns for their safety or the safety of their family members); CAC ¶¶ 18–30, 43, 46 (expressing concern about an inability to obtain a security clearance in the future); CAC ¶¶ 19, 23–24, 42–44 (expressing fear about future identity theft); CAC ¶¶ 19, 31, 50 (alleging “stress resulting from concerns that her exposure to the Data Breaches will adversely affect her minor children’s future”); see also NTEU Compl. ¶ 94 (expressing anxiety over the effect the data breaches will have on them, their families, friends, and other associates).
PROCEDURAL HISTORY
A number of lawsuits were filed around the country after the data breaches at OPM and KeyPoint were announced. The United States Judicial Panel on Multidistrict Litigation transferred all actions that were pending elsewhere to this Court for coordinated or consolidated proceedings *13 pursuant to 28 U.S.C. § 1407 [Dkt. # 1], and plaintiffs filed two amended complaints, which are the operative documents in this matter. See Order (Dec. 15, 2015) [Dkt. # 19].
The plaintiffs in the Consolidated Amended Complaint [3] assert that OPM violated the Privacy Act, the Little Tucker Act, and the Administrative Procedure Act (“APA”), and that KeyPoint is liable for negligence, negligent misrepresentation and concealment, invasion of privacy, breach of contract, and violations of the Fair Credit Reporting Act and various state statutes governing unfair and deceptive trade practices and data security. CAC ¶¶ 175–275. They seek declaratory and injunctive relief against both defendants. CAC at 75–76 (Prayer for Relief).
OPM and KeyPoint each filed motions to dismiss the CAC, arguing that the Court lacks subject matter jurisdiction under Federal Rule of Civil Procedure 12(b)(1) because plaintiffs do not have standing and defendants are shielded by sovereign immunity, and that plaintiffs failed to state a claim under Rule 12(b)(6). See KeyPoint’s Mot. to Dismiss CAC & Mem. of Law in Supp. [Dkt. # 70] (“KeyPoint Mem.”), Fed. Def.’s Mot. to Dismiss CAC and Mem. of P. & A. in Supp. [Dkt. # 72] (“OPM’s Mem.”); Pls.’ Consol. Opp. to Defs.’ Mots. To Dismiss [Dkt. # 82] (“CAC Pls.’ Opp.”); KeyPoint’s Reply [Dkt. # 86]; Fed. Def.’s Reply [Dkt. # 87].
The NTEU plaintiffs assert a single claim against the Acting Director of OPM, alleging that the agency violated their constitutional right to informational privacy. NTEU Compl. ¶¶ 95– 98. They seek declaratory and injunctive relief. NTEU Compl. at 34–35 (Request for Relief). 3 The CAC defines the class to include current, former, and prospective federal government employees and contractors, their family members and cohabitants, whose information was compromised as a result of the data breaches, and excludes defendants’ senior officers, officials, and executives and their immediate family members, and “judicial officers to whom this case is assigned and their respective staffs.” CAC ¶ 165.
OPM has moved to dismiss the NTEU complaint for lack of standing and for failure to state a claim. [4] See Fed. Defs.’ Mot. to Dismiss NTEU Compl. [Dkt. # 81]; Mem. in Supp. [Dkt. # 81-1]; NTEU Pls.’ Opp. to OPM’s NTEU Mot. [Dkt. # 84] (“NTEU’s Opp.”); Fed. Def.’s Reply Mem. in Supp. of Mot. to Dismiss [Dkt. # 91]. [5]
The Court heard oral argument on the motions, and the motions are fully briefed.
STANDARD OF REVIEW
In evaluating a motion to dismiss under either Rule 12(b)(1) or 12(b)(6), the Court must
“treat the complaint’s factual allegations as true . . . and must grant plaintiff ‘the benefit of all
inferences that can be derived from the facts alleged.’”
Sparrow v. United Air Lines, Inc.
, 216
F.3d 1111, 1113 (D.C. Cir. 2000) (internal citations omitted), quoting
Schuler v. United States
,
I. Lack of Subject Matter Jurisdiction
Under Rule 12(b)(1), the plaintiff bears the burden of establishing jurisdiction by a
preponderance of the evidence.
See Lujan v. Defs. of Wildlife
,
5 See also Joint Omnibus Notice of Supp. Auth. [Dkt. # 95]; Notice of Recent Decision [Dkt. # 99]; Def. KeyPoint’s Notice of Suppl. Citations [Dkt. # 102]; Pls.’ Resp. to Def. KeyPoint’s Notice of Suppl. Citations [Dkt. # 103]; Notice of Suppl. Auth. [Dkt. # 106], Resp. to Notice of Suppl. Auth. [Dkt. # 107], Resp. to Notice of Suppl. Auth. [Dkt. # 108], Notice of Recent Decision [Dkt. # 109], Resp. to Notice of Recent Decision [Dkt. # 110], Notice of Supp. Auth. [Dkt. # 111], NTEU Pls.’ Supp. Submission [Dkt. # 112], Fed. Def. OPM’s Suppl. Submission regarding Attias v. CareFirst, Inc . [Dkt. # 113], Def. KeyPoint’s Suppl. Submission regarding Attias v. CareFirst, Inc. [Dkt. # 114], and Class Pls.’ Suppl. Submission [Dkt. # 115].
v. Sibley Int’l Corp.
,
When considering a motion to dismiss for lack of jurisdiction, unlike when deciding a
motion to dismiss under Rule 12(b)(6), the court “is not limited to the allegations of the complaint.”
Hohri v. United States
,
Furthermore, when a government agency is the defendant, additional jurisdictional
considerations apply. The United States is not amenable to suit in the federal courts absent an
express waiver of sovereign immunity.
Anderson v. Carter
,
II. Failure to State a Claim
“To survive a [Rule 12(b)(6)] motion to dismiss, a complaint must contain sufficient
factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.’”
Ashcroft
v. Iqbal
,
A claim is facially plausible when the pleaded factual content “allows the court to draw the
reasonable inference that the defendant is liable for the misconduct alleged.”
Id.
at 678, citing
Twombly
,
When considering a motion to dismiss under Rule 12(b)(6), the Court is bound to construe
a complaint liberally in the plaintiff’s favor, and it should grant the plaintiff “the benefit of all
inferences that can be derived from the facts alleged.”
Kowal v. MCI Commc’ns Corp.
, 16 F.3d
1271, 1276 (D.C. Cir. 1994). Nevertheless, the Court need not accept inferences drawn by the
plaintiff if those inferences are unsupported by facts alleged in the complaint, nor must the Court
accept plaintiff’s legal conclusions.
See id.
;
see also Browning
,
ANALYSIS
Defendants seek to dismiss both complaints for lack of subject matter jurisdiction on the
grounds that plaintiffs lack standing and that there has not been a valid waiver of sovereign
immunity, and they have also moved to dismiss for failure to state a claim. Courts must determine
whether they have jurisdiction to hear a case before considering whether plaintiffs have failed to
state a claim.
Hancock v. Urban Outfitters
,
I. Plaintiffs Do Not Have Standing.
“To state a case or controversy under Article III, a plaintiff must establish standing.”
Ariz.
Christian Sch. Tuition Org. v. Winn
,
The party invoking federal jurisdiction bears the burden of establishing standing.
Lujan
,
A. Legal Framework
To establish constitutional standing, plaintiffs must show that (1) they have suffered an
“injury in fact,” (2) the injury is “fairly . . . trace[able] to the challenged action of the defendant,”
and (3) it is “‘likely,’ as opposed to merely ‘speculative,’ that the injury will be ‘redressed by a
favorable decision.’”
Lujan
,
1. Individual Standing
Individual plaintiffs must satisfy all three of the
Lujan
elements. To allege the first
element, injury in fact, plaintiffs must demonstrate that they “suffered ‘an invasion of a legally
protected interest’ that is ‘concrete and particularized’ and ‘actual or imminent, not conjectural or
hypothetical.’”
Spokeo, Inc. v. Robins
,
To be “concrete,” the injury “must actually exist,” meaning that it is real, and not abstract,
although concreteness is “not . . . necessarily synonymous with ‘tangible.’”
Id.
at 1548–49. And
*19
to be “particularized,” the injury must affect a plaintiff “in a personal and individual way.”
Id.
at
1548, quoting
Lujan
,
Further, the injury must be “actual,” or it must be “imminent” – that is, the “threatened
injury must be certainly impending to constitute injury in fact.”
Clapper v. Amnesty Int’l USA
,
To establish the second element, and show that an injury is “fairly traceable” to a
defendant’s action, a plaintiff must allege a causal connection between the alleged injury and the
defendant’s conduct at issue.
Ctr. for Law & Educ. v. Dep’t of Educ.
,
Finally, to be “redressable,” the alleged injury must be one that a court order in favor of
the plaintiff would be “likely” to address the harm.
Lujan
,
2. Organizational Standing
The standing requirements that apply to individuals also apply to organizations, such as the
two unions that are plaintiffs: AFGE and NTEU.
Nat’l Treasury Emps. Union v. United States
,
To assert organizational standing, an organization must allege “such a ‘personal stake’ in
the outcome of the controversy as to warrant the invocation of federal-court jurisdiction,” and must
show “concrete and demonstrable injury to the organization’s activities – with [a] consequent drain
on the organization’s resources – constitut[ing] . . . more than simply a setback to the
organization’s abstract social interests.”
Nat’l Taxpayers Union, Inc. v. United States
, 68 F.3d
1428, 1433 (D.C. Cir. 1995) (alterations in original), quoting
Havens Realty
,
To assert representational standing on behalf of its members, an organization must show
that “(a) its members would otherwise have standing to sue in their own right; (b) the interests it
seeks to protect are germane to the organization’s purpose; and (c) neither the claim asserted nor
the relief requested requires the participation of individual members in the lawsuit.”
Nat’l Ass’n
of Home Builders,
667 F.3d at 12, quoting
Ass’n of Flight Attendants-CWA v. U.S. Dep’t of
Transp.
,
B. Plaintiffs have Failed to Show that They have Article III Standing Plaintiffs allege that some of them have incurred actual out-of-pocket expenses, that others have expended time and effort, and that others have experienced emotional distress or may be subject to identity theft or some other harm in the future. Plaintiffs also contend that all of them have suffered the injury of the breach itself. The Court is not persuaded that the factual allegations in the complaints are sufficient to establish constitutional standing.
