Andrew Harley Speaker v. U.S. Dept. of HHS ( 2010 )


Menu:
  •                                                                     [PUBLISH]
    IN THE UNITED STATES COURT OF APPEALS
    FOR THE ELEVENTH CIRCUIT            FILED
    ________________________ U.S. COURT OF APPEALS
    ELEVENTH CIRCUIT
    No. 09-16154                 OCTOBER 22, 2010
    ________________________              JOHN LEY
    CLERK
    D. C. Docket No. 09-01137-CV-WSD-1
    ANDREW HARLEY SPEAKER,
    Plaintiff-Appellant,
    versus
    U.S. DEPARTMENT OF HEALTH AND HUMAN SERVICES
    CENTERS FOR DISEASE CONTROL AND PREVENTION,
    Defendant-Appellee.
    ________________________
    Appeal from the United States District Court
    for the Northern District of Georgia
    _________________________
    (October 22, 2010)
    Before HULL, MARTIN and FAY, Circuit Judges.
    HULL, Circuit Judge:
    Plaintiff Andrew Harley Speaker (“Speaker”) sued the Defendant United
    States Department of Health and Human Services Centers for Disease Control and
    Prevention (“CDC”) for violating the Privacy Act, 5 U.S.C. § 552a, by disclosing
    his identity and confidential medical information relating to the treatment of his
    tuberculosis. Plaintiff Speaker appeals the district court’s grant of Defendant
    CDC’s motion to dismiss for failure to state a claim under Federal Rule of Civil
    Procedure 12(b)(6). After review and oral argument, we reverse.
    I. BACKGROUND
    A.    Speaker’s Amended Complaint
    In this Rule 12(b)(6) context, we start by outlining the allegations in Plaintiff
    Speaker’s Amended Complaint, which seeks to recover damages under the Privacy
    Act, 5 U.S.C. § 552a.
    Speaker first tested positive for tuberculosis in March 2007. In April 2007,
    after undergoing tests and treatments, Speaker received a preliminary susceptibility
    test result suggesting an elevated diagnosis of multidrug-resistant tuberculosis
    (“MDR-TB”).
    During the course of Speaker’s treatment, several CDC employees became
    aware of his intention to travel to Europe in May 2007 for his wedding ceremony
    and honeymoon. Speaker cites e-mail records of CDC officials acknowledging the
    upcoming trip as evidence that the CDC was planning treatment options around
    2
    these travel plans. CDC officials were also aware that Speaker’s doctor at the
    Fulton County Health Department Tuberculosis Program was advising further care
    at the National Jewish Medical and Research Center in Denver upon Speaker’s
    return. This contradicted later public statements by the CDC that it had no
    knowledge of Speaker’s travel plans.
    In the days leading up to his departure, Speaker claims health officials
    repeatedly gave assurances that he was not contagious or a threat to anyone, and
    that no public health official advised him against traveling abroad. On May 12,
    2007, Speaker departed for Europe.
    Soon afterwards, the CDC lab received test results indicating increased
    resistance to drug treatments. The CDC then reclassified Speaker’s tuberculosis as
    extensively drug-resistant tuberculosis (“XDR-TB”), a more virulent strain. On
    May 22, Speaker was contacted in Europe by Dr. Bob Cooksey, a microbiologist in
    the CDC’s Division of Tuberculosis Elimination,1 about a change in test results.
    Speaker immediately contacted Dr. David Kim, a CDC employee, who informed
    him that the CDC had elevated his tuberculosis diagnosis to XDR-TB. Dr. Kim
    allegedly informed him that, while his treatment options would change, he
    remained non-contagious.
    1
    Dr. Cooksey also happened to be the father of Speaker’s fiancée at the time, and had just
    returned home after attending Speaker’s wedding in Greece.
    3
    Nevertheless, the CDC forbade Speaker from flying on a commercial
    airliner. Dr. Kim notified Speaker that the CDC was making arrangements to fly
    him back to the United States. The next day, however, Dr. Kim informed Speaker
    that the CDC did not have money in its budget to pay for the flight. Dr. Kim gave
    Speaker two options: he could charter a private flight if he wished to return to the
    United States for treatment, or he could check into an Italian hospital the next day.
    Although he had been told by his doctor that the National Jewish Medical
    and Research Center in Denver presented his best treatment option, Speaker could
    not afford a chartered flight to the United States. Faced with the prospect of
    indefinite detainment in Italy, and relying upon the statements of health officials
    that he was not contagious, Speaker elected to disregard the CDC’s travel
    instructions and booked a flight to Montreal on a commercial airliner. Speaker
    then crossed the border by car into the United States, notifying the CDC of his
    whereabouts. The CDC directed Speaker to check himself into Bellevue Hospital
    in New York City, which Speaker did. At Bellevue, Speaker was served with a
    federal quarantine order, the first imposed on a United States citizen since 1963.
    Speaker subsequently received treatment at Grady Memorial Hospital in Atlanta
    and the National Jewish Medical and Research Center in Denver.
    Upon being hospitalized, Speaker alleges that “the CDC caused personally
    4
    identifiable information about [him] to be improperly disclosed without his consent
    to law enforcement officials, the news media, and the general public as a result of
    the deliberate actions of the CDC and its employees or agents.” Am. Compl. ¶ 82.
