United States Court of Appeals, Sixth Circuit.
*544 ARGUED: Steve Frank, United States Department of Justice, Washington, D.C., for Appellants. Douglas L. McSwain, Sturgill, Turner, Barker & Moloney, PLLC, Lexington, Kentucky, for Appellees. ON BRIEF: Steve Frank, United States Department of Justice, Washington, D.C., for Appellants. Douglas L. McSwain, Andrew DeSimone, Sturgill, Turner, Barker & Moloney, PLLC, Lexington, Kentucky, for Appellees.
Before: KENNEDY, MOORE, and WHITE, Circuit Judges.
MOORE, J., delivered the opinion of the court, in which WHITE, J., joined. KENNEDY, J. (pp. 560-64), delivered a separate dissenting opinion.
KAREN NELSON MOORE, Circuit Judge.
In this Privacy Act and Federal Tort Claims Act case, the Defendants-Appellants/Cross-Appellees appeal the district court's judgment, after a twenty-three-day bench trial, in favor of the Plaintiffs-Appellees/Cross-Appellants on the Privacy Act claims. The Plaintiffs cross-appeal the district court's judgment in favor of the Defendants on the Federal Tort Claims Act claim, as well as a variety of subsidiary issues. The Plaintiffs, a group of staff members at the Federal Bureau of Prisons ("BOP") Lexington, Kentucky, Federal Medical Center ("FMC") facility, alleged that the Defendants allowed an employee roster containing the Plaintiffs' sensitive personal information to be disclosed to improper persons, namely prison inmates and other BOP staff. The Defendants include the United States Department of Justice, the BOP, the Attorney General, the head of the BOP, various FMC officials, and the United States of America. The district court found that the responsible employee's actions resulted in a disclosure actionable under 5 U.S.C. § 552a(b) & (g)(1)(D) of the Privacy Act, and that the actions were "intentional or willful" within the meaning of 5 U.S.C. § 552a(g)(4) such that the Plaintiffs were entitled to damages, even though the employee's final act of leaving the folder unsecured was "inadvertent." For the following reasons, we AFFIRM in part and REVERSE in part, and we REMAND for proceedings consistent with this opinion.
During an internal investigation of unauthorized inmate computer usage at the FMC's UNICOR work facility ("UNICOR"),[2] Special Investigative Agent Walter Clint Jones ("SIA Jones") left behind a green file folder on a civilian employee's desk that included a roster of all FMC Lexington employees' names, addresses, *545 Social Security numbers, home telephone numbers, pay grades, and other personal information (the "folder"). Contrary to BOP Program Statements, the folder was not marked with "LOU-Sensitive"[3] or other required markings to indicate its contents. SIA Jones left the folder on the desk in the Project Management area of UNICOR around 3:00 a.m. on Thursday, March 30, 2001. Staff began to admit inmates into this part of UNICOR beginning around 7:30 a.m., and inmate Charles Kinnard arrived sometime between 9:50 a.m. and 10:00 a.m. Susan Moore, on whose desk the folder lay, did not arrive until sometime after 9:50 a.m.; when she arrived she immediately discovered the folder and turned it over to her acting supervisor, Mark Barnes, and their acting manager, James Jones. At trial, three inmates testified that they saw inmate Charles Kinnard next to Moore's desk prior to her arrival, and two inmates, Mark Geralds and Terrell Harris, saw Kinnard looking at something on Moore's desk for at least two minutes. No civilian staff members noticed this behavior. Although inmates are never present without staff supervision, the Project Management employees do allow inmates with whom they work to approach the staff members' desks and to deposit and remove work papers.