1. Injury in Fact
a. Theft of Private Information Without More At oral argument, counsel for the CAC plaintiffs took to the lectern to advocate a new basis for standing that had not been set forth in any prior consolidated pleading: that the release or theft of private information – as opposed to any actual or even threatened misuse of that information – is itself the injury in fact for standing purposes in a Privacy Act case. Hr’g Tr. [Dkt. # 98] at 26– 28 (“I don’t think you get to the question of imminence because we’re not talking about a risk of future injury; the injury happened; . . . . [W]e’re not premising the Court’s Article III standing on a risk of future injury, we’re premising it on an injury that has occurred and has been recognized at common law.”). In other words, if your personal information was included in the material accessed in a data breach, you automatically have standing to bring an action predicated on a violation of the Privacy Act. See NTEU Compl. ¶ 76 (alleging that harm “occurred the moment that [plaintiffs’] inherently personal information . . . was taken by unauthorized intruders from OPM’s databases”).
While one could make a compelling argument that this would be an appropriate principle
to adopt in data breach cases given the volume, sensitivity, and vulnerability of computerized
private information, the Court is not writing a law review article. Therefore, it cannot ignore the
fact that neither the Supreme Court nor the D.C. Circuit has embraced this categorical approach to
standing to date. In the absence of authority to support plaintiffs’ proposal, it is not up to the Court
to expand the constitutional limitations on its jurisdiction on its own initiative, particularly when
considerations of sovereign immunity and separation of powers concerns are also involved.
See
Spokeo
,
At the hearing, plaintiffs pointed to
Doe v. Chao
,
[T]he reference in § 552a(g)(1)(D) to ‘adverse effect’ acts as a term of art identifying a potential plaintiff who satisfies the injury-in-fact and causation requirements of Article III standing, and who may consequently bring a civil action without suffering dismissal for want of standing to sue. That is, an individual subjected to an adverse effect has injury enough to open the courthouse door, but without more has no cause of action for damages under the Privacy Act.
Id. at 624–25.
That discussion does not necessarily mean that anyone whose information was included in a data breach automatically “has injury enough to open the courthouse door;” the statutory reference to an adverse “effect” seems to imply that there is a need for individualized consequences beyond the mere fact that a release took place, and Doe himself alleged that he suffered from *23 emotional distress. [6] See id. at 617–18. And the Court in Doe did not purport to answer the question of whether the release of private information alone is an “adverse effect.”
Plaintiffs also insisted that this issue was “specifically considered” in
In re Department of
Veterans Affairs Data Theft Litigation
, No. 06-0506,
The VA plaintiffs did not rely on the fact of the breach as the foundation for their suit; they
specifically alleged that they had suffered pecuniary and emotional harm as a result of the theft,
including the cost of credit reports and credit monitoring services, and mental anguish.
VA Data
Theft Litig.
,
detailed. Id. The court simply found the general allegations of monetary harm to be sufficient, [7] and it did not predicate its decision on the mere fact that the data had gone missing. Id.
At the hearing, plaintiffs appeared to be drawing on the concepts underlying the Supreme Court’s decision in Spokeo when they maintained that they had standing simply because they were the victims of a Privacy Act violation:
As I understand the Privacy Act, it’s really codifying common law privacy protection principles . . . . [T]his isn’t like a procedural violation case because the harm has occurred upon the release, and the reason is that the underlying claim is rooted in the common law protection of privacy principles. And so it was recognized at common law that if your private information was made public or there was an intrusion on your right to seclusion, the injury occurs at that moment.
Hr’g Tr. at 26–28;
see Spokeo
,
[I]t does cause harm . . . . [T]he harm is recognized at common law. So it’s not like a situation – let’s say it’s a Truth in Lending Act claim and you have the right so some disclosure . . . [and] it never had any impact on you whatsoever. That’s Spokeo . This is different. This is a common law right to the protection of your private facts. That right is infringed at the point when the release occurs. And the causation issue doesn’t enter in . . . .
Hr’g Tr. at 28–29.
What plaintiffs are suggesting, then, is that the challenged action that makes the defendant
liable – in this case, a failure to prevent a breach – is also the harm: the loss of the data is the
whole story. But adopting that approach would collapse the standing analysis in data breach cases
7
That aspect of the
VA Data Theft
holding has limited precedential value given the
subsequent Supreme Court rulings in
Clapper
,
entirely, answering both of the injury-in-fact inquiries – is the harm actual or imminent and is it concrete and particularized? – and the causation and redressability inquiries – is the injury fairly traceable to the defendant’s unlawful action and would the relief sought cure the harm? – with a single allegation: my data was involved. Adopting such a tautological approach would effectively eliminate the requirement to establish the elements of Article III standing in data breach cases brought against the government, and while the Supreme Court may be headed in that direction, it has not arrived there yet.
A close reading of the majority opinion in the Spokeo case reveals that the Court did not relax traditional standing requirements – if anything, Spokeo reaffirmed the constitutional underpinnings of the doctrine – and it stopped short of the theory plaintiffs advance here. The holding addresses only one prong of the standing analysis – concreteness – and it left critical aspects of even that issue open for further development. While the Court opined that a violation of a statute enacted to protect rights that have traditionally been recognized in our courts could give rise to a concrete injury without more in some circumstances, it cautioned that it would not do so in all circumstances. And disappointing commentators everywhere, it left the delineation of the boundary for another day. Since isolated phrases from the opinion can point in different directions when lifted out of context, it is necessary to review the opinion of the Court in some detail. But the message to be gleaned from that analysis is that the holding underscored that an injury in fact predicated on a statutory violation – even a violation of a statute intended to protect *26 a traditionally recognized personal right – must carry with it a risk of “real harm.” [8] Spokeo , 136 S. Ct. at 1549.
Spokeo is a firm that conducts searches of computerized databases to supply visitors to its
website with information about the people they identify.
Spokeo
,
The
Spokeo
analysis begins by reciting the holding in
Lujan
that “the ‘irreducible
constitutional minimum’ of standing consists of three elements”: injury in fact, traceability, and
redressability,
id.
at 1547, quoting
Lujan
,
the multiple components of the injury-in-fact element, but it went on to discuss just the particularization and concreteness requirements. Id. at 1548–50.
The Court repeated that “for an injury to be ‘particularized,’ it must affect the plaintiff in a
‘personal and individual way.’”
Id.
at 1548, quoting
Lujan
,
How would one go about identifying an intangible harm that constitutes a concrete injury in fact? Writing for the Court, Justice Alito explained that “both history and the judgment of Congress play important roles.” Id. at 1549.
[I]t is instructive to consider whether an alleged intangible harm has a close relationship to a harm that has traditionally been regarded as providing a basis for a lawsuit in English or American courts. In addition, because Congress is well-positioned to identify intangible harms that meet minimum Article III requirements, its judgment is also instructive and important.
Id. (citations omitted). At the same time, the opinion cautioned that “Congress’ role in identifying and elevating intangible harms does not mean that a plaintiff automatically satisfies the injury-in- fact requirement whenever a statute grants a person a statutory right and purports to authorize that person to sue to vindicate that right.” Id. (emphasis added).
Article III standing requires a concrete injury even in the context of a statutory violation. For that reason, Robins could not, for example, allege a bare procedural violation, divorced from any concrete harm and satisfy the injury-in-fact requirement . . . .
Id. Turning back to the other hand, Justice Alito went on:
This does not mean, however, that the risk of real harm cannot satisfy the requirement of concreteness. For example, the law has long permitted recovery by certain tort victims even if their harms may be difficult to prove or measure. Just as the common law permitted suit in such instances, the violation of a procedural right granted by statute can be sufficient in some circumstances to constitute injury in fact. In other words, a plaintiff in such a case need not allege any additional harm beyond the one Congress has identified.
Id. (emphasis added) (emphasis and citations omitted).
Applying all of those general principles to the case before him, Justice Alito derived two conclusions: that Congress clearly intended to prevent the harm that had befallen Robins, i.e., the dissemination of false information, when it enacted the provisions that were alleged to have been violated, but that Robins could not meet the requirements of Article III standing simply by alleging a “bare procedural violation.” Id. Since it was possible that a violation of one of the statute’s procedural requirements could result in no harm, the case was remanded to the Ninth Circuit to address “whether the particular procedural violations alleged . . . entail a degree of risk sufficient to meet the concreteness requirement.” Id. at 1550.
According to plaintiffs, their allegation of a statutory violation supplies a basis for standing since they suffered the harm of an intangible violation of their privacy – a harm traditionally recognized at common law that Congress specifically intended to protect when it enacted the statute in question. Hr’g Tr. at 28–29. But that is exactly what the Supreme Court found to be insufficient in Spokeo without a further showing that real harm, albeit even intangible harm, would *29 necessarily follow. [9] And the opinion was specifically limited to a consideration of the “concrete and particularized” element of an injury in fact; the Supreme Court did not hold that once a plaintiff has alleged an injury to a traditionally recognized intangible right that satisfies the concreteness requirement, there is no longer any need to establish that the harm is actual or imminent, or to satisfy the traceability or redressability requirements.
This reading of
Spokeo
is consistent with the Circuit precedent that the Court is bound to
follow; the Court of Appeals emphasized in
Hancock v. Urban Outfitters
that
Spokeo
did not alter
the standing requirements. “
Spokeo
held that plaintiffs must have suffered an actual (or imminent)
injury that is both particularized and ‘concrete . . . even in the context of a statutory violation’
. . . . For that reason, a plaintiff cannot ‘allege a bare procedural violation, divorced from any
concrete harm, and satisfy the injury-in-fact requirement of Article III.’”
Hancock
, 830 F.3d at
514, quoting
Spokeo
, 136 S. Ct. at 1549. In
Hancock,
there was no question that each of the
plaintiffs was personally involved: each had been asked to provide her zip code during the course
of a credit card transaction, and that information was entered into the retailer’s sales register.
Id.
