Doe v. General Services Administration , 544 F. Supp. 530 ( 1982 )

544 F. Supp. 530 (1982)

John DOE
v.
GENERAL SERVICES ADMINISTRATION, et al.

Civ. A. No. M-81-2109.

United States District Court, D. Maryland.

July 27, 1982.

Stephanie Klein, Dennis W. Carroll, C. Christopher Brown, Legal Aid Bureau, Inc., Baltimore, Md., for plaintiff.

J. Frederick Motz, U. S. Atty. D. Md., and Ty Cobb, Asst. U. S. Atty., Baltimore, Md., for defendants.

MEMORANDUM AND ORDER

JAMES R. MILLER, Jr., District Judge.

The plaintiff brought this action for damages and declaratory relief for an alleged breach of the Privacy Act of 1974, 5 U.S.C. § 552a, by employees of the General Services Administration (GSA).^[1] The case is before the court on cross-motions for summary judgment.^[2] The parties have filed extensive depositions and evidentiary materials. A hearing on the motions was held on Friday, July 9, 1982.

The basic facts involved in this suit are as follows. On May 29, 1980, Doe applied for the position of branch manager with the First Federal Savings & Loan of Annapolis (First Federal). He was hired by First Federal to manage their Randallstown branch on June 2, 1980.

In his application,^[3] Doe answered various questions about his prior employment. Doe also answered three questions about his military service: (1) whether he had served in the armed forces; (2) the dates of such service; and (3) any special training he had received.^[4] This application contained a "boilerplate" consent paragraph authorizing First Federal to make an "investigative consumer report" through personal interviews. Also on May 29, 1980, Doe signed a separate "authorization" form, which provided as follows:

"I hereby affirm that my answers to the questions on the employment application are true and correct, and that I have not knowingly withheld any fact or circumstance which would, if disclosed, affect my application unfavorably.

I authorize you to verify any and all information contained in this application and to inquire into my character, general reputation, personal characteristics and mode of living, and I release all concerned from any liability in connection with any information they give.

I have also been advised that I have the right, under Section 606(b) of the Fair Credit Reporting Act, to make a written request, within a reasonable time, for a complete and accurate disclosure of the nature and scope of any investigation."^[5]

In June of 1980, after Doe had begun working as a branch manager, First Federal requested the United Credit Bureau (UCB) to conduct an investigation into Doe's employment history. UCB was provided with a copy of Doe's employment application.^[6] On June 3, 1980, UCB requested confirmation from the United States Army, through the National Personnel Records Center (NPRC) that Doe had served with the Army and the dates of his service.^[7] In support of this request, UCB sent the NPRC a standard employment verification form^[8] and the above-quoted "authorization" signed by Doe.^[9] In return, on June 24, 1980, the NPRC sent the UCB four documents: (1) a cover sheet stating that Doe had been discharged from the Army under honorable conditions for a "character and behavior disorder";^[10] a document showing that Doe had been twice convicted by summary court martial;^[11] and (3) two Army psychiatric evaluations.^[12]

Shortly after their receipt, UCB forwarded these documents to First Federal as part of the requested investigative consumer report. Doe was asked to resign by First Federal on July 23, 1980.

The parties have raised the following issues in their motions:^[13]

(1) Whether Doe "consented" to the release of the records sent to the UCB by the NPRC. 5 U.S.C. § 552a(b).

(2) Whether the defendants' actions were "intentional or willful" within the meaning of the Privacy Act. 5 U.S.C. § 552a(g)(4).

I. Consent

The Privacy Act does not define the word "consent." Consequently, the meaning of that word under the Act must be determined by examining the Act's legislative history and any validly promulgated administrative rules or policies.^[14]

As Professor Davis has noted, only section 3 of the Privacy Act, 88 Stat. 1896 (1974), is codified at 5 U.S.C. § 552a. 1 K. Davis, Administrative Law Treatise § 5:43 (2d ed. 1982 Supp.). Section 2 of the Privacy Act, which contains an enumeration of Congress' findings and purposes, is set out only in the statutes-at-large. Section 2 provides:

"Sec. 2(a) The Congress finds that—

(1) the privacy of an individual is directly affected by the collection, maintenance, use, and dissemination of personal information by Federal agencies;

(2) the increasing use of computers and sophisticated information technology, while essential to the efficient operations of the Government, has greatly magnified the harm to individual privacy that can occur from any collection, maintenance, use, or dissemination of personal information;

(3) the opportunities for an individual to secure employment, insurance, and credit, and his right to due process, and other legal protections are endangered by the misuse of certain information systems;

(4) the right to privacy is a personal and fundamental right protected by the Constitution of the United States; and

(5) in order to protect the privacy of individuals identified in information systems maintained by Federal agencies, it is necessary and proper for the Congress to regulate the collection, maintenance, use and dissemination of information by such agencies.