James Jones, after meeting with Moore and Barnes, reported the incident to Associate Warden Ann Mary Carter. Carter then met with Moore and Barnes, told them the folder had been properly secured, asked them to submit memoranda explaining the incident, and instructed them not to discuss the incident with anyone. Because the folder was found on a civilian staff member's desk, Carter believed that no disclosure had occurred, and neither she nor anyone else ordered an investigation, lockdown, or shakedown. The inmates were subjected to the normal pat-down searches prior to their leaving Project Management at the lunch break and at the end of the workday. Warden Maryellen Thoms later decided to treat SIA Jones's act as a performance violation, and, thus, the incident was not reported to the BOP Office of Internal Affairs ("OIA").[4]
Soon after March 30, Moore contacted the Union Steward, but Thoms declined to discuss the incident with anyone other than the Union President, with whom she met in mid-April. On April 19, 2001, the Union filed an official grievance alleging that FMC management violated the Freedom of Information Act and the Privacy Act, and requesting that staff be advised of the incident and potential personal-security implications. Scott Murchie, FMC Lexington Human Resources Manager, responded and suggested that no action should be taken before evidence of disclosure was available. The BOP Regional Director denied the grievance on May 4, 2001, citing the absence of "specific proof that staff had their privacy compromised" as the reason not to notify staff. Beaven, 2007 WL 1032301, at *6. Thoms later denied two staff members' requests for information under the Privacy Act related to any disclosure of their personal information based on lack of proof of disclosure under the Privacy Act. The Union referred the incident to the OIA on May 9, 2001, and then invoked arbitration on May 29, 2001. The Union requested an accounting of disclosures, but Thoms denied the request for lack of evidence that a disclosure occurred.
*546 On September 17, 2001, Thoms issued the first memorandum to staff related to the incident, but the memorandum included several factual inaccuraciesincluding assertions that the folder was properly marked "LOU-Sensitive" and that it was discovered at 9:00 a.m. after being left unattended since only 7:30 a.m.and the memorandum failed to state the incident date, the information in the folder, and whom it affected. The memorandum closed by assuring staff of Thoms's "commitment to investigate [disclosure] allegations." Id. at *8. The memorandum also offered assistance from BOP attorneys in filing administrative tort claims if any allegations "prove founded" because "we have yet to receive any documentation that inmates accessed the file in question." Id. After arbitration on October 30, 2001, Thoms issued a second staff memorandum on December 17, 2001, but failed to correct inaccuracies or omissions other than the incident date and information included in the folder. The December 17 memorandum again stressed Thoms's "commitment to investigate allegations" of disclosure and provide assistance if "such allegations prove founded." R. on Appeal ("ROA") Vol. 1 (J.A.) at 707 (Pls.' Exhibit 56). Sometime after the arbitration, but before the second memorandum, Thoms instructed Murchie to destroy the folder when he was moving to D.C. (Murchie had received the folder from SIA Jones in case it was necessary for arbitration).
On March 1, 2002, the Plaintiffs' counsel filed administrative tort claims for seventy-eight staff members, but the BOP denied the claims on August 26, 2002, based on the claimants' failure to produce evidence of actual disclosure to inmates. On February 19, 2003, the Plaintiffs filed the instant suit asserting nine separate counts on behalf of 106 staff members (adding six more staff and four additional counts in the January 8, 2004, amended complaint). Counts One through Eight alleged violations of the Privacy Act, Count Nine alleged a violation of the Social Security Act, and Counts Ten through Thirteen alleged claims under the Federal Tort Claims Act. On cross-motions for summary judgment, the district court on February 9, 2005, denied the Plaintiffs' motion and granted the Defendants' motion on all counts except the outrageous-conduct claim in Count Eleven, but on September 29, 2005, the district court reinstated the claims of Privacy Act disclosure and common law invasion of privacy, Counts One and Ten. The district court also granted the Plaintiffs' motion to sanction the Defendants for destroying the folder, and the court excluded testimony about the Defendants' inspection of the folder. A twenty-three day bench trial started on February 27, 2006. On March 30, 2007, the district court imposed the Plaintiffs' requested adverse evidentiary inference for spoliation, found that the Defendants had violated the Privacy Act, and denied all other claims. On December 19, 2007, the district court denied the Plaintiffs' motion for discovery sanctions related to misstatements about the folder's labeling and destruction and entered judgment against the Defendants, awarding damages of $1,000 each to all of the plaintiffs except two who had proved greater actual damages.