9
Plaintiffs’ counsel attempted to differentiate
Spokeo –
“it’s not like a situation – let’s say
it’s a Truth in Lending Act claim and you have some right to some disclosure and you never saw
the disclosure . . . it never had any impact on you whatsoever. That’s
Spokeo
. . . .” – but that
characterization of the case was incorrect. Hr’g Tr. at 28–29. In
Spokeo,
Justice Alito specifically
found that the complained of action
did
intrude on Robins’s privacy rights, and he still resisted
concluding that Robins automatically had standing, finding that the violation of a statutorily
imposed procedure might not necessarily carry with it a risk of real harm that would satisfy the
concreteness requirement.
Spokeo
,
at 512. But the Court was clear that the allegation of a violation of the District of Columbia’s Consumer Protection Act was not enough to create an injury in fact absent any allegation of a concrete consequence:
The Supreme Court has been clear that the legislature “cannot erase Article
III’s standing requirements by statutorily granting the right to sue to a
plaintiff who would not otherwise have standing” . . . . Instead, an asserted
injury to even a statutorily conferred right “must actually exist,” and must
have “affect[ed] the plaintiff in a personal and individual way.”
Id.
at 514,
[10]
quoting
Spokeo
,
Plaintiffs seemed to find support in Justice Thomas’s concurring opinion in
Spokeo
, Hr’g
Tr. at 28
,
but Justice Thomas did not address the precise situation before the Court either. In
agreeing with the decision to remand, he differentiated between a suit brought by an individual to
vindicate a private right, and a suit seeking to vindicate a public right – a demand that a federal
agency “follow the law.”
Spokeo
,
Article III injury in fact.” Id. at 1554 (Thomas, J., concurring). [11] Neither alternative quite mirrors the situation of a private plaintiff suing a federal defendant to vindicate a private right.
But more important, even if one assumes that the principles reviewed by the Justices would apply equally to cases against the government, the Spokeo discussion arose in the context of a statute that creates a private right of action for a statutory violation without the need for a showing of harm. See id. at 1553 (Thomas, J, concurring) (“Congress can create new private rights and authorize private plaintiffs to sue based simply on the violation of those private rights . A plaintiff seeking to vindicate a statutorily created private right need not allege actual harm beyond the invasion of that private right.”) (emphasis added) (citation omitted); see also id. at 1549 (“[T]he violation of a procedural right granted by statute can be sufficient in some circumstances to constitute injury in fact . . . . [A] plaintiff in such a case need not allege any additional harm beyond the one Congress has identified .”) (first emphasis in original, second emphasis added).
The Privacy Act is not that sort of statute. Congress carefully limited the remedies that
would be available in a Privacy Act case, and it specifically added the requirement of a showing
of actual harm beyond the statutory violation and its impact on one’s privacy before the
government would be required to answer in Court. So even if the Court were inclined to read the
tea leaves and predict that the Supreme Court will eventually find that the bare allegation that a
plaintiff was a victim of a data breach, without more, is enough to create standing to sue under the
Privacy Act given the privacy rights involved, the victory for plaintiffs would be a hollow one.
Because notwithstanding any invasion of privacy, before the Court may pierce the shield of
sovereign immunity and exercise jurisdiction, it must consider still whether the complaint
11 The Court notes that the dissenters were of the firm belief that Robins had standing.
Spokeo
,
plausibly alleges that the named plaintiffs suffered the actual damages necessary to require the government to submit to a Privacy Act claim, and as set forth further below, it does not.
And finally, even if the Court were to find that there is standing to sue under the Privacy
Act because Congress authorized plaintiffs to sue to vindicate their private rights in that Act, that
would only confer standing to bring the Privacy Act claim. Contrary to plaintiffs’ suggestion,
see
Hr’g Tr. at 30,
[12]
it would not open the door for plaintiffs to advance the APA claims based on
OPM’s violation of the Federal Information Security Management Act (“FISMA”).
See Cuno
,
For all of these reasons, in the Court’s view, standing in this case must rise or fall on the sufficiency of the allegations of actual or future harm set forth in the complaint, and it is necessary to undertake that analysis. [13]
b. Actual Identity Theft or Fraudulent Credit Card Activity Twenty plaintiffs allege that they have already experienced identity theft or have been the victims of financial fraud. They describe unauthorized charges made to existing accounts or accounts fraudulently opened in their names, unauthorized inquiries made concerning their credit, fraudulent tax returns filed in their names, or other improper uses of their credit card or Social 12 “I thought standing was a gatekeeping doctrine that says, Do you have a right to be in court? . . . [T]o me, once you’re in court, if you read cases, courts don’t go through every claim . . . in the case and analyze standing separately for each one.”
13 In any event, after the D.C. Circuit issued its opinion in Attias, and the Court called for supplemental briefing, plaintiffs reverted back to the theory articulated in their complaint: that all plaintiffs have standing based on the risk of future harm. Class Pls.’ Supp. Submission [Dkt. # 115] at 4–5.
Security numbers. CAC ¶¶ 13, 14, 16, 17, 19, 21, 24, 26, 28–32, 38, 39, 41, 45, 49, 50; NTEU Compl. ¶¶ 80–84. For example:
• Plaintiff “King-Myers provided sensitive information to the federal government and received notice from OPM that such information has been compromised in the Data Breaches. In May 2015, King-Myers learned that unauthorized charges of approximately $658 had been incurred on her debit card account. King-Myers has spent between 30 and 35 hours attempting to reverse these fraudulent transactions.” CAC ¶ 38.
• Plaintiff Ryan Lozar provided sensitive information and received notice that his information was compromised. “Lozar thereafter learned that an unknown individual had opened a PayPal account in his name and received a $1000 cash advance. He also learned that an unidentified individual had opened a Best Buy account in his name and used it to purchase $3,500 worth of merchandise.” Lozar spent many hours communicating with PayPal and Best Buy to dispute and resolve these fraudulent activities. CAC ¶ 39.
• Plaintiff Kimberly Winsor and her husband “provided sensitive personal information to the federal government and received notice from OPM that such information has been compromised in the Data Breaches. In April 2015, Winsor’s husband learned from their bank that his debit card number had been used the make unauthorized purchases in Mississippi. On July 23, 2015, Winsor learned from their bank that her debit card had been used to make unauthorized purchases in Texas. On November 24, 2015, CSID informed Winsor that her 8 year old son’s social security number had been used in California for an unknown purpose.” CAC ¶ 50. [14]
Only two of these plaintiffs allege that they incurred out-of-pocket expenses related to actual identity theft. See CAC ¶ 22 (plaintiff “paid approximately $198 to a credit repair law firm for assistance in closing the fraudulent accounts and removing them from her credit report” and “expended approximately $50 to obtain copies of her credit report”); CAC ¶ 41 (plaintiff purchased credit repair services). None of the plaintiffs who allege that unauthorized charges were made to their accounts allege that they were held financially responsible for the charges, see CAC ¶¶ 13, 16, 19, 22, 28–31, 38–39, 41, 45, 49, 50; NTEU Compl. ¶ 80–84, and none who 14 The complaint does not specifically allege that the son’s Social Security number was included in the “sensitive information” provided to the federal government in connection with Winsor’s employment.
experienced other attempts to utilize their identity alleged that they incurred out-of-pocket costs other than fees paid to purchase credit monitoring, which will be addressed separately below.
A number of courts have held that to base standing on past actual harm, plaintiffs in a data
breach case must allege not only that their personal data was misused, but also that they suffered
economic loss as a result.
See, e.g.
,
Whalen v. Michael Stores Inc.
,
Other courts, including some in this district, have held that allegations that plaintiffs’ data
was misused state an injury in fact, even in the absence of any allegation that they suffered financial
consequences as a result.
See In re Sci. Applications Int’l Corp. Backup Tape Data Theft Litig.
,
There is no controlling authority on whether plaintiffs alleging actual harm must allege
economic losses from a data breach to show injury in fact. The D.C. Circuit’s recent opinion in
Attias v. CareFirst
dealt with allegations of future harm only, and did not directly address the
question.
c. Future Identity Theft and Other Future Harms The CAC alleges generally that the defendants’ actions “placed millions of government workers at a heightened risk of identity theft.” CAC ¶ 210; see also NTEU Compl. ¶ 92. The CAC plaintiffs allege that as a group, they face an increased risk of experiencing a host of injuries, including: “money and time expended to prevent, detect, contest, and repair identity theft [and] *36 fraud;” “money and time expended to order credit reports and place temporary freezes on credit, and to investigate options for credit monitoring and identity theft protection services;” and “lost opportunity costs and loss of productivity from efforts to mitigate and address the adverse effects of the Data Breaches.” CAC ¶ 163.
Numerous individual plaintiffs predicate injury in fact on the likelihood of possible harm in the future. For example:
• Plaintiff Myrna Brown provided sensitive information in an SF 86 form in connection with her employment with the Commerce Department, and she has received notice from OPM that her data was compromised. “Her exposure to the Data Breaches has caused Brown to review her financial accounts with greater frequency. Brown now also reviews her credit reports with greater frequency. Additionally, Brown suffers stress resulting from fear that the theft of her sensitive personal information will impair her ability to obtain future federal employment or security clearances, and fear for the safety of her family members who serve in the military. CAC ¶ 18.
• Plaintiff Maryann Hibbs “works as a Registered Nurse at the Veterans Health Administration, where she has been employed for approximately 23 years.” Hibbs also previously served in the Army National Guard. Hibbs provided sensitive information to the federal government and received notice from OPM that such information has been compromised in the Data Breaches. Hibbs suffers stress resulting from concerns for her personal safety and that of her family members.” CAC ¶ 35.
• Plaintiff Robert Slater, who currently serves in the Army, “suffers stress resulting from concerns that the theft of his sensitive personal information will impair his ability to obtain a higher security clearance, or future employment with a government contractor when he leaves the Army. His exposure to the Data Breaches has also caused Slater to review his financial accounts and credit reports with greater frequency to detect fraudulent activity. CAC ¶ 46.
Some plaintiffs claim to be suffering from stress now due to a fear of identity theft, physical harm, or some unspecified threat to their safety in the future, CAC ¶¶ 18–19, 22–25, 28, 30–31, 35, 37, 43–44, 46, 50; NTEU Compl. ¶ 94; and others point to expenses they incurred to *37 prevent or monitor future identity theft. CAC ¶¶ 17, 21, 25, 28, 34, 40, 41. [15] The Court holds that none of these allegations sets forth an injury in fact.
