This case involves the disclosure provision of the Privacy Act of 1974. The district court granted summary judgment for the National Drug Intelligence Center, holding that the information in the disclosed document is not a “record” within the meaning of the Act. We disagree and now reverse.
I.
Plaintiff-Appellant Gary Jacobs is the President and CEO of Laredo National Bank, which conducts business in the United States and Mexico. Jacobs has been the President-CEO of the bank for 25 years. He claims that the National Drug Intelligence Center (“NDIC”) violated the Privacy Act by leaking part of an internаl analytical document, the “White Tiger Report” (“the Report”), to the press. The Report alleged that Jacobs was involved in a Mexican money-laundering and drug-trafficking organization.
The NDIC is part- of the Department of Justice. Its function is to coordinate and consolidate drug intelligence from national-security and law-enforcement agencies. Specifically, the NDIC analyzes the structure, membership, finances, and activities of drug-trafficking organizations.
In 1997, the FBI and the DEA asked the NDIC to conduct a strategic assessment of a Mexiсan criminal organization that was allegedly involved in money laundering and drug trafficking in the United States, Mexico, and several other countries. As a result, the ‘White Tiger Project” was born: NDIC analysts collected and reviewed pertinent information from thousands of agency records, including records from the DEA, FBI, U.S. Customs Service, and the U.S. Attorney’s Office. The analysts placed these records in the NDIC’s “RetrievalWare” database. Re-trievalWare is the NDIC’s electronic-document system.
RetrievalWare is located within the NDIC’s computer system — “Justice/NDIC-001.” The “Main Network System” of Justice/NDIC-001 contains Re-trievalWare and two other component parts, the “unit group” and the “unit home” directories, both of which store Microsoft Word documents.
The White Tiger Report contained several different sections. The section at issue in this case is the “Executive Summary,” which summarized the entire Report. Neither the Report nor the Executive Summary were stored in Retriev-alWare, but rather in one of the other component parts of the Main Network System (unit group or unit home).
In May 1999, Donald Schultz sent the Executive Summary to Dolia Estevez, a reporter for the Mexican newspaper, El Financiero. Later that month, El Finan-ciero published a front-page article entitled, “The Hanks, in the Gun Sight of U.S. Drug Enforcement; They Constitute a Threat, It is Warned” (translated from Spanish). The article purported to rely heavily on an “unpublished official document” from the NDIC and contained allegations of wrongdoing against Jacobs. Specifically, the article discussed the activities of a family referred to as the Hank Group and reported that the family laundered money through Jacobs’s bank, stating,
The analysis states that Hank Rhon uses “front men” or “men of straw” to acquire interests in the United States. One of these characters, it says, is Gary Jacobs, the president of the Laredo National Bank, who, according to the NDIC, lacks personal resources sufficient to acquire the shares he owns in the Bank.
In May 2001, Jacobs filed suit against the NDIC in the Southern District of Texas, claiming that by leaking the Executive Summary, the NDIC violated the Privacy Act by disclosing “records” maintained in a “system of records.” Specifically, Jacobs alleged that the Executive Summary was derived from items of information (records) that the NDIC analysts retrieved from RetrievalWare (the system of records).
The NDIC has not provided Jacobs with either the information about him in Re-trievalWare or a copy of the Executive Summary. However, Jacobs believes that a confidential Customs Service report from November 1997 was included in the Re-trievalWare records that formed the basis of the Executive Summary’s information on Jacobs. Jacobs believes this for three reasons: first, such reports were generally scanned into RetrievalWare; second, El Financiero stated that the Executive Summary relied on 19 Customs Service cases; and third, the language of the El Finan-ciero article, which purports to quote the Executive Summary, is similar to the language of the Customs report. 1 Jacobs provided the following comparison in his brief:
[[Image here]]
In September 2002, the NDIC moved tо dismiss Jacobs’s complaint or, alternatively, for summary judgment. Jacobs also cross-moved for partial summary judgment against the NDIC on the issue of liability.
The district court heard oral argument on the motions in December 2002, granting the NDIC’s and denying Jacobs’s. The district court did not issue written reasons for its decision, but did make the following statement at the summary judgment hearing:
I’m going to grant the Motion to Dismiss and/or for Summary Judgment of the NDIC here and that I don’t think that the records here are maintaining a system of records under the Privacy Act, section 552~A(a), where it defines “record” and “system of records” and I don’t — both on the Motion to Dismiss and/or the Summary Judgment Motion I think it’s clear that they don’t, and that this is not a Privacy Act matter.
