Plaintiff Jeffrey Louis appeals from the district court's grant of summary judgment on his claims for disclosure of documents by the Department of Labor ("Department") under the Privacy Act, 5 U.S.C. § 552a, and the Freedom of Information Act ("FOIA"), 5 U.S.C. § 552.1 Louis contends a system of records from which he sought information about himself was improperly exempted by the Department pursuant to subsection (k)(2) of the Privacy Act, 5 U.S.C. § 552a(k)(2), because the Department did not comply with the rulemaking procedures of the Administrative Procedure Act ("APA") in exempting the system. Louis further contends that the Department's belated reliance on subsection (d)(5) of the Privacy Act, 5 U.S.C. § 552a(d)(5), which exempts from disclosure "any information compiled in reasonable anticipation of a civil action or proceeding," is improper "post-hoc rationalization" for the Department's decision to withhold information because it did not assert this exemption during the administrative proceedings.

We hold that the Department failed to follow the APA's rulemaking procedures for designating its system of records as exempt, and therefore cannot rely on this exemption to withhold documents from Louis. However, because an agency's withholding of information under the Privacy Act is reviewed de novo by the district court, we hold that the Department may rely on § 552a(d)(5) to withhold documents that were compiled in anticipation of litigation, even though it raised this provision for the first time before the district court. Because the Department's description of the withheld documents demonstrates that each falls within the scope of subsection (d)(5), we affirm the judgment of the district court as to Louis' Privacy Act claims.

From 1986 to 1988, Dr. Jeffrey Louis was employed as a podiatric surgeon with the Department of Veterans Affairs. He claims to have become disabled as a result of his employment, and thus filed for disability workers' compensation in 1993. For reasons not completely explained in the record and beyond the scope of the current appeal, that claim is still pending before the Office of Workers' Compensation Programs ("OWCP") within the Department of Labor.2

After a series of agency decisions and appeals, one of which was to this court,3 Louis made a series of Privacy Act requests to the Department of Labor between August 7, 2002, and October 27, 2002. The Department eventually denied access to the records in a letter decision, stating that all of the requested records were exempt from disclosure under the Privacy Act, indirectly relying on 5 U.S.C. § 552a(k)(2) as grounds for exemption of the system of records in which the documents were located. The agency then released some documents under FOIA, but continued to assert that a subset of the documents were exempt from disclosure under Exemption 5 of FOIA, which covers privileged and attorney work-product materials. The parties agree that this letter constitutes the agency's original partial denial of Louis' requests.

Louis appealed this initial decision to the Solicitor of Labor. The reviewing officer again determined that all of the information sought by Louis was contained in the "DOL/SOL-15" system of records, a system which had been designated as an "exempt system" under 5 U.S.C. § 552a(k)(2). Specifically, the reviewing officer explained that the system of records had been properly exempted from disclosure by the agency, citing to the Federal Register, in which the Department purportedly gave notice of the exemption. See Notices, 67 Fed.Reg. 16816, 16941 (April 8, 2002). The officer further explained that because the records sought by Louis were located in "SOL files maintained for the purposes of defending the Department of Labor in law suits and claims filed against it," they "were prepared for a law enforcement purpose," and were therefore exempt from disclosure. The reviewing officer went on to determine that some additional documents should be disclosed under FOIA, but still withheld certain groups of documents under Exemptions 2 (internal procedures) and 5 (privilege and work product) of FOIA. 5 U.S.C. §§ 552(b)(2) & (b)(5).

Louis then filed a complaint in district court challenging the agency's reliance on the (k)(2) exemption of the Privacy Act and Exemptions 2 and 5 of FOIA. When the plaintiff began serving discovery requests on the Department, the Department moved for a protective order. Louis moved to compel the requested discovery, seeking to obtain discovery related to the designation of the DOL/SOL-15 database as an "exempt system" and the Department's methodology in searching for responsive documents. During the pendency of these motions, the Department filed its motion for summary judgment, arguing that the DOL/SOL-15 database had been properly exempted from disclosure under the Privacy Act by promulgation of an agency rule. In the alternative, the Department argued for the first time that the requested information was properly withheld pursuant to § 552a(d)(5). In his cross-motion for summary judgment, Louis submitted a list specifically identifying fifteen documents sought under the Privacy Act. The district court granted the Department's motion for a protective order, thereby prohibiting any discovery, and directed the parties to proceed with briefing the cross-motions for summary judgment.