The Defendants raise three issues on appeal: (1) Whether the district court erred as a matter of law in holding that the alleged disclosure of the folder was "intentional and willful" while also finding that the responsible employee's act of leaving it in an unsecured location was "inadvertent"; (2) Whether the district court abused its discretion in adopting, as an evidentiary sanction for spoliation, a non-rebuttable inference that "disclosure" occurred; and (3) Whether the district court abused its discretion in its alternative ruling that the Plaintiffs proved "disclosure" *547 by a preponderance of the evidence. On cross-appeal, the Plaintiffs raise only one issue that we must resolve, contending that the district court erred in limiting "actual damages" recoverable under the Privacy Act to preclude their claims for lost time and future expenses. Because the Plaintiffs raise the three remaining cross-appeal issues only as alternative grounds for relief, should this court overturn the district court's Privacy Act decisions, we need not reach these issues.[5]
We will address each pertinent issue in turn, mindful that "[o]n an appeal from a judgment entered after a bench trial, we review the district court's findings of fact for clear error and its conclusions of law de novo." Lindstrom v. A-C Prod. Liab. Trust, 424 F.3d 488, 492 (6th Cir. 2005). We "afford great deference to the district court's factual findings" if the findings "involve credibility determinations." Id.
The district court found that SIA Jones's course of conduct resulted in a disclosure under the Privacy Act, specifically 5 U.S.C. § 552a(b) & (g)(1)(D), and that his actions were "intentional or willful" within the meaning of § 552a(g)(4), although his final act of leaving the folder unsecured was "inadvertent." Before deciding whether the district court erred in finding that SIA Jones's actions satisfied the "intentional or willful" standard of conduct, we must determine whether the district court erred in looking to the entire course of conduct for its determination of whether "the agency acted in a manner which was intentional or willful," rather than looking to SIA Jones's final act of inadvertently leaving the folder on the desk.
Under § 552a(g)(1)(D), the Privacy Act provides a civil remedy to an individual for an agency's "fail[ure] to comply with any other provision of this section, or any rule promulgated thereunder, in such a way as to have an adverse effect on an individual." 5 U.S.C. § 552a(g)(1)(D). Thus, an individual may bring a civil action under § 552a(g)(1)(D) if he or she is adversely affected by an agency's failure to comply with § 552a(b)'s requirement that "[n]o agency shall disclose any record which is contained in a system of records by any means of communication to any person, or to another agency, except pursuant to a written request by, or with the prior written consent of, the individual to whom the record pertains." 5 U.S.C. § 552a(b). Under § 552a(g)(4), a Privacy Act plaintiff who can prove actual damages is entitled to recover the greater of actual damages or $1,000 "[i]n any suit brought under the provisions of subsection (g)(1)(C) or (D) of this section in which the court determines that the agency acted in a manner which was intentional or willful." 5 U.S.C. § 552a(g)(4).
The main issue before us is whether the requirement under § 552a(g)(4) that the district court find that "the agency acted in a manner which was intentional or willful" requires the court to find that the final act that resulted in the disclosure was "intentional or willful" or whether the court may find that the entire course of conduct that resulted in the disclosure was "intentional or willful." *548 No court has specifically interpreted § 552a(g)(4) in the light this panel must address; therefore we must engage de novo in the analysis of what a court may consider in determining whether "the agency acted in a manner which was intentional or willful." As recently stated, we
employ[] a three-step legislative-interpretation framework established by the Supreme Court: "`first, a natural reading of the full text; second, the common-law meaning of the statutory terms; and finally, consideration of the statutory and legislative history for guidance,'" Lockhart v. Napolitano, 573 F.3d 251, 255 (6th Cir.2009) (quoting United States ex rel. A+ Homecare, Inc. v. Medshares Mgmt. Group, Inc., 400 F.3d 428, 442 (6th Cir.2005) (citing United States v. Wells, 519 U.S. 482, 490-92 [117 S. Ct. 921, 137 L. Ed. 2d 107] (1997))). The "natural reading of the full text" requires that we examine the statute for its plain meaning, including "`the language and design of the statute as a whole.'" Id. (quoting [United States v.] Parrett, 530 F.3d [422,] 429 [(6th Cir. 2008)]). "If the statutory language is not clear, we may examine the relevant legislative history." Parrett, 530 F.3d at 429.