Future harm is neither concrete nor imminent for standing purposes unless it is “certainly
impending,”
Pub. Citizen, Inc.
,
The D.C. Circuit recently weighed in on this issue in
Attias v. CareFirst Inc.
,
15 For some plaintiffs, the CAC describes a greater degree of attention paid to financial matters, but the allegations do not even go so far as to include the vague references to “stress” or increased concern. For example, with respect to plaintiff Ryan Bonner, the CAC alleges only that Bonner provided sensitive personal information and received notice that the information had been compromised, and that “his exposure to the Data Breaches has caused Bonner to review his credit reports and financial accounts with greater frequency.” CAC ¶ 15; see also CAC ¶ 13–14, 16–17, 20–21, 26–27, 29, 32–34, 36, 38–42, 45, 47–49.
The
Attias
case arose out of a cyberattack on CareFirst, a health insurance company. After
the data breach was reported, plaintiffs sued and predicated standing on an allegation that the
breach had exposed them to a heightened risk of identity theft in the future. The district court
concluded that the plaintiffs’ theory of injury was “too speculative” to satisfy the requirement in
Clapper
that the harm be “clearly impending,” and it dismissed the case for lack of subject matter
jurisdiction.
Attias v. CareFirst, Inc.
,
The Circuit Court reversed, stating that the Supreme Court had “clarified that a plaintiff
can establish standing by satisfying
either
the ‘certainly impending’ test
or
the ‘substantial risk’
test,”
Attias
,
Under our precedent, “the proper way to analyze an increased-risk-of-harm
claim is to consider the ultimate alleged harm,” which in this case, would
be identity theft, “as the concrete and particularized injury and then to
determine whether the increased risk of such harm makes injury to an
individual citizen sufficiently ‘imminent’ for standing purposes.”
Id.
at 627, quoting
Food & Water Watch, Inc. v. Vilsack
,
The Court then combed through the complaint to identify the allegations that made the
claim of an increased risk plausible,
id.
at 627–28, and it noted that the complaint alleged that
*39
CareFirst collected and stored sensitive information including credit card and social security
numbers.
[16]
Id.
It then concluded that the risk was more substantial than the risk presented in
Clapper
.
Id.
at 629.
[17]
The Court observed that the feared harm in
Clapper
“could only occur
through the happening of a series of contingent events, none of which was alleged to have occurred
by the time of the lawsuit.”
Id.
at 628, citing
Clapper,
Here, by contrast, an unauthorized party has already accessed personally identifying data on CareFirst’s servers, and it is much less speculative – at the very least, it is plausible – to infer that this party has both the intent and the ability to use that data for ill. As the Seventh Circuit asked, in another data breach case where the court found standing, “Why else would hackers break into a . . . database and steal consumers’ private information? Presumably, the purpose of the hack is, sooner or later, to make fraudulent charges or assume those consumers’ identities.”
Id.
at 628–29, citing
Remijas v. Neiman Marcus Grp.
,
No long sequence of uncertain contingencies involving multiple independent actors has to occur before the plaintiffs in this case will suffer any harm; a substantial risk of harm exists already, simply by virtue of the hack and the nature of the data that the plaintiffs allege was taken.
Attias
,
While the Court used broad language to announce its conclusion, its determination that the Attias allegations were sufficient cannot be separated from its repetition of the rhetorical question 16 The district court had based its ruling on the fact that the complaint did not expressly allege that social security or credit card numbers had been stolen , and it took into consideration the affidavit of the CareFirst IT Security Official who averred that the most sensitive data, such as social security and credit card numbers, was not included in the data breach. Attias , 199 F. Supp. 3d at 196 n.1, 198 n.3, 200–01.
17 The Court of Appeals also noted that the complaint alleged that the theft of the insureds’
names, in combination with their birth dates and other subscriber information, created a risk of
“medical identity theft” in which an imposter could obtain medical services in their names.
Attias
,
posed in Remijas and the Seventh Circuit’s answer. In other words, standing in Attias was predicated on the slender thread that one could fairly assume what the thieves meant to do with the stolen information. While drawing such an inference may have been logical in the case of a domestic crime directed at credit and financial information maintained by a retail establishment or a private health insurer, it is not necessarily logical here, and Attias supplies no other principle to follow.
Plaintiffs suggest that this case is “on all fours with the allegations in Attias ,” Class Pls.’ Suppl. Submission at 3, but they fail to address the fact that Attias, and the case upon which it relies, Remijas, were predicated on the theft of credit card information, which the courts inferred could be utilized by the hackers themselves to perpetrate financial fraud. Remijas , 794 F.3d at 692–93; see also Galaria v. Nationwide Mut. Ins. Co. , 663 F. App’x. 384, 388 (6th Cir. 2016) (court drew reasonable inference that the domestic criminal theft of personal information from an insurance company was for the fraudulent purposes alleged in the complaint). Moreover, in Remijas, there was clear evidence that a large number of the particular credit card numbers that had been stolen had already actually been used. Id. at 690. As the district court in Attias pointed out:
Remijas involved a data breach of Neiman Marcus’s computer systems, which compromised customers’ credit card information, social security numbers, and birth dates. Of the 350,000 credit cards whose information was potentially exposed, 9,200 “were known to have been used fraudulently.” In other words, the hackers had clearly demonstrated that they had the means and the will either to abuse the information they accessed or to sell it to others who did so.
But those allegations are absent here, and the complaint does not allege anything that even comes close.
Plaintiffs have not plausibly alleged that the means to commit credit card or bank fraud were included in this breach, since there is no allegation that those account numbers are called for in the standard forms at issue or that they are provided in the course of background investigations. The CAC alleges in paragraph 144 that the personal information provided to OPM includes “information about financial accounts” and “financial and investment records,” see also CAC ¶¶ 66, 146, and it states that job applications “include financial information.” CAC ¶ 144. But no plaintiff who alleges that he or she suffered from financial fraud, such as the unauthorized use of a credit or debit card, alleges that the card numbers or accounts that were compromised had been supplied to OPM in a government form.
Moreover, a detailed review of the forms themselves, which are specifically referenced in the complaint, see, e.g ., CAC ¶¶ 66–70, reveals that they do not ask for account-identifying information. The SF 85, the standard Questionnaire for Non-Sensitive Positions, asks no questions whatsoever concerning finances beyond calling for the identification of present and former employers. See https://www.opm.gov/forms/pdf_fill/sf85.pdf.
The more detailed SF 86, the Questionnaire for National Security Positions, does not ask applicants for their active credit or debit card numbers. The form, which is 127-pages long, finally gets to the questions related to business dealings and personal finances on page 63. See https://www.opm.gov/forms/pdf_fill/sf86-non508.pdf. And of the many questions asked, only *42 two call for account numbers of any sort, [18] and those ask about judgments against the applicant for delinquencies, or loans or credit accounts that resulted in foreclosures or cancellations for default – in other words, account numbers that are particularly unlikely to be useful for the perpetration of credit card fraud. But there is no allegation in the complaint that any of the plaintiffs who experienced an unauthorized use of a credit or debit card had provided those particular numbers on the SF 86 or that those were the accounts that were misused.
It has been noted that criminals may use stolen personal information as a step in the process
of creating false accounts or engaging in identity theft.
See SAIC
,
Page 100: Whether alcohol or drug use has had a negative impact on finances Page 106: Any filing for bankruptcy
Page 107: Financial problems due to gambling losses; any failure to pay taxes Page 108: Whether the applicant has ever been subjected to discipline or required to undergo counseling for misuse of an employer’s credit card, and whether he or she is currently using credit counseling services
Page 109: A question on this page asks if the applicant is delinquent in child support payments, or if there has been a judgment entered against him, including any obligations as a sole debtor, tax liens, or delinquencies on other debts, and in that situation, it directs the applicant filling out the form to identify the loan or account number involved.
Page 110: Similarly, a question on page 110 asks about any repossessions, loan foreclosures, loan defaults, debts sent to a collection agency, credit cards cancelled for default, or cards for which the applicant is more than 120 days delinquent, and those numbers are called for as well.
There are no additional questions in the form that seek financial information.
undertaken by a series of independent actors that is inconsistent with the imminence needed for standing. [19]
Also, while this ruling is not based on the original complaints that were consolidated and
amended in this multidistrict litigation, the Court notes that many of the plaintiffs specifically
alleged that the breaches were widely reported to have been perpetrated by the Chinese
government.
[20]
This was also the conclusion set forth in the U.S. House of Representatives
19 This is why plaintiffs’ reliance on
Khan v. Children’s Nat’l Health Sys.
, 188 F. Supp. 3d
524 (D. Md. 2016) is misplaced. Plaintiffs argued in their opposition that “put[ting] forth facts
that provide either (1) actual examples of the use of the fruits of the data breach for identity theft,
even if involving other victims; or (2) a clear indication that the data breach was for the purpose
of using the plaintiffs’ personal data to engage in identity fraud” can satisfy the clearly impending
or substantial risk standard. CAC Pls.’ Opp. at 17, quoting
Khan
,
The complaints do not suggest that “the fruits of the data breach” were used for the alleged
identity thefts because, as noted above, they do not allege that OPM or KeyPoint maintained the
account numbers that were used improperly, nor do they allege that the government forms
compromised in the breaches call for that information. The CAC states conclusorily that “[s]tolen
federal job applications and investigation forms contain . . . financial records that include bank
account and credit card information,” CAC ¶ 146, but that allegation is belied by the forms
themselves, and no individual plaintiff alleges that he or she provided a credit card, debit card, or
bank account number. One individual NTEU plaintiff alleged that through the SF 85P and 86 “he
disclosed or authorized the release to OPM of, among other information . . . financial information
(including his investment accounts),” NTEU Compl. ¶ 6; another simply alleges that “financial
information” was provided, NTEU Compl. ¶ 8; and the third individual plaintiff does not mention
finances at all. NTEU Compl. ¶ 7. And both complaints are devoid of allegations that would
provide “a clear indication that the data breach was for the purpose of using the plaintiffs’ personal
data to engage in identity fraud.”