Louis filed a motion for a continuance under Federal Rule of Civil Procedure 56(f), seeking much of the same discovery he had moved for in his motion to compel. The district court denied the Rule 56(f) motion and granted the Department's motion for summary judgment. The court held both that the system of records in which the requested information was located had been properly exempted from disclosure under the Privacy Act by administrative rule, and that disclosure of the records was barred under subsection (d)(5) of the Privacy Act.4 The court specifically found that the "rule" promulgated by the Department was valid.

Because Louis brought this suit under the Privacy Act and the Freedom of Information Act, 5 U.S.C. §§ 552a and 552, respectively, jurisdiction was proper in the district court pursuant to 28 U.S.C. § 1331. We have jurisdiction under 28 U.S.C. § 1291 over this direct appeal of a final judgment of the district court. Our review of the district court's grant of summary judgment under the Privacy Act is de novo. Rose v. United States, 905 F.2d 1257, 1259 (9th Cir.1990); see also 5 U.S.C. § 552a(g). We also review de novo determinations regarding the scope of the notice-and-comment and publication requirements of the APA. Natural Res. Def. Council, Inc. v. Evans, 316 F.3d 904, 910 (9th Cir.2003).

The Privacy Act of 1974 requires each agency that maintains a "system of records" to provide access to an individual's "record or to any information pertaining to him" by that individual. 5 U.S.C. § 552a(d)(1). However, the Act specifically provides that "nothing in this section shall allow an individual access to any information compiled in reasonable anticipation of a civil action or proceeding." Id. § 552a(d)(5). In addition, the Act provides a mechanism by which an agency may promulgate rules in accordance with the APA in order "to exempt [certain] system[s] of records within the agency" from disclosure. Id. § 552a(k). Relevant to the present appeal, agencies may under most circumstances exempt systems that consist of "investigatory material compiled for law enforcement purposes." Id. § 552a(k)(2).

Louis argues that the Department's "rule" exempting the DOL/SOL-15 system of records did not follow the APA's procedures and is therefore invalid, and that the DOL cannot rely on § 552a(d)(5) because the final agency determination did not rely on this section. We address each of these arguments in turn.

A. Exemption by Rule pursuant to § 552a(k)(2)

Louis argues that the agency never properly invoked subsection (k)(2) because it did not appropriately give notice of a proposed rulemaking in accordance with the requirements of the APA, 5 U.S.C. § 553, as incorporated at 5 U.S.C. § 552(a)(k). Specifically, Louis argues that the Department did not properly publish a notice of proposed rulemaking in accordance with 5 U.S.C. § 553(b), and did not properly solicit public comment in accordance with 5 U.S.C. § 553(c).

Section (b) of the APA requires a notice of proposed rulemaking to include:

(1) a statement of the time, place, and nature of public rulemaking proceedings;

(2) reference to the legal authority under which the rule is proposed; and

(3) either the terms or the substance of the proposed rule or a description of the subjects and issues involved.

5 U.S.C. § 553(b). In turn, Section (c) requires in pertinent part:

After notice required by this section, the agency shall give interested persons an opportunity to participate in the rule making through submission of written data, views, or arguments with or without opportunity for oral presentation. After consideration of the relevant matter presented, the agency shall incorporate in the rules adopted a concise general statement of their basis and purpose.

5 U.S.C. § 553(c).

Subsection (e)(4) of the Privacy Act requires each agency that maintains a system of records to publish information pertaining to each system, including: the system's name, the categories of individuals covered by the system, the categories of records contained within the system, routine uses for the records, and policies and practices regarding storage, retrieval and access to records. Id. § 552a(e)(4)(A)-(I). Sub-section (e)(4) does not require or suggest that the agency include in its notice whether a particular system of records is exempt from disclosure.