(b) The purpose of this Act is to provide certain safeguards for an individual against an invasion of personal privacy by requiring Federal agencies, except as otherwise provided by law, to—

(1) permit an individual to determine what records pertaining to him are collected, maintained, used, or disseminated by such agencies;

(2) permit an individual to prevent records pertaining to him obtained by such agencies for a particular purpose from being used or made available for another purpose without his consent;

(3) permit an individual to gain access to information pertaining to him in Federal agency records, to have a copy made of all or any portion thereof, and to correct or amend such records;

(4) collect, maintain, use, or disseminate any record or identifiable personal information in a manner that assures that such action is for a necessary and lawful purpose, that the information is current and accurate for its intended use, and that adequate safeguards are provided to prevent misuse of such information;

(5) permit exemptions from the requirements with respect to records provided in this Act only in those cases where there is an important public policy need for such exemption as has been determined by specific statutory authority; and

(6) be subject to civil suit for any damages which occur as a result of willful or intentional action which violates any individual's rights under this Act."

Both the courts^[15] and the commentators^[16] have noted the peculiar manner in which the Privacy Act was passed by Congress. In brief, the differences between the House and Senate bills were not resolved in conference. Instead, the bills were shuttled back and forth between the House and the Senate with staff members attempting to work out compromise language. The result was the enactment of a Senate bill containing primarily the House version of the Act. Further, instead of publishing a conference committee report, the proponents of the measure had a staff analysis read into the congressional record.

Notwithstanding the somewhat unusual circumstances surrounding the Act's passage, its fundamental purpose is clearly discernable: Congress was vitally concerned with the collecting agency's dissemination of sensitive and personal information to third parties. See, e.g., Detroit Edison Co. v. NLRB, 440 U.S. 301, 318-19 n.16, 99 S. Ct. 1123, 1133 n.16, 59 L. Ed. 2d 333 (1978); Wren v. Harris, 675 F.2d 1144, 1145-46 (10th Cir. 1982); Houston v. Department of Treasury, 494 F. Supp. 24, 27-28 (D.D.C. 1979); Local 2047, American Federation of Government Employees v. Defense General Supply Center, 423 F. Supp. 481, 485-86 (E.D.Va.1976), aff'd, 573 F.2d 184 (4th Cir. 1978).

To control such disclosure, Congress prohibited the release of any information covered by the Privacy Act without the consent of the individual concerned, unless authorized by one of eleven specific exceptions. 5 U.S.C. § 552a(b). See, e.g., Local 2047, American Federation of Government Employees v. Defense General Supply Center, 423 F.Supp. at 485-86; Harper v. United States, 423 F. Supp. 192, 197 (D.S.C.1976).

The government does not contend that the information was released pursuant to an enumerated exception to the consent requirement. Further, neither the parties' nor the court's research has revealed any cases that are factually similar to the instant case.^[17]

Doe's argument regarding consent proceeds along two general lines of analysis. Doe first contends that the general authorization he gave to First Federal is not an adequate consent under the Privacy Act for the release of psychiatric records. A corollary to this argument is that even if the "consent" authorized the verification of the information listed on the UCB submission, it was not sufficient to authorize the type of information actually released. Doe's second general argument is that the disclosure at issue was not in conformity with the agency's own policies and rules.

The government does not address directly Doe's first argument. Instead, the government attempts to show that the disclosure was made in conformity with the relevant agency policies.

Doe relies primarily on three administrative provisions in support of his second argument. The first is Defense Privacy Board Decision Memorandum 76-1, published on March 12, 1976.^[18] That decision provides, in pertinent part:

"Character of Discharge: In the case of discharges resulting from administrative processing, the character of discharge is not a matter of public record, and the procedures and/or hearing leading to discharge are not public. The Department of Defense has gone to great lengths to preserve the confidentiality of the character of discharge—e.g., removal of SPN numbers from the DD-214. The release of this information to the general public has thus been viewed as an unwarranted invasion of privacy and not releasable under the Privacy Act unless the individual provides his written consent. In the case of discharges premised under courts-martial, the proceedings and record are exempt from the restrictions of the Privacy Act by virtue of the fact that the Act incorporates the definition of "agency" found at 5 U.S.C. § 551(1) which specifically excludes courts-martial (see 5 U.S.C. § 551(1)(F)). The proceedings are public. Therefore, the approved sentence and subsequent clemency action, if any, are releasable under the FOIA."^[19]

Doe also relies on several provisions of the "Release and Access Guide," a document promulgated by the GSA, in consultation with the National Archives and the Department of Defense, for use at the National Personnel Records Center (NPRC).^[20]

NPRC 1864.112 provides, in relevant part, as follows:

"5. An authorization should specify that the custodian of the military record or the National Personnel Records Center, St. Louis, Missouri, is authorized to disclose military personnel and medical records or dependent's medical records to an agent of a designated company.

a. If the authorization specifies only medical records, personnel records will not be released and vice versa if the authorization specifies only personnel records.

b. The Center will not honor vague authorizations which have been passed from one company to another. The authorization must specify the company whose agency will complete the review.

c. The Center will not honor vague authorizations which do not specify or imply that the subject of the record realizes that his/her military records will be reviewed."^[21]

Doe next contends that the psychiatric reports disclosed were "medical records."^[22] If they are medical records, their release appears to be governed by NPRC 1864.110 which provides:

