David Ryan has appealed from an order of the district court awarding summary judgment in favor of the United States Department of Justice in an action brought by Ryan under the Freedom of Information Act (FOIA), 5 U.S.C. § 552, and the Privacy Act, 5 U.S.C. § 552a, to obtain access to a certain memorandum concerning him, as well as damages for the Department's wilful disclosure of the contents of the document to a third party.

Ryan is employed as a Documents' Classification Officer (Security Officer) with the Federal Bureau of Investigation (FBI). Beginning January 6, 1977, he made several requests of the Justice Department pursuant to the FOIA and the Privacy Act for the production of documents relating to him in his official capacity. Specifically, the appellant requested the production of a July 8, 1976, memorandum which he alleged was in the files of the Justice Department. Ryan contends that the July 8, 1976, memorandum dealt with the removal, insulation, reassignment or other curtailment of official actions he had taken with respect to an investigation of alleged surreptitious entries by certain FBI agents.1 Although the appellant was provided with a copy of another related memorandum which referred to him in his official capacity, the Justice Department denied him access to the July 8, 1976, memorandum on the basis that it was exempt from the mandatory disclosure provisions of the FOIA under § 552(b)(5) and (b)(7)(A) and that there were no records properly available to him under the terms of the Privacy Act.2

On August 9, 1977, subsequent to the commencement of the original action, an article appearing in the Washington Post reported that Quinlan J. Shea, Jr., a Justice Department attorney, "characterized the July 8 memo as saying Ryan was 'getting in the way' of the investigators." Ryan then filed an amended complaint which, in addition to his previous claim, alleged that the Justice Department, in violation of the Privacy Act, had wrongfully disclosed to the Washington Post information relating to him and that he was entitled to damages under the Act for the wrongful disclosure.

The district court concluded that the memorandum was exempt from disclosure to the plaintiff under § 552(b)(7) (FOIA) and under § 552a(j) (Privacy Act) as implemented by Justice Department regulations promulgated pursuant to § 552a(j). In addition, it held that the memorandum could not reasonably be segregated into exempt and nonexempt parts. Finally, the court held that § 552a(j), together with the Justice Department regulations, deprived Ryan of any of the civil remedies found in § 552a(g), thus leaving him without an action for relief for the alleged wrongful disclosure of the contents of the memorandum. The district court entered summary judgment in favor of the Justice Department on Ryan's request for disclosure of the memorandum as well as his claim for relief for wrongful disclosure of the contents of the memorandum to the Washington Post.

Disposition of this appeal requires our consideration of the concededly convoluted structure and relationship between the two Acts. Both the Freedom of Information Act and the Privacy Act contain provisions under which a party may gain access to records maintained by agencies of the United States. The FOIA contemplates access to any and all records not exempt from disclosure. The Privacy Act provides for access by an individual to records maintained concerning him. Underlying the FOIA is a broad policy of release, while the Privacy Act limits access and is designed to protect the privacy of individual citizens. Both Acts, however, contain provisions which exempt documents from access under certain specified circumstances.

Subsection 552(a) sets forth the disclosure provisions of the FOIA, and the appellant specifically relies on § 552(a)(3) which requires that each agency make available to the public any records for which there has been a request made in accordance with published rules relative to the procedures to be followed. Subsection 552(b), however, lists nine specific exemptions from the general disclosure provisions of the FOIA. Subsection 552(b)(7) exempts from disclosure "investigatory records compiled for law enforcement purposes, but only to the extent that the production of such records would (A) interfere with enforcement proceedings * * *." Based upon our examination of the memorandum of July 8, 1976, we agree with the conclusion of the district court that it was exempt from disclosure under § 552(b)(7) of the FOIA as a record "compiled for law enforcement purposes" which was part of an ongoing criminal investigation. We further agree that the memorandum was not capable of being reasonably segregated into exempt and nonexempt parts as provided by § 552(b).3