Khan
,
20 See, e.g. , Am. Fed’n of Gov’t Emps. v. OPM , Case No. 15-1015, Compl. [Dkt. # 1] ¶ 68; Krippendorf v. OPM , Case No. 15-1321, Compl. [Dkt. # 1] ¶¶ 61, 73; Robbeloth v. OPM , Case No. 15-1449, Compl. [Dkt. # 1] ¶¶ 63, 75; Brown v. OPM , Case No. 15-1564, Compl. [Dkt. # 1] ¶ 67; Bonner v. OPM , Case No. 15-1617, Compl. [Dkt. # 1] ¶¶ 3 n.4, 54 n.30 (citing press articles); Waid v. OPM , Case No. 15-1653, Compl. [Dkt. # 1] ¶¶ 63, 76; Woo v. OPM , Case No. 15-1752, Compl. [Dkt. # 1] ¶ 63; Cavis v. OPM , Case No. 15-1810, Compl. [Dkt. # 1] ¶¶ 63, 76; Smith v. OPM , Case No. 15-1835, Compl. [Dkt. # 1] ¶ 71; Hobbs v. OPM , Case No. 15-1927, Compl. [Dkt. # 1] ¶ 63; Hanagan v. OPM , Case No. 15-1933, Compl. [Dkt. # 1] ¶ 57; Fleishell v. OPM , Case No. 15-2089, Compl. [Dkt. # 1] ¶¶ 7, 81; Golden v. OPM , Case No. 16-1253, Compl. [Dkt. # 1] ¶ 80.
Committee on Oversight and Government Reform transmitting the result of a formal investigation into the OPM breach. See The OPM Data Breach: How the Gov’t Jeopardized Our Nat’l Sec. for More than a Generation, Comm. on Oversight and Gov’t Reform, U.S. House of Reps., 114th Congress, Sept. 7, 2016 (“Congressional Report”), at iii, vi, 157. And, while the administration may have been officially circumspect at the time, possibly in light of the classified nature of the information, the state-sponsored nature of the attack was discussed publicly by some individual knowledgeable federal officials. See Paul Coyer, U.S. Gov’t Data Breach Exemplifies China’s Cyber Insecurities , Forbes Mag., Jul. 19, 2015 (“The Obama White House has been careful to not formally name China as the perpetrator, yet private security firms which have long experience tracking Chinese cyber activities, Members of Congress who have been briefed by intelligence officials, and even James Clapper, the Director of National Intelligence, have all pointed to China as the likely source of the hacking.”); Ellen Nakashima, Chinese government has arrested hackers it says breached OPM database , Wash. Post, Dec. 2, 2015. Also, it does not appear that the theory has been revised or abandoned since that time. See Devlin Barrett, Chinese National Arrested for Allegedly Using Malware Linked to OPM Hack, Wash. Post, Aug. 24, 2017. While a finding concerning the source of the breach is beyond the scope of this proceeding at this juncture, these *45 circumstances render the Court unable to rely upon the presumption that animated the Attias and Remijas decisions. [21]
So here, we do have a situation where a “long sequence of uncertain contingencies
involving multiple independent actors has to occur before the plaintiffs in this case will suffer any
harm,”
Attias
,
There is no question that plaintiffs have plausibly alleged that the building blocks of some
forms of identity theft – social security numbers coupled with names, birthdates, and addresses
– were included in the cache of information that was taken from OPM. But the Consolidated
Amended Complaint does not point to any particular objective behind the breach beyond the claim
that it was carried out to obtain sensitive data for an unspecified “improper use.” CAC ¶¶ 7, 117,
128, 132. Neither complaint directly alleges, or marshals any facts that would support an
inference, that those behind this attack are likely to use the information for credit card fraud or
21
These circumstances further differentiate this case from
Khan,
Plaintiffs contend that they have shown injury in fact anyway because they allege that the
breaches were “a targeted and malicious attack,” and not an inadvertent part of an ordinary
burglary such as the theft of the laptop in the
SAIC
case. CAC Pls.’ Opp. at 17–18, citing
Pisciotta
v. Old Nat. Bankcorp
,
In
Pisciotta
, the Seventh Circuit did not rely on the nature of the hack when ruling that
plaintiffs had standing; it simply disagreed with the line of cases requiring plaintiffs whose data
has been compromised to experience a misuse of the data in order to state an injury in fact.
23 While the Court is bound to accept the factual allegations in the consolidated amended complaint as true, and to resolve any inferences in plaintiffs’ favor, it is not required to draw inferences or “presume” circumstances that are not supported by the available public record – which was cited heavily in plaintiffs’ own previous allegations – on the matter.
to infer that plaintiffs now face a substantial risk of identity theft based on the allegations in the complaint.
As for the plaintiffs who allege a risk of future bodily injury or express concerns for their personal safety, CAC ¶¶ 13, 18, 22–26, 35, 37, 43, 44, the complaint is devoid of allegations that would give rise to a plausible conclusion that the threat is clearly impending or that the risk became significant as a result of the breach. [24]
With respect to plaintiffs’ purchases of credit monitoring and other services to avoid future
identity theft, those expenditures also do not constitute an injury in fact either. CAC Pls.’ Opp. at
15 (arguing that plaintiffs “reasonably paid to protect themselves” from future injury). It is well-
established that incurring “certain costs as a reasonable reaction to a risk of harm” does not provide
for injury if “the harm [plaintiffs] seek to avoid is not certainly impending. In other words,
respondents cannot manufacture standing merely by inflicting harm on themselves based on their
fears of hypothetical future harm that is not certainly impending.”
Clapper
,
anxiety does not create standing.
SAIC
,
In sum, the Court holds that only the two plaintiffs who alleged that they incurred expenses to rectify the actual fraud or identity theft they experienced, CAC ¶¶ 22, 41, have alleged injury in fact.
2. Causation This does not end the standing analysis. Those plaintiffs, as well as any other plaintiffs who experienced some sort of identity theft event without an economic loss, lack standing because their alleged injuries are not “fairly traceable” to defendants’ challenged actions. Lujan , 504 U.S. at 560. Plaintiffs maintain that all they need to allege to show causation is that defendants failed to secure their personal information, hackers stole it, and plaintiffs “consequently were subjected to actual and imminent harm.” CAC Pls.’ Opp. at 23 (“Nothing further is required at this point to show that the harm is plausibly traceable to Defendants’ misconduct.”). But the allegations in the complaint do not even rise to the level of “consequently” – plaintiffs repeatedly allege that the breach occurred and an unauthorized use of personal information occurred “thereafter.” And while the short discussion of causation at the conclusion of the Attias decision may lend some support to plaintiffs’ legal position, see Attias , 865 F.3d at 629, the Court finds that neither complaint plausibly alleges any connection between the OPM breaches and the claimed harm.
Plaintiffs allege that OPM’s failures enabled unknown third parties not before the Court to access their personal information, and they also allege that in some instances, plaintiffs’ personal information has been used improperly by unknown parties. As the district court pointed out in Food & Water Watch v. EPA :
The Supreme Court has stated that “[w]hen the suit is one challenging the
legality of government action or inaction . . . [and] a plaintiff’s asserted
injury arises from the government’s allegedly unlawful regulation of
someone else . . . it becomes the burden of the plaintiff to adduce facts
showing that those choices have been or will be made in such a manner as
to produce causation and permit redressability of injury.”
It is true that in the
Attias
case, the D.C. Circuit concluded, “[b]ecause we assume, for
purposes of the standing analysis, that plaintiffs will prevail on the merits of their claim that
CareFirst failed to properly secure their data and thereby subjected them to a substantial risk of
identity theft, we have little difficulty concluding that their injury in fact is fairly traceable to
CareFirst.”
Attias
,
“Generally, to prove that a data breach caused identity theft, the pleadings must include allegations of a nexus between the two instances beyond allegations of time and sequence.” Resnick v. AvMed, Inc. , 693 F.3d 1317, 1326 (11th Cir. 2012). But allegations of time and sequence are all that plaintiffs provide here: they allege that the breaches occurred and that plaintiffs then learned of the identity theft. See CAC ¶ 16 (“Bos . . . received notice from OPM . . . . Bos thereafter learned that an unauthorized credit card account had been opened in his name.”); CAC ¶ 30 (plaintiff provided personal information to the federal government, learned of the data breaches, and was “thereafter” informed of unauthorized charges on his debit card); [25] CAC ¶ 14 (plaintiff provided sensitive personal information to the federal government, learned his information has been compromised in the data breaches, and later learned of a false tax return using his and his wife’s personal information); see also CAC ¶¶ 17, 19, 24, 26, 28–32, 38, 41, 49, 50; NTEU Compl. ¶¶ 66–72, 79–84 (alleging that NTEU plaintiffs submitted “inherently personal information” to OPM, were notified that they were affected by the data breaches announced on June 4 and June 12, 2015, and that plaintiff Gambardella had three fraudulent credit card charges and a fraudulent 2015 tax return filed in his name). [26] The Attias Court was able to point to 25 Some allegations do not even include the “thereafter,” but simply state that the breach occurred and certain financial irregularities – for which dates are not always provided – also occurred. See CAC ¶ 13 (“Plaintiff Travis Arnold . . . received notice from OPM . . . . In May 2015, while reviewing his bank statement, Arnold discovered an unauthorized charge . . . .” And “[w]hile reviewing his credit report, Arnold also learned that between six and ten unauthorized inquiries regarding his credit had been made.”).
26 The NTEU complaint does not allege that plaintiffs Howell or Ortino experienced actual identity theft. See NTEU Compl. ¶¶ 85–86.
allegations that customers gave CareFirst their credit card information,
Attias
,
Moreover, the events alleged to have occurred after the breach are separated across time and geography, and they follow no discernible pattern: there are a handful of false income tax returns mixed in with such occurrences as a debit card charge here, a charge to a PayPal account (which requires a password) there, several new credit inquiries, the creation of a new cellular phone account, and the cancellation of an account with a local utility. One cannot easily construct any kind of colorable theory that would link these events together, especially given the absence of evidence that the account numbers utilized here were ever provided to OPM. The Court therefore holds that these sets of allegations that two things happened in sequence are not sufficient to show causation.
In addition, to hold defendants accountable for plaintiffs’ alleged injuries, the Court would
have to presume that the vast majority of identity thefts plaintiffs experienced were not perpetrated
by other criminals or were not the result of data breaches of other entities.