Jacobs filed a motion to reconsider, which the district court denied. Judgment was entered in April 2004. This appeal followed. 2 The only issue before the court is whether the information about Jacobs in the Executive Summary constitutes a “record” contained in a “system of records” within the meaning of the Privacy Act.
II.
This court reviews a grant of summary judgment de novo, applying the same standard as the district court.
Bettersworth v. FDIC,
The Privacy Act of 1974, 5 U.S.C. § 552a (1996), “safeguards the public from unwarranted collection, maintenance, use and dissemination of personal information contained in agency records ... by allowing an individual to participate in ensuring that his records are accurate and properly used.”
Henke v. U.S. Dep’t of Commerce,
Here, Jacobs asserts the fourth cause of action: he claims that the NDIC willfully disclosed a “record” contained in a “system of records” in violation of § 552a(b) and that the disclosure had an adverse effect on him. Section 552a(b) provides that “[n]o agency shall disclose any record which is contained in a system of records by any means of communication to any person,” unless the disclosure falls within one of twelve statutory exceptions. § 552a(b). The NDIC has not alleged that any exception applies to this case.
Thus, for Jacobs to survive summary judgment on his disclosure claim, he must present evidence of the following elements: (1) the information is a “record” in a “system of records”; (2) the agency disclosed the information; (3) the disclosure had an adverse effect on him; and (4) the disclosure was willful.
Quinn v. Stone,
III.
Jacobs argues that the record that was disclosed in this case is the information about him that was retrieved by his name from RetrievalWare and put into the Executive Summary. The NDIC, by contrast, argues that the disclosed record is the Executive Summary, itself. According to the NDIC, the Privacy Act does not apply because the Executive Summary was not contained within RetrievalWare’s system of records; that is, the document, itself, was not retrieved from RetrievalWare by Jacobs’s name. The NDIC cites little authority to support its interpretation of the statute and instead tries to distinguish those cases relied upon by Jacobs. It cannot. Jacobs’s interprеtation of the statute is supported by both the statute’s text and the cases interpreting it. We therefore reverse the judgment of the district court.
A.
The Privacy Act prohibits the disclosure of “any record which is contained in a system of records by any means of communication.” § 552a(b). The Act defines “record” in the following way:
[T]he term “record” means any item, collection, or grouping of information about an individual that is maintained by an agency, including, but not limited to, his education, financial transactions, medical history, and criminal or employment history and that cоntains his name, or the identifying number, symbol, or other identifying particular assigned to the individual, such as a finger or voice print or photograph.
§ 552a(a)(4) (emphasis added). The statute further defines “system of records” as “a group of records under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual.” § 552a(a)(5) (emphasis added).
This case fits plainly within the statute. First, the Executive Summary accused Jacobs of being a front man for the Hank Group money-laundering and drug-trafficking organization and opined that Jacobs did not have the financial capability to purchase the bank shares that he owned. The Executive Summary thus included “information about” Jacobs. See § 552a(a)(4).
Second, the NDIC has conceded that NDIC analysts on the White Tiger Project retrieved information from RetrievalWare
Finally, RetrievalWare qualifies as a system of records under the statute. Re-trievalWare is located within Justice/NDIC-001. In 1993, several years before the beginning of the White Tiger Project, the NDIC published a notice in the Fеderal Register identifying Jus-tiee/NDIC-001 as its Privacy Act system of records.
Under a straightforward application of the statute, then, Jacobs has raised a genuine issue of material fact as to the statute’s applicability, which defeats the NDIC’s motion for summary judgment.
The NDIC argues, however, that the statute only protects against the disclosure of a physical document that is contained in a system of records. Thus, it contends, the Privacy Act does not apply to the disclosure of the Executive Summary in this case because it was not stored in RetrievalWare. We reject this argument.
A myriad of cases has held or assumed that the Act protects against oral disclosures,
7
as well as the nonconsensual dissemination of letters and memoranda containing information from a system of records.
8
For example, in
Pippinger v. Rubin,
the Tenth Circuit used the Privacy Act’s legislative history to support a broad interpretation of the disclosure provision.
The court’s broad interpretation of the Privacy Act’s prohibition against disclosure is clearly consistent with Congressional intent. As the Joint House and Senate Report explained, a primary purpose of 5 U.S.C. § 552a(b) is to[ ] “require employees to refrain from disclosing records or personal data in them, within the agency .... This section is designed to prevent the office gossip, interoffice and interbureau leaks of information about persons of interest in the agency or in the community, or such actions as the publicizing of information of a sensational or salacious nature or of that detrimentаl to character reputation.”