    Speaker accuses the CDC of causing the following disclosures of his “personally
    identifiable information”:
    a)    Public disclosures to the international news media during
    press conferences and interviews held on or about May
    29 and 30, June 1, and July 3 and 11, 2007;
    b)    Upon information and belief, other disclosures by CDC
    agents or employees to members of the media during the
    time frame of said public press conferences and
    interviews, including but not limited to information that
    enabled the media to ascertain Mr. Speaker’s identity and
    whereabouts on or about May 29, 2007 and to publish his
    name on and after May 31, 2007;
    c)    Upon information and belief, disclosure of Mr. Speaker’s
    identity to law enforcement officers who in turn leaked
    his identity to the Associated Press between May 29 and
    May 31, 2007;
    d)    Upon information and belief, confirmation of Mr.
    Speaker’s identity to the Associated Press between May
    29 and 31, 2007;
    e)    Upon information and belief, other disclosures made as
    part of a media campaign directed toward Mr. Speaker
    and his disease that will be identified through discovery
    and proven at trial.
    
    Id. ¶ 83.
    Although Speaker’s Amended Complaint alleges the CDC “caused”
    disclosures, Speaker elsewhere in the Amended Complaint refers to the CDC
    5
    “making the aforementioned disclosures about Mr. Speaker.” 
    Id. ¶ 84
    (emphasis
    added). Other examples make clear that Speaker alleges direct disclosures of his
    identity by the CDC. See, e.g., 
    id. ¶ 1
    (referring to the CDC’s “intentional,
    unauthorized disclosure of Plaintiff’s confidential medical history”); 
    id. ¶ 69
    n.2
    (referring to “the CDC’s unlawful disclosure of Mr. Speaker’s identity and private
    health information to the world media”); 
    id. ¶ 1
    03 (referring to “the CDC’s highly
    publicized release of Mr. Speaker’s private information”); 
    id. ¶ 1
    06 (stating that
    “[t]he aforementioned disclosures by the Defendant CDC about Plaintiff Andrew
    Speaker and his status as a tuberculosis patient resulted in the release of private
    identifiable information”); 
    id. ¶ 1
    08 (referring to “identifiable private information
    that the Defendant released about Mr. Speaker, including but not limited to his
    identity, his occupation, his city of residence, his wedding travel plans, his medical
    history, and his present medical status”); 
    id. ¶ 1
    10 (stating that “unauthorized
    disclosures of Mr. Speaker’s identifiable private information by a federal agency
    charged with the responsibility of maintaining the confidentiality of that
    information constituted a violation of the Privacy Act”); 
    id. ¶ 1
    12 (referring to “the
    CDC’s intentional, unauthorized disclosure of Mr. Speaker’s identifiable private
    information”); 
    id. ¶ 1
    14 (referring to “identifiable private information released to
    the world media by the CDC”); 
    id. ¶ 1
    15 (referring to “identifiable private
    6
    information released by the CDC”).2
    Ultimately, Speaker’s XDR-TB diagnosis proved erroneous, and his
    tuberculosis was downgraded back to MDR-TB.
    B.     CDC’s Motion for Summary Judgment
    On April 28, 2009, Plaintiff Speaker filed his original Complaint. On June
    29, 2009, Defendant CDC filed an answer. Immediately after answering, the CDC,
    on July 2, 2009, filed a motion to stay the proceedings and a motion for summary
    judgment, arguing that (1) Speaker failed to satisfy the elements of a Privacy Act
    claim and (2) under Eleventh Circuit precedent, Speaker could not recover non-
    pecuniary damages under the Privacy Act. The CDC attached a “statement of
    material facts about which there is no genuine dispute” and various exhibits,
    including the CDC’s statements at press conferences and the contents of newspaper
    articles.3
    2
    Speaker’s Amended Complaint also alleges an “indirect” disclosure of his identity by
    the CDC in its press conferences. See Am. Compl. ¶ 85 (claiming that disclosures at CDC press
    events “would have allowed him to be readily identified even if his identity had not been directly
    disclosed by the CDC”). Such CDC disclosures included “details of Mr. Speaker’s medical
    history and his alleged medical condition (including the dissemination of a detailed timeline of
    his medical treatment), the fact that he had flown to Greece to get married, and the fact that he
    was a lawyer in Atlanta.” 
    Id. This indirect
    disclosure allegation, however, does not annul the
    allegations of direct disclosure contained throughout the Amended Complaint.
    3
    The exhibits were labeled in the CDC’s “Appendix” as follows: “May 29, 2007 CDC
    Press Briefing Transcript” (Exhibit A); “Young, Alison: ‘Atlantan Quarantined with Deadly TB
    Strain,’ Atlanta Journal-Constitution, May 30, 2007” (Exhibit B); “May 30, 2007 CDC Press
    Briefing Transcript” (Exhibit C); “Slevin, Colleen: ‘TB Patient ID’d as Atlanta Attorney, 31,’
    The Associated Press, May 31, 2007” (Exhibit D); “May 31, 2007 Press Release by National
    7
    In response, Speaker filed motions opposing the stay and summary
    judgment. He supplied a “statement of material facts” and a “response to
    defendant’s statement of facts,” along with a Rule 56(f) affidavit requesting
    discovery.
    The district court’s ruling referenced the contents of some of the CDC
    exhibits, so we recount them here.