[27]
Such a presumption,
with no factual predicate in the complaints besides allegations based on chronology, stretches the
notion of traceability in this case beyond constitutional limits, particularly given how common
identity theft is in the digital age.
See SAIC
,
twenty of the CAC plaintiffs alleging some form of fraud: 20 out of 21.5 million is 0.00009 percent.
In the end, plaintiffs can point to nothing that would begin to connect this hack to such
random events as an unauthorized spending spree at Best Buy.
See
CAC ¶ 39. Since plaintiffs’
allegations of fraudulent financial activity are based on pure speculation about the actions of a
chain of unknown third-party wrongdoers who are not before the Court, they are insufficient to
establish standing.
See Clapper
, 568 U.S. at 414 (expressing the Court’s “usual reluctance to
endorse standing theories that rest on speculation about the decisions of independent actors”).
Plaintiffs have not satisfied their burden to adduce facts showing that the choices of third parties
“have been or will be made in such manner” to show causation as to OPM or KeyPoint.
Lujan
,
For all of these reasons, the Court holds that neither the CAC nor NTEU plaintiffs have Article III standing, and it will grant defendants’ motions to dismiss for lack of subject matter jurisdiction pursuant to Rule 12(b)(1).
The Court recognizes, particularly in light of the recent decision in Attias , that standing is a very close and difficult question in this case. But there are other significant challenges to subject matter jurisdiction to contend with. Even if plaintiffs have standing, they must establish that there has been a waiver of sovereign immunity that would give the Court authority to hear a claim against the United States, and the bulk of the Privacy Act claims and the APA claim fail for that reason. Furthermore, as a government contractor, KeyPoint also enjoys sovereign immunity, and there is no applicable exception that would allow the lawsuit against the firm to go forward. And in the end, the few CAC plaintiffs who can invoke the Privacy Act fail to state a claim, the CAC *53 complaint fails to state a claim under the Little Tucker Act, and the NTEU plaintiffs fail to state a constitutional claim.
II. Plaintiffs’ Claims Cannot Proceed.
A. Claims Against OPM
1. Plaintiffs’ Privacy Act claims must be dismissed.
The CAC plaintiffs’ first count against OPM alleges that the agency violated the Privacy
Act. CAC ¶¶ 175–85. This act “regulate[s] the collection, maintenance, use, and dissemination
of information” by federal agencies, Privacy Act of 1974, § 2(a)(5), 88 Stat. 1896 (codified at
5 U.S.C. § 552a), setting detailed requirements on how agencies should manage their records.
5 U.S.C. § 552a(e). It provides “civil relief to individuals aggrieved by failures on the
Government’s part to comply with [the Act’s] requirements,”
Doe v. Chao
,
Plaintiffs assert that the agency “willfully and intentionally failed to comply with [the Federal Information Security Management Act]” which “adversely affected Plaintiffs and Class members.” CAC ¶ 178. In doing so, they contend, OPM violated both the disclosure provision, CAC ¶ 183, and the safeguards provision, CAC ¶ 182, of the Privacy Act.
a. All but two CAC plaintiffs fail to plead actual damages, and therefore the Court lacks subject matter jurisdiction to hear their claims.
The term “actual damages” under the Act is “limited to proven pecuniary or economic harm.” FAA v. Cooper , 566 U.S 284, 299 (2012); see also Earle v. Holder , No. 11-5280, 2012 *54 WL 1450574, at *1 (D.C. Cir. Apr. 20, 2012) (unpublished) (“[B]ecause nothing in appellant’s pleadings could be construed as alleging he sustained pecuniary loss as a result of the [defendant’s] alleged Privacy Act violation, the district court correctly determined he was not entitled to damages.”).
Reading the complaint in the light most favorable to plaintiffs, the Court finds that all but two plaintiffs fail to allege facts that support a plausible inference that they sustained actual damages within the meaning of the Act. Plaintiffs who allege unauthorized charges on their financial accounts do not allege any out-of-pocket or unreimbursed costs resulting from the thefts, see CAC ¶¶ 13, 19, 29, 30, 38, 41, 50, so they have not alleged “actual damages” within the meaning of the Act. Further, most plaintiffs alleging other forms of identity theft, such as fraudulent tax returns or the improper use of Social Security numbers, allege that they spent time, but not money, addressing these events. See CAC ¶ 13, 14, 16, 17, 21, 24, 26, 28, 29, 31, 32, 39, 45, 49, 50. The plaintiffs who alleged emotional distress arising from the breaches, see, e.g. , CAC ¶¶ 22, 41, do not allege “actual damages” under the Act. Cooper , 566 U.S at 299, 304. And those plaintiffs who purchased credit monitoring services or incurred other expenses to prevent future identity theft, CAC ¶¶ 17, 21, 25, 28, 34, 40, 41, have not suffered actual damages because expenditures undertaken voluntarily to prevent possible future harm do not constitute actual damages attributable to OPM. See 5 U.S.C. § 552a(g)(4); Welborn, 518 F. Supp. 3d 82 fn.2 (holding that the plaintiffs’ decisions “to spend money on credit monitoring services to prevent potential future harm does not allege actual damages attributable to the [agency]” under the Privacy Act). Therefore, none of these plaintiffs has alleged facts that would support the waiver of sovereign immunity needed to give this Court jurisdiction to hear their claims.
The two plaintiffs who spent money to address actual identity theft did allege “actual damages” under the Act. See CAC ¶¶ 22, 41. But their disclosure provision claim fails under Rule 12(b)(6) because it does not plausibly allege that OPM “disclosed” private information as that statutory term has been defined by the D.C. Circuit, and their safeguards provision claim fails because they have not pled sufficient facts to allege that their injuries were “a result of” OPM’s actions.
b. The disclosure provision claim fails because OPM did not intentionally or willfully disclose plaintiffs’ information within the meaning of the Act.
Plaintiffs allege that OPM violated the disclosure provision of the Privacy Act. CAC ¶ 183. This provision prohibits a federal agency from disclosing “any record . . . contained in a system of records” without the written consent of the “individual to whom the record pertains.” 5 U.S.C. § 552a(b). But this claim fails because it hinges on the act of third-party cyber criminals who hacked OPM’s systems and were outside of OPM’s control. CAC ¶¶ 114–37.
The D.C. Circuit has held, upon review of the Act’s “purposes, legislative history, and
integrated structure . . . that Congress intended the term ‘disclose’ to apply in virtually all instances
to an agency’s unauthorized transmission of a protected record, regardless of the recipient’s prior
familiarity with it.”
Pilon v. U.S. Dep’t of Justice
,
c. While plaintiffs have alleged a willful violation of the safeguards provision of the Privacy Act, their claim fails because they do not allege sufficient facts to show that their injuries were “a result of” OPM’s conduct.
Plaintiffs also contend that OPM violated the safeguards provision of the Act. CAC ¶ 182.
This provision requires federal agencies to “establish appropriate administrative, technical, and
physical safeguards” to protect agency records. 5 U.S.C. § 552a(e)(10). To be an “intentional or
willful” violation of this provision of the Privacy Act, an agency’s actions must be “greater than
gross negligence.”
Waters v. Thornburgh
,
Courts have held that allegations that an agency has been warned “of recurring, systemic,
and fundamental deficiencies in its information security . . . if proven, would support a finding that
defendants were warned of the deficiencies in their information security but failed to establish
proper safeguards.”
Hawley
,
Plaintiffs here allege that OPM was warned repeatedly by its Office of Inspector General
that the agency’s computer security was deficient. CAC ¶¶ 84–113 (alleging that OPM was
warned of information security deficiencies, including that it “fail[ed] to implement or enforce
multi-factor authentication,” “failed to promptly patch or install security updates for its systems,”
*57
“lacked a mature vulnerability scanning program to find and track the status of security
weaknesses . . . and failed to continuously monitor the security controls of its software systems,”
and “failed to engage in appropriate oversight of its contractor-operated systems”). They also
allege that its failure to correct these specific deficiencies identified by the Inspector General
“enabled hackers to access and loot OPM’s systems for nearly a year without being detected,”
CAC ¶ 134; that “inadequate patching of software systems contributed to the [breaches],” CAC ¶
135; and that “OPM’s failure to implement . . . tiered identity management controls for system
administrators exposed hundreds of its sub-networks, instead of a single sub-network, to breach,”
and if it implemented such controls, “the intrusion would have been detected earlier and the cyber
thieves prevented from accessing the entire OPM network.” CAC ¶ 137. Assuming the truth of
the allegations in the complaint, as required when resolving a motion to dismiss, the Court holds
that these factual statements do allege that OPM acted in an “intentional or willful” manner.
See
Hawley
,
But the allegations still fail to state a claim because they plead facts insufficient for the
Court to plausibly infer that OPM’s failure to comply with the safeguards provision “ha[d] an
adverse effect” on plaintiffs, 5 U.S.C. § 552a(g)(1)(D), or that their damages are “as a result of”
the agency’s failures. 5 U.S.C. § 552a(g)(4)(A).
See, e.g.
,
Lugo v. U.S. Dep’t of Justice
,
The two plaintiffs who allege actual damages make only a temporal connection between the OPM breaches and their damages. See CAC ¶ 22 (alleging that plaintiff was notified of the breaches, that in August of 2015, the FBI informed her “that her [government investigation *58 information] had been acquired by the so-called Islamic State of Iraq and al-Sham,” and that while reviewing her credit report at an unspecified time, she discovered accounts had been fraudulently opened in her name and she purchased credit repair services and a copy of her credit report); CAC ¶ 41 (alleging that plaintiff was notified of the breaches; in June of 2015, she learned of fraudulent activity related to her account with an electrical utility; “additionally,” she learned of fraudulent purchases on her debit card and two credit cards; and she purchased credit monitoring and repair). For the same reasons that plaintiffs do not plead injuries traceable to OPM for standing purposes, these allegations of problems that arose after the breaches are insufficient to plausibly allege that OPM’s actions “ha[d] an adverse effect” on them or that that their identify thefts were “a result of” the OPM’s actions or the breaches. Plaintiffs do not allege that OPM obtained or stored the account numbers that were improperly used – neither complaint alleges that the government was in possession of anyone’s debit card number. And the facts alleged, as well as public statements about the breaches, suggest the attacks were not made for the purpose of ringing up retail charges or defrauding the electric company. Thus, it is equally if not more possible that plaintiffs’ damages were the result of other criminal activities unrelated to the OPM breaches, and plaintiffs fail to allege facts, as opposed to conclusions, that would tie them to OPM.