Id. at 529 (first emphasis in original) (quoting S. Rep. No. 93-1183; H.R.Rep. No. 93-1416, at 51 (1974), reprinted in 1974 U.S.C.C.A.N. 6916, 6966).
We agree with the Tenth Circuit’s characterization of the statute; the Privacy Act’s legislative history supports a broader interpretation of the Privacy Act than the one advanced by the NDIC in this case. The disclosure provision is meant to protect against just the sort of governmental activity that took place here — the leaking and publicizing of information that is “detrimental to character reputation.” See id. Both the statute’s plain text and its legislative history support the application of the Privacy Act to this case. The caselaw applying the Act’s disclosure provision confirms our conclusion.
Jacobs principally relies on
Bartel v. FAA,
In Bartel, the plaintiff, Bartel, worked as an air-safety inspector for the FAA. Id. at 1405. Contemplating the filing of an EEOC complaint alleging reverse discrimination, Bartel requested employment information about several other inspectors. Id. The information he received “consisted of virtually complete airman files” of three of his coworkers. Id. Despite being assured that the requested information was available to the public, some of the information in the files was not public. Id. Bartel’s acquisition of the files was therefore a potential Privacy Act violation. Id.
Bartel then filed a discrimination complaint with the FAA’s EEO office. Id. Shortly thereafter, one of Bartel’s superiors, Vincent, instituted an investigation into Bartel’s request for thе employment files. Id. Documents collected pursuant to the investigation were placed in a file called a “Report of Investigation,” or “ROI.” The investigation closed without any criminal charges being filed against Bartel. Id. at 1405-06. Bartel soon left the FAA for civilian employment. Id. at 1406.
The next year, Vincent learned that Bar-tel was seeking reemployment with the FAA.
Id.
Vincent then sent the three airmen whose files had been requested letters notifying them of the apparent Privacy Act violation by Bartel.
Id.
These letters contained Bartel’s name and place of work and stated that Bartel had obtained records about them, potentially in violation of the Privacy Act.
Id.
Vincent also disclosed Bartel’s alleged Privacy Act violation over the phone to an investigator for Flight Resources, Inc., with whom Bar-tel was interviewing for a job.
Id.
Bartel
Bartel sued the FAA, alleging that Vincent’s letters and phone conversations themselves constituted nonconsensual disclosures in violation of § 552a(b) of the Privacy Act. Id. The district court dismissed Bartel’s complaint. Id. at 1407. The D.C. Circuit reversed. Id.
In the course of its analysis, the Bartel court assumed a broad definition of “record,” stating,
It is of course оbvious that the letters were not themselves agency records. On the other hand, it is not disputed that the Bartel ROI referred to in the letters is a record subject to the disclosure provisions of the Act. Because we find that under the peculiar circumstances of this case, the letters did in fact communicate sensitive information contained in the ROI — specifically, that Bartel’s conduct was the subject of an official agency investigation, that he acted improperly, and that he may have violated the Privacy Act — we conclude that the Act’s disclosure provisions may have been triggered. Courts have up to now unanimously agreed that the Act covers more than the mere physical dissemination of records (or copies) but that it does not necessarily cover disclosure of information merely because the information happens to be contained in the records. The line they draw is that where no statutory exception applies, the Act prohibits nonconsensual disclosure of any information that has been retrieved from a protected reсord.
Id. at 1408 (emphasis added).
Bartel squarely supports Jacobs’s position. First, the letters disclosed there are analogous to the Executive Summary disclosed here. In both cases, the damaging information was taken from a protected record and inserted into a new document, which was then disclosed without the plaintiffs consent. Under the statute, the new document is also a protected record. See 5 U.S.C. § 552a(a)(4).
Second, the narrow definition of record that the NDIC advances here is inconsistent with the broad definition set forth in Bartel. The NDIC claims that the Privacy Act was not triggered here sinсe the Executive Summary, itself, was not stored in RetrievalWare. This reading of the Act, however, cannot be reconciled with the caselaw.
Furthermore, the NDIC attempts to distinguish Bartel on the ground that the letters there were “information paper[s]” created “for the purpose of disclosing information contained in a system of records.” According to the NDIC, the Executive Summary should be treated differently because it is “an analysis of vast amounts of underlying data created at the request of other agencies.” The NDIC' does not cite any authority to support this proposition, nor is the distinction persuasive. There is absolutely nothing in Bartel suggesting that the court’s decision hinged on the nature of the document disclosed. In fact, courts following Bartel have done so in contexts where the disclosed document was not created for the purpose of disclosing information contained in a system of records.