    One CDC exhibit was the transcript of the CDC’s first press conference on
    May 29, 2007. In that press conference, CDC Director Julie Gerberding stated that
    the tuberculosis patient in question, whom she did not identify by name, (1)
    departed Atlanta on May 12, traveling to Paris on Air France flight 385 and (2)
    returned to the United States on May 24, taking Czech Air flight 104 from Prague
    to Montreal, and crossing the border by car. Dr. Martin Cetron, the CDC’s
    Jewish Medical and Research Center” (Exhibit E); “June 1, 2007 Good Morning America
    Transcript” (Exhibit F); “Declaration of William Allstetter Authenticating Press Releases”
    (Exhibit G); “June 6, 2007 Declaration of Carrie Mitchell and Transcript to Hearing of the
    Labor, Health and Human Services, Education, and Related Agencies Subcommittee of the
    Senate Committee on Appropriations: ‘The Impact of one Tuberculosis Patient on International
    Public Health’” (Exhibit H); “June 5, 2007 Press Release National Jewish Medical and Research
    Center” (Exhibit I); “June 6, 2007 CNN Interview with Larry King” (Exhibit J); “June 14, 2007
    Press Release by National Jewish Medical and Research Center” (Exhibit K); “July 3, 2007
    Press Release by National Jewish Medical and Research Center” (Exhibit L); “July 3, 2007 Joint
    Press Briefing Transcript between National Jewish Medical and Research Center and the CDC”
    (Exhibit M); “June 1, 2007 CDC Press Briefing Transcript” (Exhibit N); “‘My Thoughts on the
    Last Few Weeks,’ Internet posting by Andrew Speaker, July 6, 2007” (Exhibit O); “Signed
    Authorization of Andrew Speaker” (Exhibit P); “July 11, 2007 Anderson Cooper 360 Degrees
    Transcript” (Exhibit Q); and “Declaration of Glen Nowak Authenticating Transcripts and
    Briefings” (Exhibit R).
    8
    Director of the Division of Global Migration and Quarantine, identified Atlanta as
    the patient’s home.
    The CDC also attached as an exhibit an Atlanta Journal-Constitution article
    that appeared within 24 hours of the CDC’s May 29 press conference. The article
    revealed that the tuberculosis patient participated in a telephone interview with the
    newspaper, on condition of anonymity, and reported that he was presently under
    federal quarantine at Grady Memorial Hospital in Atlanta.
    Another CDC exhibit was a transcript of its press conference on May 30,
    2007. In this second press conference, the CDC’s Dr. Cetron provided additional
    information about the patient’s flights, including approximate numerical figures of
    passengers and crew members potentially affected. Dr. Cetron also listed the
    patient’s seat number as 12C on the Czech Air flight 104 from Prague to Montreal.
    The CDC did not identify Speaker by name in the press conference, but did
    identify both his flight and seat number.
    The next day, the Associated Press (“AP”) published an article, which the
    CDC also filed as an exhibit, that identified Speaker by name. The AP’s May 31
    article announced that Speaker was a “31-year-old personal injury attorney who
    practices law with his father in Atlanta.” The AP story stated that Speaker’s
    identity was provided to the AP by “a federal law enforcement official” and
    9
    confirmed by a “medical official in Atlanta” who, along with the law enforcement
    official, spoke on condition of anonymity.4
    After Speaker was identified as the tuberculosis patient on May 31, he
    appeared on television. The CDC included as an exhibit the transcript of a June 1,
    2007 “Good Morning America” episode on ABC, in which Diane Sawyer
    interviewed Speaker. Now that his identity had been revealed, Speaker in this
    interview revealed details about his tuberculosis diagnosis. The CDC included
    transcripts of subsequent national media interviews in which Speaker participated,
    along with the transcript of Speaker’s testimony before Congress on June 6, 2007.
    The CDC also attached as exhibits transcripts of its June 1, 2007 press conference
    and media interviews in which the CDC participated on July 3 and July 11, 2007.
    Throughout these media events, the CDC did not use Speaker’s name, even though
    his identity had been widely revealed at this point.
    C.     District Court’s Status Conference
    On August 27, 2009, the district court conducted a telephonic status
    conference with counsel for the parties. The main issues in the conference related
    4
    Speaker’s Amended Complaint acknowledges that the CDC was not the only health
    institution in Atlanta involved in his case. His Amended Complaint indicates other Atlanta
    entities were involved in his diagnosis and testing, including the Fulton County Health
    Department Tuberculosis Program, the Georgia Public Health Laboratory, and the Georgia
    Department of Health and Wellness.
    10
    to what losses are recoverable under the Privacy Act and what discovery could be
    sought. The CDC’s counsel invoked the precedents of Bell Atlantic Corporation v.
    Twombly, 
    550 U.S. 544
    , 
    127 S. Ct. 1955
    (2007), and Ashcroft v. Iqbal, 556 U.S.
    __, 
    129 S. Ct. 1937
    (2009), as a rationale to deny Speaker’s Rule 56(f) discovery
    request. The CDC contended that Speaker had not properly alleged the statutory
    elements of a Privacy Act violation, nor had he identified the nature of the
    wrongful disclosure. The district court inquired why the CDC filed a motion for
    summary judgment when it was alleging pleading inadequacies.5
    After lengthy exchanges with counsel for both parties, the district court
    denied Speaker’s request for discovery at this juncture and temporarily stayed the
    case.6 The court, however, allowed Speaker the option of filing an Amended
    5
    The district court stated:
    If you had filed a motion to dismiss under Rule 12, I would have looked at
    the pleadings to determine whether or not they were sufficient under Twombly to
    move forward under a plausibility argument. But you have opened this can of
    worms, not me.