In April of 2002, the Department published an updated notice of all systems of records entitled "Publication in Full of All Notices of Systems of Records Including Several New Systems; Publication of Proposed Routine Uses." 67 Fed.Reg. at 16816. That notice, which unequivocally states that it was published in accordance with subsection (e)(4) of the Privacy Act, contained the required information for scores of systems of records maintained by the Department. Id. at 16816-16948. Yet nowhere in its introductory section does the notice mention that the agency is proposing to exempt certain systems from disclosure. Id. at 16816. Instead, in the description of certain individual systems, the Department included a statement that the system was exempt from disclosure under the Privacy Act, citing the statutory provision relied upon and giving a justification for the exemption. For example, with respect to the DOL/SOL-15 database at issue in the present appeal, the agency stated:

SYSTEM EXEMPTED FROM CERTAIN PROVISION OF THE ACT:

Under the specific exemption authority provided by 5 U.S.C. 552a(k)(2), this system is exempt from the following provisions of the Privacy Act: 5 U.S.C. § 552a . . . (d). . . . Disclosure of information could enable the subject of the record to take action to escape prosecution and could avail the subject greater access to information than that already provided under rules of discovery. In addition, disclosure of information might lead to intimidation of witnesses, informants, or their families, and impair future investigations by making it more difficult to collect similar information.

67 Fed.Reg. at 16942.

In general, the notice and comment provisions of the APA require an agency to publish a notice of "proposed" rulemaking, then allow for comment before publishing a "final" rule that includes a discussion of the comments received. See Nat'l Tour Brokers v. United States, 591 F.2d 896, 901-902 (D.C.Cir.1978) (rejecting procedure of publishing final rule with opportunity for reconsideration). "Th[e] requirement is designed to give interested persons, through written submissions and oral presentations, an opportunity to participate in the rulemaking process." Erringer v. Thompson, 371 F.3d 625, 629 (9th Cir.2004) (quoting Chief Prob. Officers of Cal. v. Shalala, 118 F.3d 1327, 1329 (9th Cir.1997)). The test for sufficiency of the notice is whether the notice "fairly apprise[s] interested persons of the subjects and issues before the Agency." Natural Res. Def. Council v. EPA, 279 F.3d 1180, 1186 (9th Cir.2002) (quoting Natural Res. Def. Council v. EPA, 863 F.2d 1420, 1429 (9th Cir.1988)). "[A]n interested member of the public should be able to read the published notice of an application and understand the `essential attributes' of that application. . . . [and] should not have to guess the [agency's] `true intent.'" State of California ex rel. Lockyer v. FERC, 329 F.3d 700, 706-07 (9th Cir.2003) (noting connection between Due Process Clause and notice provisions).

With these basic principles in mind, we conclude that the notice in this case was insufficient. While it is true that each of the components of section 553(b) are technically present in the Federal Register notice published by the Department, the presentation of the information obscures the intent of the agency and allows for broad exemption of records systems through the back door. Rather than a "notice of proposed rule," the Department's notice was simply entitled "Notices," with a subtitle reading, "Privacy Act of 1974; Publication in Full of All Notices of Systems of Records Including Several New Systems; Publication of Proposed Routine Uses." See 67 Fed.Reg. at 16816. Everything about the title and introductory paragraphs of the notice indicates that the Department is simply complying with subsection (e)(4) of the Privacy Act.5 Id. Nothing in those sections indicates that the agency proposes to exempt systems from access. This omission allows potentially controversial subject matter — exemption of entire systems of records from public disclosure laws — to go unnoticed buried deep in a non-controversial publication generally describing existing systems and their contents. We cannot say that an "interested member of the public [would] be able to read the published notice" and "understand[its] `essential attributes.'" See State of California ex rel. Lockyer, 329 F.3d at 707. Indeed, a member of the public would likely read the first few pages of this document and conclude that this was a simple disclosure made by the Department pursuant to (e)(4), not a proposed rule exempting certain records systems from disclosure.

While we have yet to address the sufficiency of a notice of proposed rulemaking in a factual context substantially similar to that presented in the present case, we note that cases from at least two other circuits are instructive to our analysis and support our view. In McLouth Steel Products Corp. v. Thomas, 838 F.2d 1317 (D.C.Cir.1988), the D.C. Circuit stressed the importance of a notice's heading and summary in "alert[ing] a reader to the stakes." Id. at 1322-23. In that case, the court held that the EPA's failure to mention its use of a particular diagnostic model to evaluate potentially hazardous wastes in the summary of the proposed rule rendered its notice inadequate as to its use of that model. Id.; see also AFL-CIO v. Donovan, 757 F.2d 330, 339 (D.C.Cir.1985) (holding rule invalid where no notice given of an important change between proposed and final rule; some changes to rule were highlighted in the notice of proposed rulemaking, giving impression that only highlighted portions had been selected for change).

