Obama Administration Fights Privacy Act Liability

In February 2004, privacy advocates were put off by a Supreme Court case called Doe v. Chao, in which the Court found that the Privacy Act requires a victim of a government privacy violation to show "actual damages" before receiving any compensation. The Act appeared to provide for $1,000 per violation in statutory damages, but the Court interpreted the legislation to require that actual damages be proven, after which the victim would be entitled to a minimum award of $1,000. (Statutory damages are appropriate in privacy cases against the government because government bureaucrats pay little price themselves when their agency gets fined. A penalty is required to draw oversight and political attention to violations of the law.)

Doe v. Chao was a close call given the statutory language, and the Court chose the outcome that would limit the government's exposure to Privacy Act liability. Doing so marginally weakened the government's attentiveness to the already insubstantial protections of the Privacy Act.

A companion case to Doe v. Chao has now reached the Supreme Court. FAA v. Cooper, which the highest court recently agreed to hear, involves a victim of a government privacy invasion who alleges "actual damages" based on evidence of mental and emotional distress. Cooper, a recreational pilot who was HIV-positive, had chosen to conceal his health status generally, but revealed it to the Social Security Administration for the purposes of pursuing disability payments. When the SSA revealed that he was HIV-positive to the Department of Transportation, it violated the Privacy Act. Cooper claims in court that he suffered mental and emotional distress at learning of the disclosure of his health status and inferentially his sexual orientation, which he had kept private.

In the Ninth Circuit Court of Appeals and now in the Supreme Court, the Obama Administration has argued that it doesn't have to pay the victim of this privacy violation because mental and emotional distress do not qualify as "actual damages." No one disputes that Cooper has to present objective proof of harm as a check on the truth of his claims. But the government isn't saying that Cooper is faking distress at having his health status and sexual orientation illegally exposed by the government. The government is arguing that the court should limit "actual damages" to economic injury simply because it's the government being sued.

The doctrine of sovereign immunity holds that the state is generally not subject to lawsuits. The state can make itself liable by a clear statement in legislation that it agrees to be sued. In the Privacy Act, Congress did exactly that: it created a cause of action against the government for Privacy Act violations.

But now the Obama Administration is arguing that the statute should be interpreted narrowly based on sovereign immunity. It's an attempt to limit Privacy Act liability once again, insulating government officials from consequences of their wrongdoing. The Court should reject the sovereign immunity argument. Congress made the government subject to suit, and the chips should fall where they may on the question of what constitutes "actual damages."

Putting aside sovereign immunity, what about the "actual damages" question? Should the Court recognize mental and emotional distress as a harm coming from privacy violations?

Privacy is the subjective condition people enjoy when they have the power to control information about themselves and when they have exercised that power consistent with their interests and values. People can, and often do, maintain privacy in information they share with a limited audience for limited purposes. Privacy is violated when that sense of control and controlled sharing is upended.

A privacy violation is called a "violation" because of the loss of confident control over information, which, depending on the sensitivity and circumstances, can be very concerning and even devastating. When privacy violations have this effect--not idle worry about who knows what, but the shock and mortification of having specific, sensitive information wrested from one's control and exposed--that's the case when actual damages should probably be found. If the Privacy Act is to protect the interest after which it's named, the Court will recognize proven mental and emotional suffering as "actual damages."