    ....
    . . . [B]y your filing it and filing all these attachments, you have opened up
    the record.
    6
    The district court denied discovery, stating:
    I am always extremely reluctant where there is a pending motion for
    summary judgment with a request and information submitted to me to go beyond the
    pleadings to not allow some discovery on fundamental issues. I just have to go and
    look at the pleadings to see what fundamental issue there might be.
    But the CDC has taken this litigation approach, it complicates it in my mind
    as far as whether I can stick to the pleadings . . . .
    So I am going to go back and revisit this. And until I do, the case will stand
    instanter and we won’t have any discovery until I allow it.
    11
    Complaint to add factual specificity necessary to survive a Rule 12(b)(6) motion
    under the pleading standards set forth in Twombly and Iqbal.
    D.     Final Proceedings
    On August 31, 2009, Plaintiff Speaker filed an Amended Complaint, which
    we recounted above. On September 17, 2009, Defendant CDC filed a motion to
    dismiss or, in the alternative, a motion for partial summary judgment. Along with
    its motion to dismiss, the CDC attached another “statement of material facts about
    which there is no dispute,” in addition to essentially the same exhibits that were
    attached to its earlier motion for summary judgment. Among the new exhibits,
    however, were videos of the May 29 and May 30, 2007 CDC press conferences,
    which reflect the CDC’s statements recited above.7
    In a November 23, 2009 order, the district court granted the CDC’s motion
    to dismiss Speaker’s Amended Complaint under Rule 12(b)(6) for failure to state a
    claim. The court denied the CDC’s other motions as moot. Speaker v. U.S. HHS
    CDC, 
    680 F. Supp. 2d 1359
    , 1369-70 (N.D. Ga. 2009). Speaker timely appealed.
    7
    Other new exhibits were labeled as “July 3, 2007 Letter to Speaker” (Exhibit N); “July
    13, 2007 HHS Memorandum re Disclosure of XDR Patient’s Identity” (Exhibit P); and “July 11,
    2007 Letter to Speaker” (Exhibit R). The CDC also filed additional declarations authenticating
    the exhibits.
    12
    II. STANDARD OF REVIEW
    A.     Motion to Dismiss
    We review de novo a Rule 12(b)(6) dismissal of a complaint for failure to
    state a claim. See Rosenberg v. Gould, 
    554 F.3d 962
    , 965 (11th Cir. 2009). In
    ruling on a 12(b)(6) motion, the Court accepts the factual allegations in the
    complaint as true and construes them in the light most favorable to the plaintiff.
    Hill v. White, 
    321 F.3d 1334
    , 1335 (11th Cir. 2003).
    B.     Exhibits Relating to CDC’s Motion to Dismiss
    In appeals of Rule 12(b)(6) dismissals, it is generally true that the “scope of
    the review must be limited to the four corners of the complaint.” St. George v.
    Pinellas Cnty., 
    285 F.3d 1334
    , 1337 (11th Cir. 2002). If matters outside the
    pleadings are presented by the parties and considered by the district court, the Rule
    12(b)(c) motion must be converted into a Rule 56 summary judgment motion. Fed.
    R. Civ. P. 12(d). This Court, however, has recognized an important qualification
    to this rule where certain documents and their contents are undisputed:
    “In ruling upon a motion to dismiss, the district court may consider an extrinsic
    document if it is (1) central to the plaintiff's claim, and (2) its authenticity is not
    challenged.” SFM Holdings, Ltd. v. Banc of Am. Secs, LLC, 
    600 F.3d 1334
    , 1337
    (11th Cir. 2010); see also Harris v. Ivax Corp., 
    182 F.3d 799
    , 802 n.2 (11th Cir.
    13
    1999) (stating that “a document central to the complaint that the defense appends
    to its motion to dismiss is also properly considered, provided that its contents are
    not in dispute”). In its order, the district court relied upon Defendant CDC’s
    supporting exhibits and its “statement of material facts about which there is no
    genuine dispute” derived in part from those exhibits. Because the materials relied
    upon by the district court are not disputed (at least at this juncture),8 and because
    they are central to Plaintiff’s claim, we similarly incorporate their contents to
    determine whether Speaker has alleged sufficient facts to state a claim under the
    Privacy Act.9
    C.     Pleading Standard Under Twombly and Iqbal
    In Conley v. Gibson, 
    355 U.S. 41
    , 
    78 S. Ct. 99
    (1957), the United States
    Supreme Court instructed that “a complaint should not be dismissed for failure to
    state a claim unless it appears beyond doubt that the plaintiff can prove no set of
    8
    In this appeal, the CDC states that “Plaintiff did not challenge any of the material facts
    or supporting exhibits filed by the government. The district court accordingly relied on the
    government’s statement of undisputed facts in its opinion.” Appellee’s Br. at 6 n.5. We
    recognize, however, that Speaker, in the district court, did contest the authenticity of the CDC’s
    press conference transcripts, alleging irregularities and omissions. The CDC then supplemented
    the record with videos of those same press conferences. In this appeal, Speaker has not
    contested the district court’s reliance upon these extrinsic documents.