"5. Authorization for release of medical records. Before medical records may be released to a third party, the individual whose records are involved must authorize release. The authorization must: (1) adequately identify the records to be released; (2) state, as specifically as possible, who is sanctioned to receive clinical/health records; "blanket" or general authorizations are not acceptable; (3) bear the signature of the veteran or dependent, next of kin, or legal representative, as appropriate; and (4) bear a reasonably current date. (An authorization which is more than twelve months old is not honored by NPRC personnel.) Photocopies, or comparable reproductions, which meet the preceding requirements are acceptable equally with originals. In questionable cases, the veteran's signature on the authorization request should be compared with signatures on available personnel records. If there is no similarity, refer inquiry to supervisor for instructions. In cases where a military dependent's medical records are involved, the sponsor's authorization is not needed. Rather, authorization of the dependent (unless he/she is a minor or judged incompetent) is required."^[23]

Finally, Doe asserts that the UCB request^[24] was an employee suitability request governed by NPRC 1865.50C, which provides:

"2. Request forms. Most requests are from the employer with the veteran's authorization as a part of the request, or attached to it.

a. See fig. 2 as an example of a request form which specifically authorizes the release of medical and personnel records.

b. See fig. 3 for an example of a request form which authorizes only medical records.

c. If the request form asks NPRC for an appraisal of the applicant's abilities (see fig. 4) and does not specifically authorize the release of either personnel or medical records, return the request using the NPRC Test Form 65, Reply to Employment Suitability Inquiry, until revised GSA Form 7263 (Rev. 12/79), Reply to Request for Information, is available. See fig. 5.

d. When release of information/documents is authorized, but an opinion or characterization of the veteran's job performance is requested as well, furnish the pertinent data/documents using NPRC Test Form 65 for transmittal until revised GSA Form 7263 (Rev. 12/79) is available. See fig. 6."^[25]

In Doe's view, the form submitted by UCB is nearly identical to Fig. 4,^[26] which the Release Guide considers an inadequate consent under the Privacy Act.^[27]

In opposing Doe's interpretation of the Act and the Release Guide, the government contends generally that the consent form submitted by Doe to First Federal is sufficient for disclosure purposes, and that the disclosure was consistent with agency practice.

In somewhat circular fashion, the government first contends that no decision of the Defense Privacy Board has been violated because Doe consented to the release of the information.^[28] The government next contends that NPRC 1864.112 is inapplicable to the disclosure and an inappropriate standard because: (1) it did not become effective until October 27, 1980, after the disclosure of Doe's records; and (2) it applies only to oral, walk-in requests.^[29]

Finally, the government contends that the psychiatric records released were not "pure" medical records and; therefore, that NPRC 1864.110 is inapplicable. In the government's view, the psychiatric reports were simply "summaries" and related to the "facts and circumstances" surrounding Doe's discharge. In support of this interpretation, the government claims that Doe's medical file was on loan to the Veterans Administration at the time of the disclosures to UCB.^[30] According to the government, therefore, the release of the psychiatric reports was authorized by NPRC 1865.16A, Part 5, item 19^[31] and Part 5, item 26.^[32]

An initial issue that must be addressed concerns the legal status of the Release and Access Guide, as its provisions are relied on by both parties under the rubric of "agency interpretations" of the Privacy Act. Such reliance is understandable in light of Congress' failure to define the word "consent" in the text or legislative history of the Act.

Neither side has argued that the provisions of the Release and Access Guide at issue are agency rules within the meaning of 5 U.S.C. § 552a(f), and therefore subject to the notice and comment requirements of 5 U.S.C. § 553. In other words, it is not contended by either party that the Release and Access Guide is a set of legislative rules.^[33]See United States v. Nixon, 418 U.S. 683, 694-96, 94 S. Ct. 3090, 3100-3101, 41 L. Ed. 2d 1039 (1974). See generally 2 K. Davis, Administrative Law Treatise §§ 7:9 to 7:12, 7:15 to 7:18 (2d ed. 1979 & 1982 Supp.).

Although it is not altogether certain,^[34] it appears that the Release and Access Guide is a statement of agency "policies and practices" regarding "retrievability, access controls, retention, and disposal of records." 5 U.S.C. § 552a(e)(4)(E).^[35] For the purpose of these motions, therefore, the court will accept the parties' characterization of the guidelines as "interpretative" without determining whether they qualify as "interpretative rules" under the Administrative Procedure Act, 5 U.S.C. § 553(b)(A).^[36]See Whirlpool Corp. v. Marshall, 445 U.S. 1, 11 n.15, 100 S. Ct. 883, 890 n.15, 63 L. Ed. 2d 154 (1980).

The characterization of the provisions of the Release and Access Guide as agency interpretations of the Privacy Act brings into play three general but related principles of administrative law. As will be seen below, the application of these principles to this case is somewhat strained. Nevertheless, the guidelines are an appropriate starting point given Congress' lack of guidance as to the meaning of the word "consent."