We also are of the opinion that the request for access under the Privacy Act was properly denied. Subsection 552a(d) of the Privacy Act permits an individual to gain access to those records which pertain to him and are found in a system of records maintained by an agency.4 Subsection 552a(j)(2), however, provides for exemption from the application of § 552a(d), among other sections, any system of records which is "maintained by an agency or component thereof which performs as its principal function any activity pertaining to the enforcement of criminal laws * * * and which consists of * * * (B) information compiled for the purpose of a criminal investigation, including reports of informants and investigators, and associated with an identifiable individual * * *."5 To properly exempt a system of records, an agency must: (1) promulgate rules, pursuant to the rule making requirements of § 553(b)(1), (2), and (3), (c) and (e), which exempt a system of records from a provision of the Act, and (2) state the reasons in the rule itself why the system of records is to be exempt from a provision of the Act. 5 U.S.C. § 552a(j). The Justice Department takes the position that because it has promulgated certain regulations found in 28 C.F.R. § 16.90(e) and (f), the memorandum sought by Ryan is exempt from the access provisions of the Privacy Act. Specifically, § 16.90(e) exempts from the § 552a(d) access provisions a system of records designated as "Central Civil Rights Division Index File and Associated Record (JUSTICE/CRT-001)" of which system of records the memorandum is a part. Subsection 16.90(f)(1) refers to the reasons for exempting JUSTICE/CRT-001 from § 552a(d): " * * * because freely permitting access to records in this system would compromise ongoing investigations and reveal investigatory techniques." Since the Justice Department has promulgated rules exempting the system of records which includes the July 8, 1976, memorandum and the reason for withholding the memorandum is consistent with one of the reasons listed in the regulations for exempting JUSTICE/CRT-001 from the application of the access provisions, the district court properly concluded that § 552a(j) and 28 C.F.R. § 16.90(e) and (f) combine to exempt the memorandum from the application of the access provisions of the Privacy Act.6

Subsection 552a(g) provides civil remedies which are available to an individual whose rights under the Privacy Act have been violated by an agency. Ryan seeks damages under the civil remedies provisions of § 552a(g)(4) for the alleged wrongful disclosure of the contents of the July 8, 1976, memorandum by the Justice Department to the Washington Post. As heretofore noted, subsection 552a(j) permits an agency whose primary function is the enforcement of criminal laws to exempt a system of records which is compiled for the purpose of a criminal investigation from the application of the civil remedies provisions by (1) promulgating rules which specifically exempt a system of records from § 552a(g) and (2) stating the reasons for the exemption in the rule itself.7 The Justice Department contends that the system of records of which the memorandum is a part is properly exempt from the application of the civil remedies provisions by the promulgation of 28 C.F.R. § 16.90(e) and (f).

The Department has satisfied the first requirement for exempting the memorandum by promulgating 28 C.F.R. § 16.90(e) which reads in part: "The following system of records is exempt from 5 U.S.C. 552a(c)(3), (d) and (g): (1) Central Civil Rights Division Index File and Associated Records (JUSTICE/CRT-001)." In an effort to comply with the requirement that reasons for the exemption be stated in the rule, the Department has promulgated 28 C.F.R. § 16.90(f) which reads in part: "Exceptions from the particular subsections are justified for the following reasons: * * * (2) From subsection (g) ((civil remedies provisions)) because exemption from the provision of subsection (d) ((access provisions)) will render the provisions on suits to enforce (d) inapplicable." Since the Justice Department has exempted JUSTICE/CRT-001 from the application of the § 552a(d) access provisions, there is no need for the § 552a(g) civil remedies provisions to enforce that subsection, and the Department has adequately explained its reason for so exempting the system of records from that part of the civil remedies provisions. But while the Justice Department had the authority to Completely exempt JUSTICE/CRT-001 from the application of all of the civil remedies, it did so only to the extent that those provisions would have applied to enforce access under § 552a(d).

It should be noted that the Office of Management and Budget which has been given the responsibility of developing guidelines and regulations for the use of agencies in implementing the Privacy Act, and of providing continuing assistance to and oversight of the implementation of the Privacy Act by such agencies,8 made this comment about the exemption provisions of the Act: "It should be emphasized that the exemption provisions are permissive; i. e., an agency head is authorized, but not required, to exempt a system from all or any portion of selected provisions of the Act when he or she deems it to be in the best interest of the Government and consistent with the Act and these guidelines." 40 Fed.Reg. 28971 (1975). By requiring the agency to state the reasons in the rule itself for exempting a system of records from a provision of the Privacy Act, the extent of the exemption intended can be fully ascertained.9

Although the Justice Department could have exempted JUSTICE/CRT-001 from the application of the § 552a(g) civil remedies provisions to a § 552a(b) wrongful disclosure violation, it failed to do so as required by § 552a(j) and cannot now claim such an exemption without first satisfying the requirement that reasons therefor be stated in the rule. Since the Department did not take the steps necessary to exempt JUSTICE/CRT-001 from the civil remedy for wrongful disclosure, it was error to grant summary judgment against the plaintiff on his charge of improper disclosure of the July 8, 1976, memorandum to the Washington Post. We, of course, express no opinion on the merits of the plaintiff's claim.

The judgment denying disclosure and access under Count 1 is affirmed; the judgment dismissing the claim for damages under Count 2 is reversed, and the case remanded for further proceedings.