    9
    The CDC faults Speaker for relying upon facts, contained in newspaper articles, that
    were not alleged in his Amended Complaint. See Appellee’s Br. at 28. Yet, the CDC itself
    placed these newspaper articles before the district court by appending them to its motion to
    dismiss as statements of undisputed material facts and exhibits. The CDC has utilized them in
    its own brief on appeal, and on appeal the CDC has not objected to the district court’s usage of
    these facts. The CDC cannot employ its exhibits as both a sword and a shield.
    14
    facts in support of his claim which would entitle him to relief.” 
    Id. at 45-46,
    78 S.
    Ct. at 102. In 2007, the Supreme Court in Bell Atlantic Corporation v. Twombly,
    
    550 U.S. 544
    , 
    127 S. Ct. 1955
    (2007), retired Conley’s “no set of facts” test in
    favor of a new formulation of Rule 12(b)(6)’s pleading standard. 
    Id. at 562-63,
    127 S. Ct. at 1969.
    In Twombly, the Supreme Court distinguished “plausible” claims from
    allegations that were merely “conceivable,” and stated that the Court “[did] not
    require heightened fact pleading of specifics, but only enough facts to state a claim
    to relief that is plausible on its face.” 
    Id. at 570,
    127 S. Ct. at 1974. The Supreme
    Court explained that a complaint “does not need detailed factual allegations,” but
    the allegations “must be enough to raise a right to relief above the speculative
    level.” 
    Id. at 555;
    127 S. Ct. at 1964-65. Furthermore, “a well-pleaded complaint
    may proceed even if it strikes a savvy judge that actual proof of those facts is
    improbable, and that a recovery is very remote and unlikely.” 
    Id. at 556,
    127 S. Ct.
    at 1965 (quotation marks omitted).
    Subsequently, in Iqbal the Supreme Court clarified that “[a] claim has facial
    plausibility when the plaintiff pleads factual content that allows the court to draw
    the reasonable inference that the defendant is liable for the misconduct alleged.”
    Id. at __, 129 S. Ct. at 1949; see also Watts v. Fla. Int’l Univ., 
    495 F.3d 1289
    ,
    15
    1295-1296 (11th Cir. 2007) (“The Court has instructed us that the rule ‘does not
    impose a probability requirement at the pleading stage,’ but instead ‘simply calls
    for enough fact to raise a reasonable expectation that discovery will reveal
    evidence of’ the necessary element.”) (quoting 
    Twombly, 550 U.S. at 556
    , 127 S.
    Ct. at 1965). Given the Twombly and Iqbal plausibility standard, we turn to
    whether Speaker’s Amended Complaint states a claim under the Privacy Act.
    III. DISCUSSION
    A.    Four Elements of a Privacy Act Claim Under 5 U.S.C. § 552a(g)(1)(D)
    In 1974 Congress enacted the Privacy Act “to protect the privacy of
    individuals identified in government information systems by regulating the
    collection, maintenance, use and dissemination of personal information and
    prohibiting unnecessary and excessive exchange of such information within the
    government and to outside individuals.” Cochran v. United States, 
    770 F.2d 949
    ,
    954 (11th Cir. 1985). The Privacy Act imposed upon federal agencies an array of
    record-keeping obligations to prevent unauthorized disclosures of confidential
    information. It also created a private right of action, enabling citizens to sue when
    Privacy Act violations occur. 5 U.S.C. § 552a(g)(1).
    Specifically, the Privacy Act contains a catch-all provision allowing an
    individual to bring a civil suit when an agency “fails to comply” with the Privacy
    16
    Act “in such a way as to have an adverse effect on an individual.” 5 U.S.C. §
    552a(g)(1)(D).10 A civil plaintiff may recover actual damages, attorney’s fees, and
    costs under this subsection, but the court must first determine that the agency acted
    intentionally or willfully. See 5 U.S.C. § 552a(g)(4).
    In Fanin v. U.S. Dep’t of Veterans Affairs, this Court summarized the four
    elements necessary to bring a claim under § 552a(g)(1)(D):
    The plaintiff must demonstrate that: (1) the government failed to
    fulfill its record-keeping obligation; (2) the agency acted intentionally
    or willfully in failing to perform its obligation; (3) the failure
    proximately caused an adverse effect on an individual; and (4) that
    individual suffered actual damages.
    
    572 F.3d 868
    , 872 (11th Cir. 2009) (citing Perry v. Bureau of Prisons, 
    371 F.3d 1304
    , 1305 (11th Cir. 2004)), cert. denied, 
    130 S. Ct. 1755
    (2010).
    Therefore, to state a valid claim under the Privacy Act, Speaker must
    establish these four elements: (1) the CDC failed to fulfill its record-keeping
    obligation, 5 U.S.C. § 552a(g)(1)(D); (2) it did so deliberately, 5 U.S.C. §
    552a(g)(4); (3) Speaker suffered an adverse effect from this disclosure, 5 U.S.C. §
    552a(g)(1)(D); and (4) he suffered actual damages, 5 U.S.C. § 552a(g)(4)(A).
    Moreover, given the pleading standards announced in Twombly and Iqbal,
    Speaker must do more than recite these statutory elements in conclusory fashion.