Elgharib v. Napolitano, 600 F.3d 597, 601 (6th Cir.2010). We begin with the recognition that the language of § 552a(g)(4) at issue is ambiguous. And although we have not found any cases in which the court stated explicitly which actions a district court may consider in determining whether "the agency acted in a manner which was intentional or willful," several Privacy Act cases are instructive.
In Doe v. Chao, the Supreme Court interpreted the interplay between § 552a(g)(1)(D) and § 552a(g)(4) to decide whether a plaintiff suing under § 552a(g)(1)(D) must prove "actual damages" under § 552a(g)(4) before he or she is entitled to the statutory minimum under § 552a(g)(4). Doe v. Chao, 540 U.S. 614, 124 S. Ct. 1204, 157 L. Ed. 2d 1122 (2004). Although the Court did not address the specific issue before this panel (because the government did not challenge the finding that the agency acted in an intentional or willful manner), the Court found that subsection (g)(1)(D) is intended to "deal with derelictions having consequences beyond the statutory violations per se" and "speaks of a violation when someone suffers an `adverse effect' from any other failure [not covered under subsections (g)(1)(A)-(C)] to hew to the terms of the Act." Id. at 619, 124 S. Ct. 1204. The Court's opinion can thus be read to endorse a broader interpretation of what actions a court may consider in determining whether "the agency acted in a manner which was intentional or willful." Indeed throughout the opinion the Court referred to subsection (g)(4) as covering damages for "an intentional or willful violation," see, e.g., id. at 620-22, 627, 124 S. Ct. 1204 (emphasis added), and Justice Ginsburg in dissent interpreted the language of (g)(4) relevant for our purposes to cover "an agency's intentional or willful commission of a Privacy Act violation of the kind described in § 552a(g)(1)(C) or (D)."[6]Id. *549 at 628, 124 S. Ct. 1204 (Ginsburg, J., dissenting) (emphasis added).
Even though many courts have interpreted what "intentional or willful" means under § 552a(g)(4),[7] none have set forth an interpretation of what a court may consider in determining whether "the agency acted in a manner" that meets this standard. Under our precedent, Privacy Act damages are recoverable only if the Plaintiffs prove that the Defendants acted "intentionally" or "willfully""a standard `somewhat greater than gross negligence' ""`either by committing the act without grounds for believing it to be lawful, or flagrantly disregarding others' rights under the [Privacy] Act.'" Mount v. U.S. Postal Serv., 79 F.3d 531, 533 (6th Cir.1996) (quoting White v. Office of Pers. Mgmt., 840 F.2d 85, 87 (D.C.Cir.1988); Wilborn v. Dep't of Health & Human Servs., 49 F.3d 597, 602 (9th Cir.1995)). We have noted that the Privacy Act is an attempt "`to strike a balance between the government's need to collect and maintain information and the privacy interests of the persons to whom such information pertains.'" Cardamone v. Cohen, 241 F.3d 520, 524 (6th Cir.2001) (quoting Hudson, 130 F.3d at 1204).