The first principle concerns the deference due to an agency's interpretation of a statute, absent a direct conflict with the statutory language or the underlying congressional purposes. See Bowles v. Seminole Rock Co., 325 U.S. 410, 413-15, 65 S. Ct. 1215, 1217-1218, 89 L. Ed. 1700 (1945). That principle is somewhat diluted in this context, however, as the GSA is neither specifically nor alone charged with administering the Privacy Act. Cf. EPA v. National Crushed Stone Ass'n, 449 U.S. 64, 83-85, 101 S. Ct. 295, 306-307, 66 L. Ed. 2d 268 (1980) (EPA and Federal Water Pollution Control Act); Ford Motor Credit Co. v. Milhollin, 444 U.S. 555, 566-67, 100 S. Ct. 790, 797-798, 63 L. Ed. 2d 22 (1980) (Federal Reserve Board and Truth-in-Lending Act); Miller v. Youakim, 440 U.S. 125, 144-45 & n.25, 99 S. Ct. 957, 968-969 & n.25, 59 L. Ed. 2d 194 (1979) (HEW and AFDC program); Red Lion Broadcasting Co. v. FCC, 395 U.S. 367, 380-82, 89 S. Ct. 1794, 1801-1802, 23 L. Ed. 2d 371 (1969) (FCC and Communications Act).

The second general principle accords deference to the agency's interpretation of its own regulations. See, e.g., Udall v. Tallman, 380 U.S. 1, 16-17, 85 S. Ct. 792, 801-802, 13 L. Ed. 2d 616 (1965); Allen v. Bergland, 661 F.2d 1001, 1004-05 (4th Cir. 1981); Talley v. Mathews, 550 F.2d 911, 919 (4th Cir. 1977). When the regulation at issue is interpretative rather than legislative, however, "[v]arying degrees of deference are accorded ... based on such factors as the timing and consistency of the agency's position, and the nature of its expertise." Batterton v. Francis, 432 U.S. 416, 425 n.9, 97 S. Ct. 2399, 2405 n.9, 53 L. Ed. 2d 448 (1977).^[37]

The court has for several reasons determined to accord the GSA's interpretation of its guidelines slight deference. Not only are there inconsistencies among the various provisions of the Release and Access Guide but, as will be seen below, the depositions of the GSA employees taken in this case reveal differences and inconsistencies in actual interpretation. In addition, "though the [guidelines] are complicated, even frustrating, they are neither highly technical nor call upon any special expertise beyond experience in interpretation of bureaucratic formulation of the English language." Shepherd v. Merit Systems Protection Board, 652 F.2d 1040, 1043 (D.C.Cir.1981) (Wilkey, J.).

The final general principle concerns the effect of non-legislative rules on agency conduct. Although subject to some criticism,^[38] there is substantial authority for the proposition that an agency is bound to follow its own internal or procedural rules when they were promulgated, at least in part, for the protection of individuals over whose interests the agency exercises authority and when a departure from them would prejudice the rights of such individuals. See, e.g., Morton v. Ruiz, 415 U.S. 199, 235, 94 S. Ct. 1055, 1074, 39 L. Ed. 2d 270 (1974); McCourt v. Hampton, 514 F.2d 1365, 1369-70 (4th Cir. 1975); United States v. Heffner, 420 F.2d 809, 811-12 (4th Cir. 1970).^[39]Cf. Massachusetts Dept. of Correction v. LEAA, 605 F.2d 21, 26 (1st Cir. 1979) (agency's breach of guidelines issued for administrative convenience does not amount to arbitrary action).^[40]

The Release and Access Guide was promulgated, in part, to assist GSA employees working at the NPRC to process requests for information relating to military personnel.^[41] Nevertheless, it is apparent from the guidelines themselves,^[42] as well as the method of their adoption and amendment,^[43] that a principal purpose behind their issuance was to implement the letter of and the policies underlying the Privacy Act. Consequently, if the GSA failed to comply with its guidelines in releasing Doe's psychiatric records to the UCB, there may have been a violation of the Privacy Act. Such would not necessarily be the case, however, should the guidelines provide protections exceeding those mandated by the Privacy Act itself. In that event, Doe might have a claim cognizable under the Due Process Clause of the Fifth Amendment rather than one under the Privacy Act. See United States v. Caceres, 440 U.S. at 751-53, nn. 14 & 15, 99 S.Ct. at 1471-1472 nn. 14 & 15; Morton v. Ruiz, 415 U.S. at 235, 94 S.Ct. at 1074.

According to the GSA, Doe's psychiatric records were released to the UCB as the "facts and circumstances" of his discharge and not as medical records. In GSA's view, therefore, the consent strictures of NPRC 1864.110 did not apply. GSA takes this position notwithstanding that: (1) the psychiatric records released to the UCB fall within the guideline's definition of medical records;^[44] (2) Doe's authorization was inadequate for the release of medical records to the UCB;^[45] and (3) the records probably could not have been released to Doe himself.^[46] Thus, despite the absence of any written policy concerning when medical records are not to be treated as medical records under NPRC 1864.110,^[47] and uncertainty expressed by the GSA employees involved as to whether psychiatric records could be released under the authorization signed by Doe,^[48] all of the GSA personnel deposed by Doe maintained that it was appropriate to release the psychiatric records as "facts and circumstances" surrounding Doe's discharge from the Army.^[49]

The difficulty with the GSA's position is not that it is inherently unreasonable to release medical records if they are relevant to the reason for a veteran's discharge, or are relevant in connection with an employment suitability request. Rather, the so-called "facts and circumstances" provisions of NPRC 1865.16A, Part 5, items 19 and 26, assume that the subject of the record has consented to their release and that such information has been requested to be released. Thus, unlike the aspects of the Release and Access Guide dealing specifically with medical records, NPRC 1864.110, walk-in requests, 1864.112, and employee suitability requests, NPRC 1865.50C, the general guidelines contained in NPRC 1865.16A do not specifically define, by way of illustration or otherwise, what constitutes a sufficient consent for the release of a veteran's records to a third party.^[50]

Of further significance in this context is that paragraph 6(b) of NPRC 1865.16A apparently requires that if a request cannot be satisfied without providing information such as psychiatric records, the request and the records are to be forwarded to the appropriate office of the Armed Force concerned.^[51] Although the GSA employee responding to the UCB's request thought it necessary to provide psychiatric material, there is no indication that paragraph 6(b) was considered.