    10
    There are other causes of action in the Privacy Act, but we address the only one
    relevant here.
    17
    Rather, his allegations must proffer enough factual content to “raise a right to relief
    above the speculative level.” 
    Twombly, 550 U.S. at 555
    , 127 S. Ct. at 1965.
    Accordingly, to state a claim, Speaker must do more than allege that the CDC did
    not fulfill its record-keeping obligation. Speaker must allege the specific nature of
    the record-keeping obligation the CDC failed to satisfy.
    The record-keeping obligation at issue here is outlined in § 552a(b), which
    states that “[n]o agency shall disclose any record which is contained in a system of
    records by any means of communication to any person, or to another agency,”
    except by the individual’s written consent or if one of twelve statutory exceptions
    is met. 5 U.S.C. § 552a(b). The Privacy Act defines a “record” as:
    [A]ny item, collection, or grouping of information about an individual
    that is maintained by an agency, including, but not limited to, his
    education, financial transactions, medical history, and criminal or
    employment history and that contains his name, or the identifying
    number, symbol, or other identifying particular assigned to the
    individual, such as a finger or voice print or a photograph.
    5 U.S.C. § 552a(a)(4) (emphasis added). Meanwhile, the Act defines a “system of
    records” as “a group of any records under the control of any agency from which
    information is retrieved by the name of the individual or by some identifying
    number, symbol, or other identifying particular assigned to the individual.” 5
    U.S.C. § 552a(a)(5).
    Accordingly, the CDC did not fulfill its record-keeping obligation if it
    18
    disclosed: (a) any item, collection, or grouping of information (b) that contains
    (and is retrievable by) Speaker’s name or an identifying number, symbol, or other
    identifying particular assigned to Speaker (c) within its system of records (d) by
    any means of communication11 (e) to any person or agency.
    B.      Speaker’s Amended Complaint
    Reading Speaker’s Amended Complaint as a whole, we conclude that it both
    alleges the requisite statutory elements and marshals “enough facts to state a claim
    to relief that is plausible on its face.” Twombly, 550 U.S. at 
    570, 127 S. Ct. at 1974
    .
    Whether Speaker’s allegations satisfy elements two, three, and four in the
    Fanin test is not the main focus of the appeal. We review elements two, three, and
    four and then turn to element one, the CDC’s record-keeping obligation.
    As to the intentionality requirement in element two, Speaker expressly
    alleges that the CDC’s “unauthorized disclosure” was “intentional.” Am. Compl. ¶
    1; see also 
    id. ¶ 82
    (stating that improper disclosures were “a result of the
    deliberate actions of the CDC and its employers or agents”); 
    id. ¶ 83
    (alleging that
    CDC’s disclosures were “part of a media campaign directed toward Mr. Speaker”);
    11
    Numerous courts have held that the Privacy Act protects against improper oral
    disclosures. See Jacobs v. Nat’l Drug Intelligence Ctr., 
    423 F.3d 512
    , 517 n.7 (5th Cir. 2005)
    (collecting cases).
    19
    
    id. ¶ 1
    11 (stating that “[a]t all times relevant herein, the CDC acted wilfully and
    intentionally in connection with the aforementioned disclosures”); 
    id. ¶ 1
    12
    (referring to CDC’s unauthorized disclosure as “intentional”).
    As to the adverse effect required in element three, the Supreme Court has
    stated that the “adverse effect” language of the Privacy Act is “a term of art
    identifying a potential plaintiff who satisfies the injury-in-fact and causation
    requirements of Article III standing, and who may consequently bring a civil action
    without suffering dismissal for want of standing to sue.” Doe v. Chao, 
    540 U.S. 614
    , 624, 
    124 S. Ct. 1204
    , 1211 (2004). Speaker has alleged numerous injuries
    sufficient to satisfy both Article III standing and the “adverse” effect element of
    the Privacy Act. See, e.g., Am. Compl. ¶ 69 n.2 (alleging marital dissolution
    caused by CDC’s unlawful disclosures); 
    id. ¶ 84
    (stating that Speaker was
    subjected to “public criticism and forced . . . to defend the false allegations being
    made against him”); 
    id. ¶ 1
    14 (alleging “unwanted public attention,” “death
    threats,” and “strain on his marital relationship”); 
    id. ¶ 1
    15 (alleging “damage to
    his personal and professional reputation”); 
    id. ¶ 1
    16 (alleging “grave mental
    anguish and emotional distress”).
    As to the actual damages requirement in element four, this Court has held
    that “‘actual damages’ as used in the Privacy Act permits recovery only for proven
    20
    pecuniary losses and not for generalized mental injuries, loss of reputation,
    embarrassment or other non-quantifiable injuries.” Fitzpatrick v. IRS, 
    665 F.2d 327
    , 331 (11th Cir. 1982), abrogated on other grounds by Doe v. 
    Chao, 540 U.S. at 616
    , 124 S. Ct. at 1206. Speaker’s allegations, taken as true for purposes of a Rule
    12(b)(6) motion, satisfy this requirement. See, e.g., Am. Compl. ¶ 114 (alleging
    that Speaker suffered “both pecuniary and non-pecuniary losses”); 
    id. ¶ 1
    15
    (alleging that CDC disclosures “had a substantial economic and noneconomic
    impact upon his livelihood,” including loss of prospective clients as an attorney);
    
    id. ¶ 1
    16 (alleging “considerable economic and non-economic damage to his
    personal and professional reputation”).