In
Wilborn v. Department of Health and Human Services,
for example, the information illegally disclosed was contained in a judicial opinion.
Wilborn filed a grievance over the PIP, and it was eventually ordered to be expunged from the agency’s records. Id. Wilborn then left HHS and went into private practice representing social-security-disability claimants. Id. One of his cases was handled by the same ALJ who had administered the PIP. Id. Wilborn wrote a letter to the ALJ attacking his impartiality. The ALJ responded to Wil-born’s allegations in the text of an opinion, noting, “What Mr. Wilborn does not state is that as his supervisor, the undersigned was required to place him on a Performance Improvement Plan (PIP) because of his failure to meet even minimal production requirements.” Id.
Wilborn complained that the ALJ had violated the Privacy Act, after which the ALJ issued a substituted opinion without the objectionable languаge, but which did not disclose that the PIP had been rescinded and expunged from the agency’s records. Id.
Wilborn filed suit, alleging that the ALJ’s opinion impermissibly disclosed information about him in violation of the Privacy Act. See id. Although the district court granted summary judgment for the agency, the Ninth Circuit reversed, relying on Bartel. Id. at 600-01.
Wilborn is important for two reasons. First, as in Bartel, the information disclosed in Wilborn was equally removed from the relevant system of records as was the Executive Summary here: There, the ALJ incorporated information that had once been in Wilborn’s employment file into a judicial opinion, which was disclosed without Wilborn’s consent. See id. Here, information was taken from RetrievalWare and incorporated into the Executive Summary, which was then disclosed.
Second,
Wilborn
refutes the NDIC’s argument that
Bartel
can be distinguished because the disclosed document in that case was made for the purpose of “dissemi-nat[ing] information from a system of records.” Although the letter in
Bartel
was written for the purpose of informing the objects of Bartel’s information request that Bartel had obtained their files in apparent violation of the Privacy Act,
Bartel,
In addition to
Bartel
and
Wilborn,
the First, Third, Fourth, Sixth, Seventh, and Tenth Circuits have all interpreted the Privacy Act’s record requirement consistent with the reading that Jacobs advances here.
9
District-court cases construing the
B.
Finally, the NDIC asks us to reject Jacobs’s аrgument for policy reasons. It argues that were this court to rule in Jacobs’s favor, an intolerably heavy burden would be imposed on the government. Specifically, the NDIC claims that under Jacobs’s approach, “it is impossible for an agency to predict with certainty whether a document is subject to the statute”; and, it argues, the government will have to “analyze each document’s component parts and determine whether any of those parts were derived from a system of records anywhere throughout the federal government.” According to the NDIC, each time a document is found to include “such derivative information,” it will be required to evaluate whether disclosure of the information is permitted under any statutory exception to the disclosure provision. This argument is flawed in several respects.
First, the Act only prohibits the disclosure of records “in a system of records.” 5 U.S.C. § 552a(b). And the Act defines “system of records” narrowly — the records must be both “under the control of [an] agency,” and the information must be “retrieved by the name of the individual or by some identifying ... particular.” § 552a(a)(5). Courts have strictly enforced this latter requirement. 11
Third, at least some courts have limited the type of information protected by the Act. 13 Finally, the Act, itself, safeguards against unreasonable liability by providing for twelve statutory exceptions. See § 552a(b)(l)-(12).
Jacobs is not asking the court for a more expansive reading of the Privacy Act than other courts have given it. To the contrary, Jacobs’s case is the kind at which the Privacy Act’s disclosure provision is aimed.
IV.
For the foregoing reasons, we hold that the district court erred in granting the NDIC’s motion for summary judgment. The judgment of the district court is therefore reversed.
REVERSED and REMANDED.
Notes
. The November 1997 Customs Service report was reprinted in Jose Martinez, The Teachings of the Professor, Inquest on Carlos Hank-Gonzales 234-66 (1999).
. Jacobs appeals only the district court's grant of the NDIC's motion for summary judgment; he does not apрeal the denial of his partial motion for summary judgment.
. 5 U.S.C. § 552a(g)(l)(A).
. Id. § 552a(d)(l), (g)(1)(B).
. Id. § 552a(g)(l)(C).
. Id. § 552a(g)(l)(D).
.
See Orekoya v. Mooney,
.
Williams v. Dep't of Veterans Affairs,
.
See Orekoya v. Mooney,
.
See Buckles v. Indian Health Serv./Belcourt Serv. Unit,
.
Bechhoefer v. U.S. Dep’t of Justice,
.
See Pippinger v. Rubin,
.
See Bechhoefer v. U.S. Dep’t of Justice,