Similarly, in American Iron and Steel Institute v. EPA, 568 F.2d 284 (3d Cir.1977), the Third Circuit declared a rule invalid where the notice of proposed rulemaking failed to indicate that the proposed rule would apply to steelmaking, as opposed to other processes involved in iron and steel manufacturing. Id. at 291. The court specifically determined that such a defect in the notice of proposed rulemaking rendered it ineffective at enabling an "interested person . . . to make comments which could assist the [agency] in formulating [the] regulations." Id.

Again, in the present case the Department's notice only indicates that it is publishing information about hundreds of pre-existing systems of records, with a few additions and deletions. The introductory sections of the notice speak of compliance with subsection (e)(4) of the Privacy Act, and indicate that there have been changes to the universe of systems, but do not refer to subsection (k)(2) and do not mention "exemptions" at all. Under these circumstances, we conclude that the Department's notice was insufficient in that it does not "fairly apprise interested persons of the subjects and issues before the Agency." See Natural Res. Def. Council, 279 F.3d at 1186.

Louis next argues that the Department failed to comply with the requirements of § 553(c) of the APA because the notice failed to give a meaningful opportunity to comment on the exemption of records systems. 5 U.S.C. § 553(c). This argument flows directly from the improper notice given by the agency. Although the notice invited comment "on newly published systems and on the proposed routine uses, both universal and specific," 67 Fed.Reg. at 16816, there was no specific invitation to comment on the exemption of systems from disclosure. The Department thus never afforded itself the opportunity "to educate itself on the full range of interests the rule affects" with respect to the exempted systems. See Alcaraz v. Block, 746 F.2d 593, 611 (9th Cir.1984); see also Pac. Coast European Conference v. United States, 350 F.2d 197, 205 (9th Cir.1965). In short, the Department did not comply with the comment provision of the APA.

In summary, subsection (k)(2) of the Privacy Act by its text requires that a rule be promulgated in accordance with the notice and comment provisions of the APA. We hold that mere notice of an agency's invocation of subsection (k)(2) to exempt information from the Act's disclosure requirements, when published under headings indicating that the purpose of the publication is compliance with a routine reporting requirement of the statute, is insufficient to constitute the kind of notice of proposed rulemaking and invitation to comment required by the APA. Exemption from the Privacy Act's fundamental requirement that an individual have access to an individual's "record or to any information pertaining to him" collected by the government is a serious matter requiring the strictest compliance with the APA's rulemaking procedures. The Department may not withhold documents contained in the DOL/SOL-15 system of records on the basis of the (k)(2) exemption.

B. Bar to Access pursuant to 5 U.S.C. § 552a(d)(5)

Although the Department's "rule" exempting the DOL/SOL-15 system of records is invalid, the requested documents may be withheld if they fall within the scope of subsection (d)(5) of the Privacy Act, even though the Department relied on this subsection for the first time during the district court proceedings. Louis argues that the district court's alternative holding that subsection (d)(5) barred access to certain documents was improper because the agency never relied on this exception when it issued its final disclosure determination. Specifically, Louis asserts that the Department's belated reliance on subsection (d)(5) is a post-hoc rationalization prohibited by SEC v. Chenery Corp., 318 U.S. 80, 63 S. Ct. 454, 87 L. Ed. 626 (1943) ("Chenery I") and its progeny.

This argument fails for two reasons. First, review of agency access decisions under FOIA and the Privacy Act is de novo, requiring no deference to the agency's determination or rationale regarding disclosures. Second, the text and structure of the statute lead us to conclude that because Louis never had a right to access individual records prepared in anticipation of litigation, he cannot now claim access to them on a theory that the agency passively waived this exception.

Subsection 552a(g)(3)(A) of the Privacy Act provides that where a suit is brought under subsection (g)(1)(B) for failure to comply with a records request (as is the present case), "the court shall determine the matter de novo . . . and the burden is on the agency to sustain its action." 5 U.S.C. § 552a(g)(3)(A). The Supreme Court has recently noted that this provision means that no deference is due the agency's determination of which records to disclose and which are exempt. Doe v. Chao, 540 U.S. 614, 618-19, 124 S. Ct. 1204, 157 L. Ed. 2d 1122 (2004) (distinguishing de novo review from "any form of deferential review").