Therefore, the Court will dismiss the few claims under Privacy Act over which it arguably has jurisdiction for failure to state a claim under Federal Rule of Civil Procedure 12(b)(6).
2. Plaintiffs fail to state a claim under the Little Tucker Act. CAC plaintiffs’ second count alleges that OPM violated the Little Tucker Act, 28 U.S.C. § 1346. This act authorizes a “civil action or claim against the United States, not exceeding $10,000 in amount, founded . . . upon any express or implied contract with the United States.” Id. § 1346(a)(2). But in this case, there is no contract.
Plaintiffs allege in connection with federal employment that, along with all class members who completed SF 85 and SF 86 forms, they were in a contractual relationship with OPM. CAC ¶ 192. The contractual claim is based on the fact that each form contains a statement advising job applicants that the information called for “will be protected from unauthorized disclosure.” See, e.g. , SF 86 at 2. It also warns that the information “may be disclosed without your consent . . . as permitted by the Privacy Act [5 U.S.C. § 552a(b)], and by routine uses,” and each form lists eleven permitted uses. CAC ¶¶ 68–69; see, e.g. , SF 86 at 2. Plaintiffs assert that they relied on their “reasonable expectation and understanding that OPM was agreeing to prevent the disclosure of such information to unauthorized third parties and/or for improper purposes,” and that OPM breached this agreement. CAC ¶¶ 192–93.
The statements in these forms, however, do not create a contract between plaintiffs and
OPM because a pre-existing legal duty cannot form the basis for a contract.
Allen v. United States
,
100 F.3d 133, 134 (Fed. Cir. 1996) (“Performance of a pre-existing legal duty is not
consideration.”), citing Restatement (Second) of Contracts § 73 (1981) (“Performance of a legal
duty owed to a promisor which is neither doubtful nor the subject of honest dispute is not
consideration[.]”);
Floyd v. United States
,
Plaintiffs contend that defendants’ reference to the Privacy Act obligations in the forms overlooks OPM’s separate duty to protect submitting information “from unauthorized disclosure.” CAC Pls.’ Opp. at 106 (quoting forms and arguing “[t]his promise stands by itself” and “is not *60 defined by reference to the Privacy Act”). But the single sentence merely acknowledges OPM’s obligation to handle the information on the forms in accordance with federal law.
In any event, plaintiffs fail to allege facts to support the plausible inference of a contract.
There is no offer because government forms are not considered binding contracts.
See, e.g.
,
Chattler v. United States
,
3. The Court lacks subject matter jurisdiction to hear plaintiffs’ claim under the APA.
The third count in the Consolidated Amended Complaint seeks declaratory and injunctive relief under the APA for OPM’s alleged violations of the Privacy Act and FISMA. CAC ¶ 198 (alleging that “OPM acted arbitrarily and capriciously, [and] abused its discretion” when it violated the Privacy Act, FISMA, and regulations and technical standards for data security). Plaintiffs allege a series of failures by OPM relating to the operation of its computer and software systems, both before its systems were breached and after. CAC ¶¶ 200, 202.
The APA may serve as the waiver of sovereign immunity for claims brought by an
individual who “suffer[ed a] legal wrong because of agency action, or [was] adversely affected or
aggrieved by agency action.” 5 U.S.C. § 702. It cannot, however, be invoked when another statute
*61
“expressly or impliedly forbids the relief which is sought.”
Id.
The Privacy Act limits the
injunctive relief available under the statute to an order that an agency correct inaccurate,
incomplete, irrelevant, or untimely records, 5 U.S.C §§ 552a(g)(1)(A), (2)(A), or give individuals
access to their records.
Id.
§ 552a(g)(1)(B). No other forms of injunctive relief are available to
plaintiffs for violations of the Act.
See Edison v. Dep’t of Army
,
Plaintiffs’ assertions that OPM’s violations of the FIMSA warrant judicial review under
the APA are similarly unavailing. The APA provides for judicial review of all “final agency action
for which there is no other adequate remedy in a court,” 5 U.S.C. § 704, except when “statutes
preclude judicial review” or the “agency action is committed to agency discretion by law.”
Id.
§ 701(a). FISMA requires federal agencies to comply with information “security standards and
conduct annual, independent evaluations of their information security.”
Trusted Integration, Inc.
v. United States,
carrying out its FISMA obligations.”). The Court holds that OPM’s actions in carrying out the
statute’s requirements is committed to the agency’s discretion, and not subject to judicial review
under the APA.
Welborn
,
4. The NTEU plaintiffs fail to state a constitutional claim. The NTEU plaintiffs have brought just one claim on behalf of themselves and the NTEU members whose personal information was exposed by the breaches: that OPM violated their constitutional right to informational privacy. NTEU Compl. ¶¶ 95–98. The Court holds that the NTEU complaint fails to allege a legally cognizable constitutional claim.
Legal authority on the existence of a constitutional right to informational privacy is limited.
The Supreme Court has addressed the matter in only three cases, and in those cases, it assumed
– but did not expressly recognize – the existence of such a legal interest.
See NASA v. Nelson
, 562
U.S. 134, 138 (2011);
Nixon v. Adm’r of Gen. Servs.
,
In Whalen , the Supreme Court considered a challenge to a New York statute that required physicians and pharmacists to report prescription information for certain narcotics to the state health department, which would maintain the information in a centralized computer file. 429 U.S. at 593. The plaintiffs expressed a fear that the computerized data would be misused, and they claimed that the statute invaded a constitutionally protected “zone of privacy,” which included an “individual interest in avoiding disclosure of personal matters” and an interest in the right to make *63 important individual decisions independently. Id. at 598–600. But the Court found that the New York program did not pose a threat to either interest. Id. In a “word about issues we have not decided,” the Court observed that the government’s right to collect and use private data for public purposes is “typically accompanied by a concomitant statutory or regulatory duty to avoid unwarranted disclosures,” and “that in some circumstances, that duty arguably has its roots in the Constitution.” Id. at 605. But since it found that the New York statute reflected “a proper concern with, and protection of, the individual’s interest in privacy,” and that no right or liberty protected by the Constitution had been invaded, the Court pointedly stated: “[w]e therefore need not, and do not, decide any question which might be presented by the unwarranted disclosure of accumulated private data whether intentional or unintentional or by a system that did not contain comparable security provisions.” Id. at 605–06.
In
Nixon
, the Court rejected a constitutional challenge to the Presidential Recordings and
Materials Preservation Act, 44 U.S.C. § 2111, which compelled the President to turn over his
Presidential papers and recorded conversations for review, and which the President claimed would
violate his constitutional right to privacy.
Finally, in
NASA
, the Court held that challenged portions of the federal government’s
standard background investigation did not violate any constitutional right to informational privacy,
emphasizing that the Privacy Act “covers all information collected during the background-check
process” and imposes obligations for nondisclosure and criminal liability for willful violations of
those obligations.
Faced with this lack of definitive guidance from the Supreme Court, the D.C. Circuit has
simply assumed in cases involving the collection of information that keeping one’s information
private may have a constitutional dimension, and it has not gone on to resolve the issue.
See
,
e.g.
,
Franklin v. Dist. of Columbia
,
“enter the fray by concluding that there is no such constitutional right.”
Given this reticence on the part of the higher courts, and the absence of binding precedent
one way or the other, this Court also finds it prudent to avoid wading into the legal waters
surrounding the existence or scope of any constitutional right to informational privacy in general
when it is not necessary to do so. And it is not necessary here because the NTEU claim is asking
the Court to recognize a constitutional violation that no court has even hinted might exist: that the
assumed constitutional right to informational privacy would be violated not only when information
is disclosed, but when a third party
steals
it.
See
NTEU Compl. ¶¶ 96–98; NTEU’s Opp. at 25–
44 (arguing that the government has an affirmative duty “grounded in the constitutional right to
informational privacy” to safeguard plaintiffs’ private data). In other words, even if an individual
who completes an SF 85 or SF 86 has a constitutional right to privacy in the information he or she
is being asked to provide, it is well-established that the government has the right to gather that
information. And even if it might violate the Constitution for the government to then deliberately
disclose the information,
[30]
there is no authority for the proposition that the Constitution gives rise
to an affirmative duty – separate and apart from the statutory requirements enacted by Congress
– to protect the information in any particular manner from the criminal acts of third parties.
See,
e.g., Harris v. McRae,
Amendment and declining to “translate the limitation on governmental power implicit in the Due Process Clause” into an affirmative obligation on the government).
At bottom, what the NTEU plaintiffs allege is a violation of the Privacy Act, see NTEU Compl. ¶ 97 (“By failing to heed the repeated warnings of OPM’s OIG and otherwise failing to satisfy obligations imposed on her by statute and other appropriate authority, the Defendant has manifested reckless indifference to her obligation to safeguard personal information . . . .”), but they have not brought a Privacy Act claim or alleged the facts that would enable them to do so, and they cannot find support for the allegedly unfulfilled “obligation” in the Constitution.
The sole source plaintiffs identify for the existence of the affirmative duty they would have this Court enforce is a law review article. NTEU’s Opp. at 37, citing A. Michael Froomkin, Government Data Breaches, 24 Berkley Tech. L. J. 1019, 1049 (2009) (“When the State takes a person’s data and holds it in a fashion outside the person’s control, the State has done to that data exactly what Chief Justice Rehnquist said was necessary to trigger Due Process Clause protection: it has ‘by the affirmative exercise of its power’ taken the data and ‘so restrain[ed]’ it that the original owner is unable to exert any control whatsoever over how the government stores or secures it. The government’s ‘affirmative duty to protect’ the data ‘arises . . . from the limitation which it has imposed on his freedom to act on his own behalf’ to keep the data secure.”). Given the absence of any binding precedent – or even any persuasive writing from other courts – that recognizes a *67 constitutionally based duty to safeguard personal information, [31] and the D.C. Circuit’s expressed skepticism about the existence of a right to informational privacy in the first place, this Court is compelled to hold that plaintiffs have failed to state a constitutional claim. [32]
B. Claims Against KeyPoint
The CAC plaintiffs assert that KeyPoint is liable for negligence, negligent misrepresentation and concealment, invasion of privacy, breach of contract, violations of the Fair Credit Reporting Act, and various state statutes governing unfair and deceptive trade practices and data breaches. CAC ¶¶ 216–75. The Court holds that plaintiffs’ claims against KeyPoint must be dismissed because the firm is immune from suit as a government contractor.