The most specific aspect of the Release and Access Guide apparently applicable to the UCB request is NPRC 1865.50C. That provision governs "handling requests for military service and medical data needed in determining suitability for employment."

The stated purpose of NPRC 1865.50C is as follows:

"to update procedures for replying to employment suitability requests. New procedures are established for handling requests which involve medical/neuropsychiatric records that contain derogatory information potentially injurious to the veteran. These procedures are updated to bring them into conformity with provisions of NPRC 1865.16, Release and access guide for military personnel and related records at NPRC, and NPRC 1864.110, Requests involving medical records."

Figure 2 and Figure 3 of NPRC 1865.50C, which the guidelines state are illustrations of sufficient consents for the release of personnel and medical records, indicate on their face that certain types of records are to be released, who is authorized to receive the records, and by the veteran's signature thereon, indicates that he or she is or should be aware that there has been an authorization to release records.

In contrast, the form sent to the NPRC by the UCB did not specifically request the release of records and does not indicate on whose behalf a request for verification of information is being made. Further, Doe's authorization does not specifically authorize anyone to release any records. It simply authorizes "you" to verify the information contained in his "application" and to investigate generally his background, character and conduct.^[52] When read together, these two documents simply do not meet the level of specificity required for the release of records by GSA's own illustrative forms.

In short, the GSA's assertion that Doe's authorization, which is neither record nor entity specific, and the UCB's request for the verification of basic service information are sufficient under the Release and Access Guide is untenable. That such might be the GSA's practice is beside the point. The court's own examination of the provisions of the Release and Access Guide relied on by the parties reveals that military personnel records, particularly those that are psychiatric in nature, should not be released absent a specific request and authorization therefor by the veteran. Consequently, as interpreted by the GSA's Release and Access Guide, the Privacy Act did not permit the release of records that occurred in this case.

As the court noted earlier, a violation of the Release and Access Guide may not per se be a violation of the Privacy Act. The GSA's apparent interpretation of the nature of the consent required under the Act to authorize the release of records to third parties might exceed that intended by Congress.

In section 2(a)(4) of the Privacy Act, Congress stated that "the right to privacy is a fundamental right protected by the Constitution of the United States." 88 Stat. 1896 (1974). Such a statement, however, is plainly overbroad.

The Supreme Court has recognized a constitutional right of privacy under certain circumstances. As the decided cases indicate, this implicit or explicit recognition usually occurs in connection with those values and liberties that a free society deems to be fundamental. See, e.g., Moore v. City of East Cleveland, 431 U.S. 494, 97 S. Ct. 1932, 52 L. Ed. 2d 531 (1977); Roe v. Wade, 410 U.S. 113, 93 S. Ct. 705, 35 L. Ed. 2d 147 (1973); Stanley v. Illinois, 405 U.S. 645, 92 S. Ct. 1208, 31 L. Ed. 2d 551 (1972); Eisenstadt v. Baird, 405 U.S. 438, 92 S. Ct. 1029, 31 L. Ed. 2d 349 (1972); Griswold v. Connecticut, 381 U.S. 479, 85 S. Ct. 1678, 14 L. Ed. 2d 510 (1965); NAACP v. Alabama, 357 U.S. 449, 78 S. Ct. 1163, 2 L. Ed. 2d 1488 (1958); Skinner v. Oklahoma, 316 U.S. 535, 62 S. Ct. 1110, 86 L. Ed. 1655 (1942). See generally L. Tribe, American Constitutional Law §§ 11-3, 15-3, (1978). See also Poe v. Ullman, 367 U.S. 497, 522, 81 S. Ct. 1752, 1766, 6 L. Ed. 2d 989 (1961) (Black, J., dissenting).

On the other hand, the Court has indicated that the right of privacy is neither absolute nor all encompassing, and often must give way to competing societal interests. See, e.g., Whalen v. Roe, 429 U.S. 589, 97 S. Ct. 869, 51 L. Ed. 2d 64 (1977); United States v. Miller, 425 U.S. 435, 96 S. Ct. 1619, 48 L. Ed. 2d 71 (1976); California Banker's Ass'n v. Shultz, 416 U.S. 21, 94 S. Ct. 1494, 39 L. Ed. 2d 812 (1974). Further, it appears that an individual has no right of privacy solely in connection with injury to reputation alone. See Paul v. Davis, 424 U.S. 693, 96 S. Ct. 1155, 47 L. Ed. 2d 405 (1976). Consequently, because Congress did not indicate in the Act or the legislative history the nature of the consent required for third party release, it is appropriate to measure the requisites of such consent by examining the particular right or interest at stake.

