On the same day the United States Supreme Court handed down its landmark decision in Wal-Mart Stores, Inc. v. Dukes, the Court also granted certiorari in FAA v. Cooper, a case coming out of the Ninth Circuit with a potentially significant effect on privacy law. In Cooper, the Court will attempt to resolve a split among federal appeals courts as to whether “actual damages” resulting from a violation of the disclosure provisions of the Privacy Act may include mental and emotional injuries.
The Privacy Act, 5 U.S.C. § 552a, et seq., prohibits federal agencies from disclosing personally identifiable information that is maintained in federal records systems. Although the Act does not directly apply to private employers, it does apply to private employers with government contracts to oversee a federal agency’s record system. The Act generally establishes a code governing collection, maintenance, use, and dissemination of personal information, but it also creates a private cause of action for willful or intentional violations of the Act. An aggrieved individual may recover when the violation has “an adverse effect on the individual,” but recovery is limited to “actual damages.” What may constitute “actual damages” is the focus of the Cooper opinion.
The plaintiff in Cooper is an airline pilot who did not disclose that he had HIV when he renewed his medical certifications required to maintain his pilot’s license. As his condition worsened, Cooper applied for Social Security disability benefits and reported his HIV status to the Social Security Administration. Years later, a federal investigation uncovered that Cooper had an active pilot license at the same time he was receiving disability benefits, and a comparison of FAA and SSA files revealed that Cooper had never disclosed his HIV or treatment. During this investigation, medical information that Cooper believed would remain private was disclosed, so he filed suit alleging a violation of the Privacy Act.
Although the trial court found that the agencies’ use of Cooper’s personal information may have violated the Act, the court threw out the lawsuit because “mental stress alone does not satisfy the Privacy Act’s actual damages requirement.” The Ninth Circuit reversed in Cooper v. FAA, 622 F.3d 1016 (9th Cir. 2010). The Ninth Circuit noted that it and the majority of other circuits have found that non-pecuniary harm, such as emotional distress and embarrassment, is sufficient to satisfy the Act’s “adverse effect” requirement. The court also stated that damages sustained in privacy violation cases typically include mental distress from being exposed to public view. It therefore follows, the court held, that non-pecuniary harm may be enough to prove “actual damages.” This conclusion is contrary to how the Sixth and Eleventh Circuits have previously decided the issue. The Supreme Court has now stepped in to attempt to resolve the split.
How the Court ultimately decides the matter could have implications for private enforcement of Privacy Act violations. If the Court finds that non-pecuniary harm is insufficient to prove “actual damages,” the plaintiffs must instead prove that the violation caused them some quantifiable harm. If, however, the Court concludes that a plaintiff need only show embarrassment or mental distress, otherwise harmless violations of the Act could expose federal agencies and contractors to substantial liability. Such a holding could also influence damage awards outside of the Privacy Act. As the Ninth Circuit noted, federal district courts and courts of appeals have disagreed regarding the meaning of “actual damages,” and any broadening of this term by the Court may expand the liability faced by both public and private employers in other contexts, as well. The Supreme Court will hear the case in its next term starting in October.