The Supreme Court has held that “government contractors obtain certain immunity in
connection with work which they do pursuant to their contractual undertakings with the United
States.”
Campbell-Ewald Co. v. Gomez
,
32 Since the Court finds that the NTEU case should be dismissed under both Rule 12(b)(1) and Rule 12(b)(6), it does not reach the issue of sovereign immunity, which was addressed only briefly by the parties.
[is] done was within the constitutional power of Congress, there is no liability on the part of the contractor for executing [Congress’s] will.”).
There is no dispute that KeyPoint was acting pursuant to a valid contract with OPM. CAC
¶¶ 1, 123 (alleging that KeyPoint was acting pursuant to a contract with the United States at the
time of the events underlying the complaint). So the question is whether the complaint plausibly
alleges that KeyPoint violated federal law and OPM’s explicit instructions or exceeded its
authority under the contract.
Campbell-Ewald Co.
,
1. KeyPoint has derivative immunity because it was a government contractor. Plaintiffs argue that because KeyPoint “violated section 552a(e)(10) . . . [and] section 552a(b) of the Privacy Act,” it is not protected by derivative government immunity. CAC Pls.’ Opp. at 60–61. KeyPoint maintains that this argument does not provide a basis to abrogate its immunity because a contractor cannot violate the Privacy Act. KeyPoint Mem. at 20.
The Privacy Act imposes requirements on each “agency” that maintains a system of records, see, e.g. , 5 U.S.C. § 552a(d), and section 552a(a)(1) of the statute refers to 5 U.S.C. § 551, the Freedom of Information Act, for the definition of the term agency:
“[A]gency” as defined in section 551(1) of this title includes any executive department, military department, Government corporation, Government controlled corporation, or other establishment in the executive branch of the Government (including the Executive Office of the President), or any independent regulatory agency . . . .
5 U.S.C. § 552(f)(1). With respect to government contractors, the statute expressly provides:
When an agency provides by a contract for the operation by or on behalf of the agency of a system of records to accomplish an agency function, the agency shall, consistent with its authority, cause the requirements of this section to be applied to such system.
5 U.S.C. § 552a(m)(1). Thus, the Act requires that the
agency
ensure that the requirements of the
Act are implemented; it does not hold contractors responsible for doing so.
See Metro. Life Ins.
Co. v. Blyther
,
2. Plaintiffs do not adequately identify a portion of KeyPoint’s contract with OPM that KeyPoint breached.
Plaintiffs argue, though, that KeyPoint “breached the terms of its contract with OPM . . . [because] [f]ederal contracts necessarily incorporate the requirements of the Privacy Act” via section 552a(m)(1). CAC Pls.’ Opp. at 61–62, citing CAC ¶ 123 (“The contract between OPM and KeyPoint incorporates the requirements of the Privacy Act. 5 U.S.C. § 552a(m)(1)”).
But this is simply an attempt to do indirectly what plaintiffs cannot do directly, and it fails as well. It is true that section 552a(m)(1) provides: “[w]hen an agency provides by a contract for the operation by or on behalf of the agency of a system of records to accomplish an agency function, the agency shall, consistent with its authority, cause the requirements of this section to be applied to such system.” 5 U.S.C. § 552a(m)(1); see also 48 C.F.R. § 24.102(a). But the implementing regulation goes on to provide: “the system of records operated under the contract is deemed to be maintained by the agency,” 42 C.F.R. § 24.102(c), and section 552a(m)(1) makes *70 clear that the contractor and its employees shall be considered employees of the agency. So this provision does not supply a basis to transfer Privacy Act liability to KeyPoint.
Even if one can draw an inference that pursuant to this provision of the Act, OPM imposed contractual requirements that prohibited KeyPoint from “disclosing” any record in accordance with § 552a(b), and bound it to establish appropriate safeguards under § 552a(e)(1), the complaint does not allege facts that would show that these presumed contractual terms were violated. There is no allegation in the complaint that KeyPoint “disclosed” anything – the complaint alleges that KeyPoint was the victim of a breach, and that a set of its log-in credentials was “stolen.” CAC ¶¶ 4, 117, 127, 133.
With respect to safeguards, plaintiffs conclusorily allege that KeyPoint breached its
contract with OPM because it “fail[ed] to ensure the security and confidentiality of records and to
protect against known and anticipated threats,” CAC ¶ 123, and by “unreasonably failing to
safeguard its security credentials and Plaintiffs’ [government investigation information].” CAC
¶ 122. But these general statements do not supply any facts and do not state a claim for breach of
contract. Plaintiffs allege that KeyPoint “lack[ed] software logs to track malware entering its
systems and data exiting its systems,”
id.
¶ 121, but they can point to no provision of the contract
between OPM and KeyPoint requiring those measures. A plaintiff must provide “factual content
[in her complaint] that allows the court to draw the reasonable inference that the defendant is liable
for the misconduct alleged,”
Brown v. Sessoms
,
Finally, plaintiffs make only conclusory allegations that KeyPoint exceeded its authority
in executing its contract with OPM.
See
CAC ¶ 122 (alleging that “[b]y unreasonably failing to
safeguard its security credentials and Plaintiffs’ and Class members’ [government investigation
*71
information], KeyPoint departed from its mandate, exceeded its authority, and breached its
contract with OPM”). These allegations offer no more than “labels and conclusions” and so they
do not suffice to state a claim.
Iqbal
,
3. Even if KeyPoint acted negligently, it did not lose its sovereign immunity.
Finally, plaintiffs maintain that “derivative sovereign immunity is not available to
contractors who act negligently in performing their obligations under the contract.” CAC Pls.’
Opp. at 62, quoting
In re Fort Totten Metrorail Cases
,
Applying the doctrine of derivative immunity for government contractors for the first time in this circuit, Fort Totten involved a claim against a subcontractor that had agreed to replace certain safety features on train tracks and conduct safety tests of those features. 895 F. Supp. 2d at 72–73. The plaintiffs asserted that the subcontractor “negligently failed to perform safety and compatibility testing in violation of its contractual obligations and applicable standards of care,” but the contractor asserted it had derivative sovereign immunity under Yearsley . Id. at 74–75. The purported sovereign entity, Washington Metropolitan Area Transit Authority (“WMATA”), filed cross-claims against the subcontractor for breach of contract and negligence. Id. at 75.
In deciding whether the subcontractor had immunity, the court analyzed the various claims against the subcontractor, considering whether they were predicated on the subcontractor carrying out its contract with WMATA or on the subcontractor’s breach of that contract and negligence in performing its obligations under the contract. Id. WMATA asserted that the subcontractor was required by the contract to ensure the compatibility of certain products to perform the requisite safety testing but failed to carry out these obligations. Id. Thus, the court concluded, “the very premise of these claims is that [the contractor] acted against the ‘will of the sovereign’ by *72 breaching its contractual duties to [the sovereign entity] and by performing negligently under the contract,” undermining the contractor’s attempt to invoke derivative immunity. Id. The court held that the contractor was “not entitled to derivative sovereign immunity under Yearsley as to these claims.” Id.
The instant case is distinguishable from Fort Totten , which involved the unique circumstance where the governmental entity itself was making the allegation. Here, plaintiffs provide only conclusory allegations that KeyPoint exceeded its authority or acted negligently, and its conclusory allegations are based on its contentions that KeyPoint violated FISMA and breached its contract with OPM. See CAC ¶¶ 122–24. But as explained above, plaintiffs do not identify any contract provisions that KeyPoint allegedly violated, and their claims that it violated federal law cannot stand. And importantly, the sovereign in this case, OPM, does not disavow the actions of KeyPoint. Indeed, the complaint indicates as much, alleging that “OPM did not terminate or suspend its contract with KeyPoint.” CAC ¶ 5. Thus, plaintiffs fail to plead facts sufficient to allege that KeyPoint violated OPM’s explicit instructions or exceeded its authority under its contract with the agency. [33]
33
Plaintiffs also cite
Worcester v. HCA Management Co.
,
Accordingly, all of plaintiffs’ claims against KeyPoint will be dismissed for lack of subject matter jurisdiction.
C. Claims against both defendants for declaratory judgment and injunctive relief will be dismissed for lack of subject matter jurisdiction.
Finally, the Court will dismiss the CAC plaintiffs’ Count IV, which seeks a declaration that
defendants’ conduct is unlawful, a judgment requiring them to indemnify plaintiffs for their
economic injury and provide “free lifetime identity theft protection services,” and an order that
OPM implement a data security plan that complies with the Privacy Act and FISMA. CAC
¶¶ 208–15. They assert that equitable relief is warranted under the APA, the Declaratory Judgment
Act, the common laws and statutory provisions that KeyPoint violated, and the Court’s inherent
authority. CAC ¶ 209.
[34]
But, as explained above, the APA does not provide relief for plaintiffs’
claims. Also, as explained above, neither the Privacy Act, the Little Tucker Act, nor the APA
provide plaintiffs the relief they seek, and the United States may not be sued without a waiver of
sovereign immunity.
United States v. Mitchell
,
CONCLUSION
For the reasons set forth above, the Court will dismiss plaintiffs’ Consolidated Amended
Complaint and the NTEU Complaint for lack of subject matter jurisdiction based on both standing
and sovereign immunity grounds, and the Court also finds that the CAC fails to state a claim under
34 Characterizing their request for relief for indemnity from economic harm as seeking
“equitable relief” does not allow plaintiffs to circumvent the Privacy Act’s requirement that they
suffer actual damages to obtain relief under the Act,
Cooper
,
the Privacy Act and the Little Tucker Act, and that the NTEU complaint fails to state a constitutional claim. A separate order will issue.
AMY BERMAN JACKSON United States District Judge DATE: September 19, 2017