Under Johnson v. Zerbst, 304 U.S. 458, 464, 58 S. Ct. 1019, 1023, 82 L. Ed. 1461 (1938), there cannot be a valid consent to or waiver of the Sixth Amendment right to counsel in a criminal trial unless there has been "an intentional relinquishment of a known right or privilege." See Edwards v. Arizona, 451 U.S. 477, 481-85, 101 S. Ct. 1880, 1883-1885, 68 L. Ed. 2d 378 (1981). In contrast, "knowledge of a right to refuse is not a prerequisite of a voluntary consent" in connection with the relinquishment of certain rights protected by the Fourth Amendment. Schneckloth v. Bustamonte, 412 U.S. 218, 234, 93 S. Ct. 2041, 2051, 36 L. Ed. 2d 854 (1973).

Given Congress' silence on the nature of the consent required under the Privacy Act, this court simply cannot equate the status of the rights protected by that Act with those rights to which the Supreme Court has applied the Johnson standard. See cases collected in Schneckloth v. Bustamonte, 412 U.S. at 237-40, 93 S.Ct. at 2052-2054. The non-application of the Johnson standard is also suggested by the limited availability of injunctive relief under the Act,^[53] the intent requirement for the recovery of civil damages under the Act,^[54] and the constitutionally unprotected status of reputational injury alone. See Paul v. Davis, 424 U.S. 693, 96 S. Ct. 1155, 47 L. Ed. 2d 405 (1976).^[55] Consequently, the fact that Doe may not have actually known that records would be released, or that he could have withheld his consent to such release, is not dispositive.

To provide Doe with appropriate declaratory relief, however, the court need not further address the parameters of the consent required under the Privacy Act. Such relief is available to Doe under the Federal Declaratory Judgment Act, 28 U.S.C. § 2201, for the GSA's failure to comply with its own guidelines in releasing psychiatric information to the UCB.^[56]See C. Wright, The Law of Federal Courts § 100 (1976); 6A Moore's Federal Practice ¶ 57.05 (2d ed. 1982). Further discussion of this issue is also made unnecessary due to the court's ruling, set out below, on Doe's Privacy Act damage claim.

II. Intentional or Willful Conduct

The Privacy Act imposes civil damage liability on an agency only if "the agency acted in a manner which was intentional or willful." 5 U.S.C. § 552a(g)(4). The legislative history of the Act comments on this standard as follows:

"In a suit for damages, the [compromise] amendment reflects a belief that a finding of willful, arbitrary or capricious action is too harsh a standard of proof for an individual to exercise the rights granted by this legislation. Thus the standard for recovery of damages was reduced to ``willful or intentional' action by an agency. On a continuum between negligence and the very high standard of willful, arbitrary, or capricious conduct, this standard is viewed as only somewhat greater than gross negligence."

Analysis of House and Senate Compromise Amendments to the Federal Privacy Act, reprinted in 120 Cong.Rec. S 40405, 40406 and H. 40881, 40882 (1974) (emphasis supplied).

Although several courts have noted this standard, none have sought further to define it. See, e.g., Edison v. Department of the Army, 672 F.2d 840, 846 & n.12 (11th Cir. 1982); Bruce v. United States, 621 F.2d 914, 917 & n.6 (8th Cir. 1980); Parks v. IRS, 618 F.2d at 683; South v. FBI, 508 F. Supp. 1104, 1107-08 (N.D.Ill.1981).

Professor Prosser has commented on gross negligence as follows:

"As it originally appeared, this was very great negligence, or the want of even scant care. It has been described as a failure to exercise even that care which a careless person would use. Several courts, however, dissatisfied with a term so nebulous, and struggling to assign some more or less definite point of reference to it, have construed gross negligence as requiring wilful misconduct, or recklessness, or such utter lack of all care as will be evidence of either—sometimes on the ground that this must necessarily have been the intent of the legislature. But it is still true that most courts consider that ``gross negligence' falls short of a reckless disregard of consequences, and differs from ordinary negligence only in degree, and not in kind. There is, in short, no generally accepted meaning; but the probability is, when the phrase is used, that it signifies more than ordinary inadvertence or inattention, but less than conscious indifference to consequences; and that it is, in other words, merely an extreme departure from the ordinary standard of care."

W. Prosser, Law of Torts § 34 at 183-84 (4th ed. 1971) (footnotes omitted) (emphasis supplied).

This court agrees with the Tenth Circuit that the "willful and intentional" standard of the Privacy Act does not require proof of premeditated malice. Parks v. IRS, 618 F.2d at 683. Nevertheless, gross negligence is an extreme departure from the standard of ordinary care and the Privacy Act's culpability standard is "somewhat greater" than gross negligence.

The undisputed facts show that the GSA, through its employees, believed that release of Doe's psychiatric records was authorized under the Release and Access Guide as "facts and circumstances" surrounding Doe's discharge.^[57] This belief was based primarily on two factors. First, that the UCB request contained service data ordinarily known only to the veteran. Second, Doe did sign an authorization form that, when read in conjunction with the UCB request, arguably authorized at least the verification of the reason for Doe's discharge. Given the fact some kind of a consent was submitted, it was not wholly unreasonable for the GSA records clerk to conclude that Doe knew that psychiatric records would be released since his discharge was for psychiatric reasons.