The rationale behind the Chenery I Court's refusal to accept belated justifications for agency action not previously asserted during the agency's own proceedings does not apply in this case. Chenery I was premised on the policy that courts should not substitute their judgment for that of the agency when reviewing a "determination of policy or judgment which the agency alone is authorized to make and which it has not made." 318 U.S. at 88, 63 S. Ct. 454. "[A]n appellate court cannot intrude upon the domain which Congress has exclusively entrusted to an administrative agency." Id. In the present case, review of documents for disclosure under the Privacy Act is not an action that is within the particular expertise of any agency, and Congress has expressly instructed courts to review such actions de novo. 5 U.S.C. § 552a(g)(3)(A). As such, judicial review is not limited to the justification for withholding of documents originally relied upon by the agency. Cf. SEC v. Chenery Corp., 332 U.S. 194, 196-97, 67 S. Ct. 1575, 91 L. Ed. 1995 (1947) ("Chenery II") ("[A] reviewing court, in dealing with a determination or judgment which an administrative agency alone is authorized to make, must judge the propriety of such action solely by the grounds invoked by the agency.").

Our opinion in Friends of the Coast Fork v. United States Department of the Interior, 110 F.3d 53, 55 (9th Cir.1997), is distinguishable in that it discussed post-hoc rationalization under FOIA's fee waiver provision, which specifically provides that although review of agency determinations on such waivers is de novo, "the court's review of the matter shall be limited to the record before the agency." 5 U.S.C. § 552(a)(4)(A)(vii). The judicial review provision relevant to this case contains no such limiting language. See 5 U.S.C. § 552a(g)(3)(A).6

We note that in the FOIA context,7 at least one other circuit has concluded that an agency does not waive exemptions prior to litigation in the district court.8 Young v. CIA, 972 F.2d 536, 538-39 (4th Cir.1992) ("[A]n agency does not waive FOIA exemptions by not raising them during the administrative process. . . . [W]aiver is inappropriate because [inter alia] FOIA provides for de novo judicial review."); see also Ryan v. Dep't. of Justice, 617 F.2d 781, 792 (D.C.Cir.1980) ("This court has held that an agency must identify the specific statutory exemptions relied upon, and do so at least by the time of the district court proceedings." (emphasis added) (citing Jordan v. United States Dep't of Justice, 591 F.2d 753, 779-80 (D.C.Cir.1978), overruled on other grounds by Crooker v. Bureau of Alcohol, Tobacco & Firearms, 670 F.2d 1051 (D.C.Cir.1981))).

The text and structure of the statute also suggest that passive waiver of the (d)(5) exception is inappropriate, at least until the parties reach the district court. While subsection (d)(1) requires that agencies "upon request by any individual to gain access to his record or to any information pertaining to him . . . permit him . . . to review the record and have a copy made," subsection (d)(5) states that "nothing in this section shall allow an individual access to any information compiled in reasonable anticipation of a civil action or proceeding." Unlike the section (k) exemptions, which require an agency to exempt a system from access through rulemaking, subsection (d)(5) is a self-executing exception to the general access granted to individuals in subsection (d)(1). Put another way, the right to access granted by subsection (d)(1) is expressly qualified by subsection (d)(5). Because an individual has no right to even demand such information, there would be no need for the agency to actively assert (d)(5) as an applicable exception to disclosure. Louis never had a right to access records prepared in reasonable anticipation of litigation. Thus, he cannot now claim a right to access simply because the Department did not specifically rely on that specific exemption when it made its initial determination.

For the above-stated reasons, it was entirely proper for the district court to consider the Department's argument that the documents sought were barred from disclosure by subsection (d)(5). Turning now to the merits, we conclude that the descriptions of the documents sufficiently indicate that each is a communication or writing specifically related to the ongoing agency proceeding and eventual litigation with Louis. Each document therefore falls within the scope of (d)(5)'s intended protection against disclosure of any "information" compiled in anticipation of a civil action or proceeding.9

In sum, we conclude that the Department failed to comply with the notice and comment provisions of the Administrative Procedure Act in its attempt to exempt the DOL/SOL-15 system of records from access under Privacy Act subsection (k)(2). However, we also conclude that the district court's reliance on the Privacy Act's litigation exception to access as prescribed by subsection (d)(5) of the Act was proper. Because review of information for disclosure is not a task that has been entrusted to the Department of Labor, and because the statute specifically provides for de novo review by the courts, we refuse to apply the general bar against post-hoc rationalization by an agency originally set forth in Chenery I. On the merits, we find the descriptions of the documents sought sufficient to conclude that each falls within the (d)(5) exception.10

AFFIRMED IN PART.