    The crux of the CDC’s arguments on appeal concerns element one of the
    Fanin test: whether the CDC failed to fulfill its record-keeping obligation. As to
    this element, Speaker’s Amended Complaint sufficiently states a claim as well.
    At the outset, Speaker alleges that the CDC disclosed an “item, collection, or
    grouping of information” about Speaker. Among other allegations, Speaker claims
    that the CDC disclosed his confidential medical history, Am. Compl. ¶ 1, one of
    the expressly enumerated items listed in the Privacy Act’s definition of “record.”
    See 5 U.S.C. § 552a(a)(4). Speaker also alleges that “the Defendant CDC
    maintained a system of documents and records containing sensitive private
    21
    information, including medical history and other protected health information,
    identifiable to specific individuals including [Speaker].” Am. Compl. ¶ 105
    (emphasis added). That CDC medical records contain the individual’s name and
    are retrievable by name is hardly surprising. And Speaker expressly alleges that
    these records were “contained within the system of records” maintained by the
    CDC. Am. Compl. ¶ 1. Speaker further alleges that the unauthorized disclosures
    were made to “person[s],” particularly “law enforcement officials,” “members of
    the media,” and “the general public.” Am. Compl. ¶¶ 82-83.
    The CDC’s main argument here is that Speaker’s Amended Complaint
    impermissibly equivocated on the issue of whether the CDC itself disclosed his
    name. The CDC cites, in particular, Paragraph 82 of the Amended Complaint,
    which alleges that “the CDC caused personally identifiable information about Mr.
    Speaker to be improperly disclosed.” Am. Compl. ¶ 82. The CDC, however, reads
    the Amended Complaint far too narrowly. Nothing in the transitive verb “cause”
    necessitates the intervention of a third party, as the CDC seems to imply.
    Even if a substantive difference arguably exists between “causing”
    disclosures and “making” disclosures, any pleading infirmity is obviated by the
    fact that Speaker later refers to the CDC “making the aforementioned disclosures
    about Mr. Speaker.” Am. Compl. ¶ 84 (emphasis added); see Aldana v. Del Monte
    22
    Fresh Produce, N.A., Inc., 
    416 F.3d 1242
    , 1252 n.11 (11th Cir. 2005) (stating that,
    in a Rule 12(b)(6) context, “[w]e read the complaint as a whole”). As recounted
    earlier, Speaker’s Amended Complaint in multiple places refers to the CDC’s
    making the disclosures or to the CDC’s unlawful disclosures of Speaker’s private
    identifiable information.
    The district court stated, “What is clear from the allegation itself is that
    Speaker’s identity was not disclosed by the CDC or any other person. If Speaker
    was identified by a news agency, it was because it discovered Speaker’s identity
    using other information sources.” 
    Speaker, 680 F. Supp. 2d at 1366
    . This
    statement gives credit only to Speaker’s “indirect disclosure” theory and does not
    fully take into account the instances throughout the Amended Complaint in which
    Speaker alleges a direct disclosure by the CDC. Of course, whether Speaker can
    ultimately prove his allegations is another matter.12
    C.     Twombly and Iqbal’s Plausibility Analysis
    12
    The district court further stated that “Speaker does not state that any disclosures were
    ‘made,’ but that the CDC ‘caused’ them to be made. A claim that a disclosure was ‘caused’ to
    be made does not allege a disclosure that violates the Privacy Act. An actionable disclosure
    must have been made by the defendant.” 
    Speaker, 680 F. Supp. 2d at 1364
    n.8 (internal citation
    omitted). Because we conclude that Speaker’s Amended Complaint sufficiently alleges the CDC
    itself made the disclosure of his identity, we do not need to reach, for Rule 12(b)(6) purposes,
    the legal issues of whether the CDC disclosed enough, or the requisite type of, identifying
    particulars to constitute a Privacy Act violation, which in turn caused the press to identify him.
    There has been no discovery and those issues are better addressed once the parties have an
    opportunity to develop the record.
    23
    Furthermore, Plaintiff Speaker has pleaded enough factual content to
    “nudge[] [his] claims across the line from conceivable to plausible.” Twombly,
    550 U.S. at 
    570, 127 S. Ct. at 1974
    . Importantly, Speaker’s allegations are not
    barren recitals of the statutory elements, shorn of factual specificity. See 
    id. at 555,
    127 S. Ct. at 1964-65 (stating that “a plaintiff’s obligation to provide grounds of
    his entitlement to relief requires more than labels and conclusions, and a formulaic
    recitation of the elements of a cause of action will not do” (quotation marks and
    brackets omitted)).
    Rather, Speaker alleges what the CDC disclosed; namely, “personally
    identifiable information,” including information relating to his “medical history
    and his testing and treatment for tuberculosis.”13 Am. Compl. ¶ 81. Moreover, he
    alleges when the CDC disclosed this information: namely, “during the time frame
    of said public press conferences.” Am. Compl. ¶ 83. Speaker’s Amended
    Complaint narrows the time frame of the CDC’s initial disclosures to a short period
    in late May 2007. Speaker also expressly identifies one news organization to
    whom disclosure was made; namely, the Associated Press, which he claims
    13
    The CDC press conferences, attached as exhibits in Defendant’s motion to dismiss,
    divulged that the patient had an extremely drug-resistant form of tuberculosis and that he was
    “smear negative” (correlated with a low risk of transmission). Moreover, newspaper articles in
    the days surrounding these events reported on details not publicly disclosed at the CDC press
    conferences, including Speaker’s quarantine at Grady Memorial Hospital.