Simply because this court has concluded that the GSA's interpretation of its own guidelines is erroneous does not establish that the GSA was more than grossly negligent in releasing the disputed records. Such is the case even if the GSA's guidelines accurately reflect Congress' intent as to the type of consent required under the Act, due to the two factors outlined above. In short, Doe has failed to establish a dispute of material fact as to the issue of a "willful and intentional" release. Consequently, the defendants are entitled to summary judgment on that issue.

For the reasons set out above, it is this 27th day of July, 1982, by the United States District Court for the District of Maryland, ORDERED:

1. Doe's motion for summary judgment is GRANTED to the extent of the GSA's failure to comply with its own regulations and is DENIED in all other respects.

2. The defendants' motion for summary judgment is GRANTED as to Doe's claim for damages under the Privacy Act.

3. Judgment shall be entered for Doe in connection with his claim regarding a violation of his Due Process rights under the Fifth Amendment for the GSA's failure to follow its own regulations AND IT IS DECLARED, ADJUDGED AND DECREED that the GSA failed to follow its own regulations in releasing psychiatric records to the UCB and that said failure operated to Doe's prejudice.

4. Judgment shall be entered for the defendants as to Doe's claims based on the Privacy Act.

NOTES

[1] Doe has abandoned his request for injunctive relief. Paper No. 33 at 18.

[2] Paper No. 21 (plaintiff); Paper No. 32 (defendants); Paper No. 33 (plaintiff's reply); Paper No. 36 (defendants' reply).

[3] Paper No. 21, Ex. A.

[4] Id. at 3.

[5] Paper No. 21. Ex. B.

[6] Affidavit of Marie Welch, Paper No. 21, Ex. D.

[7] Id. at ¶ 3.

[8] Defendants' Interrogatory Answers, Paper No. 8, Attachment 5.

[9] Id. at Attachment 6.

[10] Id. at Attachment 1.

[11] Id. at Attachment 4. Doe does not presently contest the release of these records. Paper No. 21 at 5 n.3.

[12] Id. at Attachments 2 & 3.

[13] Notwithstanding any arguable pleading deficiencies, Doe's affidavit of July 7, 1982, appears to satisfy the prima facie elements of: (1) an "adverse effect" because of the agency's violation of the Privacy Act, 5 U.S.C. § 552a(g)(1)(D); and (2) "actual damages." Id. § 552a(g)(4). Compare Parks v. IRS, 618 F.2d 677, 682-83 (10th Cir. 1980) with Houston v. Department of Treasury, 494 F. Supp. 24, 29-30 (D.D.C.1979). The government expressly conceded this point at the motions hearing.

[14] Covered agencies are required to publish in the Federal Register their policies and practices regarding their record systems. 5 U.S.C. § 552a(e)(4). Such agencies are also required to adopt rules relating to these record systems. Id. § 552a(f).

[15] See, e.g., Cell Associates, Inc. v. National Institutes of Health, 579 F.2d 1155, 1160 (9th Cir. 1978); Florida Medical Ass'n, Inc. v. Department of HEW, 479 F. Supp. 1291, 1305-06 (M.D.Fla.1979).

[16] See, e.g., 2 J. O'Reilly, Federal Information Disclosure §§ 20.01 to 20.03 (1982).

[17] The government's citation of Thomas v. Veterans Administration, 467 F. Supp. 458 (D.Conn.1979) as a factually relevant case is spurious. The consent signed by the plaintiff in Thomas was not the type of general authorization at issue in this case. Rather, it was both agency and record specific. 467 F.Supp. at 460-61 n.4.

[18] By regulation, the Department of Defense created the Board "for the purpose of ensuring the preservation of individual privacy within the Department of Defense." 32 C.F.R. § 286a.4(a) (1981). The GSA considers itself bound by the decisions of the Board insofar as they relate to military records in GSA's custody. Deposition of Linda Brown, Paper No. 20, at 8-10. Further, GSA is subject to the access rules of the Department of Defense. See 5 U.S.C. § 552a(f)(1)(2); 44 U.S.C. § 2104; 41 C.F.R. § 105-61.103-2 (1981).

[19] Paper No. 21, Ex. E at 3.

[20] NPRC Memorandum of August 17, 1977, Paper No. 21, Ex. F; Brown deposition, supra note 17, at 5-6, 8-10, 52-53.

[21] Paper No. 21, Ex. G.

[22] NPRC 1864.110 at ¶ 4(c), September 29, 1978, Paper No. 8, Attachment 8.

[23] Id. at ¶ 5.

[24] Paper No. 8, Attachment 5.

[25] Paper No. 8, Attachment 9, at 1.

[26] Paper No. 8, Attachment 9, at 11.

[27] NPRC 1865.50C at ¶ 2(c); Brown deposition, supra note 17, at 35-36.

[28] Paper No. 36 at 5; Brown Affidavit of June 18, 1982 at ¶ 3(d).

[29] Brown Affidavit, supra note 26, at ¶ 5(i).

[30] Brown Affidavit, supra note 26, at ¶ 5; Brown Deposition, supra note 17, at 50-55.

[31] Paper No. 8, Attachment 7 at 9.

[32] Id. at 13.

[33] The Privacy Act regulations of the Department of Defense, issued pursuant to 5 U.S.C. § 552a(f), are published at 32 C.F.R. §§ 286a & 286b (1981).