    24
    received the leaked information between May 29 and May 31. Id.14 Importantly,
    Speaker has also alleged with factual specificity how the CDC came into
    possession of this information. Even the CDC does not dispute that it had the
    information that Speaker alleges was impermissibly disclosed. And there is no
    doubt that some entity, or its employees, disclosed Speaker’s identity, since not
    even the CDC contends that Speaker himself revealed this information before the
    AP’s May 31 article.
    Defendant CDC asserts that the factual scenario in this case largely mirrors
    the factually-insufficient pleadings in Twombly. We disagree. Twombly involved
    a claim by plaintiffs that telecommunications providers violated the Sherman Act,
    15 U.S.C. § 1, by conspiring to enter into agreements not to compete in each
    other’s respective 
    territories. 550 U.S. at 548-50
    , 127 S. Ct. at 1961-62. The
    Supreme Court stated that mere parallel activity that is unfavorable to competition,
    “absent some factual context suggesting agreement,” was insufficient to withstand
    Rule 12(b)(6) dismissal, since such parallel activity was equally consistent with
    lawful independent action. 
    Id. at 548-49,
    567-69, 127 S. Ct. at 1961
    , 1972-73. In
    Twombly, doubt encompassed not merely who entered into an agreement, but
    14
    Citing Paragraph 83(b) of the Amended Complaint, the district court stated: “Plaintiff
    does not allege what was disclosed, when it was disclosed, to what news organization disclosure
    was made, or how the media was ‘enabled to ascertain Mr. Speaker's identity.’” Speaker, 680 F.
    Supp. 2d at 1366.
    25
    whether such agreement existed at all. The only lingering uncertainty here, by
    contrast, concerns whether it was a federal agency (namely, the CDC) or a very
    limited number of other health institutions that divulged Speaker’s identity.
    Speaker provides greater factual specificity than the Twombly plaintiffs
    (and, by extension, a more plausible claim), such as by alleging an extremely
    determinate and compressed span of time in which the violations took place. For
    example, a fair reading of the Amended Complaint indicates that the CDC
    allegedly leaked his identity to the media sometime between the day it found out
    about his elevated diagnosis (May 18, 2007) and the day the AP publicly revealed
    his identity (May 31, 2007), and most likely during the period between its first
    press conference (May 29, 2007) and the AP story (May 31, 2007). This contrasts
    markedly with the long and nebulous seven-year time frame in which an agreement
    was alleged to have occurred in Twombly—a broad window which would have
    necessitated “sprawling, costly, and hugely time-consuming” discovery.
    
    Twombly, 550 U.S. at 560
    n.6, 127 S. Ct. at 1967 
    n.6.
    Moreover, the short time frame alleged by Speaker is not only factually
    specific, but it is also more suggestive of a causal nexus between the CDC’s press
    interaction and the exposure of Speaker’s identity. Although several health
    institutions treated Speaker in Atlanta, there are, at this juncture at least, no
    26
    allegations of press conferences or such press interaction by those other Atlanta
    entities around the time his identity was revealed. This close temporal relationship
    between the time of the CDC’s press interaction and the discovery of Speaker’s
    identity is far removed from the factual allegations in Twombly.15
    Speaker need not prove his case on the pleadings—his Amended Complaint
    must merely provide enough factual material to raise a reasonable inference, and
    thus a plausible claim, that the CDC was the source of the disclosures at issue.
    Speaker has met this burden.
    IV. CONCLUSION
    Accordingly, we reverse the district court’s dismissal of Speaker’s Amended
    Complaint and remand for further proceedings.
    15
    Speaker also alleges numerous other facts which he believes isolates the CDC as the
    more likely source of the leak than other medical officials in Atlanta who were also familiar with
    his diagnosis. Primarily, he alleges that the CDC had a greater motivation to disclose his identity
    in order to generate publicity. For instance, he alleges that the CDC had been pursuing a
    tuberculosis funding initiative for several years that finally passed Congress in December 2007,
    spurred by the media attention garnered by Speaker’s ordeal. Am. Compl. ¶ 103. He also
    alleges multiple incidents in which the CDC did not take precautions to protect Speaker from
    exposing others to his tuberculosis, despite its statements that he presented a legitimate public
    health risk. See Am. Compl. ¶ 69, 86. Additionally, Speaker alleges that the CDC had access to
    flight manifests and could have personally contacted the potentially affected passengers without
    attracting undue media attention to the matter. Lastly, Speaker alleges in briefing, though not in
    his Amended Complaint, that there have been at least one hundred cases in which XDR-TB-
    diagnosed persons have boarded commercial airlines, yet this was the only incident the CDC
    elected to publicize.
    Because we believe that Speaker has already satisfied his Twombly and Iqbal burden
    without resort to these contentions, we expressly make no ruling on their legitimacy or relevancy
    here.
    27
    REVERSED AND REMANDED.
    28