[34] There is no indication in the record whether the Release and Access Guide has been published in the Federal Register. See 5 U.S.C. § 552a(e)(4) & (f).

[35] See Brown deposition, supra note 17, at 4-15, 52-53; NPRC Memorandum of May 9, 1977, reprinted at Paper No. 21, Ex. F.

[36] For discussions of the criteria for determining whether a rule is legislative or interpretative, see New Jersey v. HHS, 670 F.2d 1262, 1281-83 (3d Cir. 1981); Chamber of Commerce v. OSHA, 636 F.2d 464, 468-69 (D.C.Cir.1980).

[37] See, e.g., General Electric Co. v. Gilbert, 429 U.S. 125, 141-42, 97 S. Ct. 401, 410-411, 50 L. Ed. 2d 343 (1976); Skidmore v. Swift & Co., 323 U.S. 134, 140, 65 S. Ct. 161, 164, 89 L. Ed. 124 (1944). See generally 2 K. Davis, Administrative Law Treatise § 7:13 at 59-61 (2d ed. 1979).

[38] See 2 K. Davis, Administrative Law Treatise § 7:21 at 100-01 (2d ed. 1979).

[39] The exclusionary remedy deemed appropriate in Heffner must be reconsidered in light of United States v. Caceres, 440 U.S. 741, 99 S. Ct. 1465, 59 L. Ed. 2d 733 (1979). The Court in Caceres recognized, however, the continuing vitality of Ruiz in the non-criminal context. 440 U.S. at 751-52 n.14, 99 S.Ct. at 1471-1472 n.14.

[40] For cases involving rules assumed to be legislative in nature, see Mayor & City Council of Baltimore v. Mathews, 562 F.2d 914, 922 (4th Cir. 1977); Algea v. Schweiker, 529 F. Supp. 163, 167 (D.Md.1981). See also Electronic Components Corp. v. NLRB, 546 F.2d 1088, 1090 (4th Cir. 1976).

[41] Brown deposition, supra note 17, at 13-15.

[42] E.g., Paragraph 3 of NPRC Memorandum of May 9, 1977, reprinted at Paper No. 21, Ex. F.

[43] E.g., Id. at ¶ 1; Brown deposition, supra note 17, at 4-15, 52-53. See 5 U.S.C. § 552a(e)(4)(E).

[44] See, e.g., NPRC 1864.110 at ¶ 4, reprinted at Paper No. 8, Attachment 8; Deposition of Patricia Evans, Paper No. 17, at 10-11; Brown deposition, supra note 17, at 26-27.

[45] Brown deposition, supra note 17, at 23 & 48; Evans deposition, supra note 42, at 23 & 25; Deposition of Gertrude Young, Paper No. 16, at 27-28, 34 & 50.

[46] Brown deposition, supra note 17, at 26-28; Young deposition, supra note 43, at 41.

[47] Brown deposition, supra note 17, at 56-58.

[48] Evans deposition, supra note 42, at 21, 23 & 25; Young deposition, supra note 43, at 27-28, 32-34 & 50.

[49] Brown deposition, supra note 17, at 50 & 54; Evans deposition, supra note 42, at 27; Young deposition, supra note 43, at 51-52 & 69.

[50] Consent is defined in ¶ 2(c) of NPRC 1865.16A as "[w]ritten authorization to comply with a request from the individual concerned." Paper No. 8, Attachment 8 at 2.

[51] Id. at 5.

[52] Young thought that the "you" in Doe's authorization was the UCB and that the UCB was Doe's prospective employer. Young deposition, supra note 43, at 48-49 & 68. Evans thought that the "you" in the authorization was the NPRC and that the UCB was the prospective employer. Evans deposition, supra note 42, at 14 & 23. Doe's employment application was not sent to the NPRC and the form used by the UCB states that information has "been requested by one of our clients." The client is not identified.

[53] See, e.g., Edison v. Dept. of the Army, 672 F.2d 840, 845 (11th Cir. 1982); Parks v. IRS, 618 F.2d 677, 682-84 (10th Cir. 1980); Cell Associates, Inc. v. Nat'l Institute of Health, 579 F.2d 1155, 1161-62 (9th Cir. 1978).

[54] 5 U.S.C. § 552a(g)(4).

[55] Cf. Greentree v. U. S. Customs Service, 674 F.2d 74 (D.C.Cir.1982) (material unavailable under the Privacy Act is not per se unavailable under the Freedom of Information Act). But see Painter v. Federal Bureau of Investigation, 615 F.2d 689 (5th Cir. 1980); Terkel v. Kelly, 599 F.2d 214 (7th Cir. 1979), cert. denied, 444 U.S. 1013, 100 S. Ct. 662, 62 L. Ed. 2d 642 (1980).

[56] The court has jurisdiction under 28 U.S.C. § 1331 and there is an actual "case or controversy" between the parties. Aetna Life Insurance Co. v. Haworth, 300 U.S. 227, 241, 57 S. Ct. 461, 464, 81 L. Ed. 617 (1937).

[57] Doe has not introduced any evidentiary materials to controvert the GSA's showing that its employees actually believed that release was authorized and that this belief was held in good faith. These factors are relevant, given the culpability standard, notwithstanding that the release should be viewed primarily from an objective standard.