From our review of the cases in this area, we conclude that courts determining whether a Privacy Act violation occurred have not differentiated between the final act and the course of action that results in the final act, but rather courts generally look to the entire course of conduct in context. In an early case interpreting § 552a(g)(4) in a suit under § 552a(g)(1)(D) for a disclosure violation, the Tenth Circuit looked to the entire course of conduct engaged in by IRS agents to find that the plaintiffs would be able to allege "intentional or willful" agency actions on remand. Parks v. Internal Revenue Serv., 618 F.2d 677, 683 (10th Cir.1980) (considering allegations that the agency published lists containing the plaintiffs' personal information, furnished the lists to IRS employees, and condoned the use of the information in the lists to contact the plaintiffs for solicitations). Other circuit courts since have applied this reasoning, and the D.C. Circuit has explicitly stated that "[t]he agency's actions must be viewed in their context to determine whether the agency's staff acted in a willful *550 or intentional manner." Waters v. Thornburgh, 888 F.2d 870, 876 (D.C.Cir. 1989) (citing Albright v. United States, 732 F.2d 181, 189 (D.C.Cir.1984)), abrogated on other grounds by Doe, 540 U.S. 614, 124 S. Ct. 1204; id. at 876-77 (looking to, among other things, "the events that led up to sending the letter" in finding genuine issue of material fact regarding intent); Albright, 732 F.2d at 189-90 (considering agency's actions prior to and after decision to videotape meeting, including subsequent offer to destroy videotape at issue, in finding actions not intentional or willful); see also Dong v. Smithsonian Inst., 943 F. Supp. 69, 73 (D.D.C.1996) (applying Waters and looking at agency's notice of its obligations under the Act and lack of effort to abide by Act prior to violation to find intentional or willful action because reckless disregard for rights); Romero-Vargas v. Shalala, 907 F. Supp. 1128, 1131, 1133-34 (N.D.Ohio 1995) (finding intentional or willful disclosure based on flagrant disregard where no effort made to comply with Act and each step that agency employee took was in violation of internal guidelines and led to Act violation).
Without the aid of prior interpretations directly on point for what a court may consider in determining whether "the agency acted in a manner which was intentional or willful" and faced with admittedly ambiguous language, we will look to Congress's intent regarding § 552a(g)(4) as shown in the legislative history. As the preface to the public law stated, "The purpose of this Act is to provide certain safeguards for an individual against an invasion of personal privacy by requiring federal agencies, except as otherwise provided by law, to . . . be subject to civil suit for any damages which occur as a result of willful or intentional action which violates any individual's rights under this Act." Privacy Act of 1974, Pub.L. No. 93-579, § 2(b)(6), 88 Stat. 1896 (codified as amended at 5 U.S.C. § 552a). The Senate Report accompanying the original Senate version of the Act states that one of the purposes of the Act is "to prevent the kind of illegal, unwise, overbroad, investigation and record surveillance of law-abiding citizens produced in recent years from actions of some over-zealous investigators, and the curiosity of some government administrators, or the wrongful disclosure and use, in some cases, of personal files held by Federal agencies." S.REP. NO. 93-1183, at 1 (1974), reprinted in JOINT COMM. ON GOV'T OPERATIONS, LEGISLATIVE HISTORY OF THE PRIVACY ACT OF 1974, S. 3418 (PUBLIC LAW 93-579): SOURCE BOOK ON PRIVACY 154 (1976) (hereinafter SOURCE BOOK). The Privacy Act was passed in the relatively short period between the Thanksgiving recess and the end of the 93rd congressional session and "reflects the merger of seemingly disparate bills from the Senate and the House." ABA SECTION OF ADMIN. LAW & REGULATORY PRACTICE, FEDERAL ADMINISTRATIVE PROCEDURE SOURCEBOOK 1083 (William F. Funk et al. eds., 4th ed. 2008). This short time-frame led the two houses of Congress to forgo the usual conference committee and, instead, to reach an agreement to pass identical bills through informal meetings between the respective staffs of the two houses' committees, with the amendments to each version included in their respective records. Id. A staff memorandum entitled "Analysis of House and Senate Compromise Amendments to the Federal Privacy Act" is "[t]he only record of the final negotiations leading to the bill actually adopted." ABA SECTION OF ADMIN. LAW & REGULATORY PRACTICE, supra, at 1083; 120 Cong. Rec. 40,405-08, 40,881-83 (1974), reprinted in SOURCE BOOK, supra, at 858, 985. The analysis explains the compromise reached for including the "intentional or willful" standard of conduct rather than a greater standard of "willful, arbitrary, or capricious" action or a lesser *551 standard of "negligent" action (or no standard at all, as some members of Congress had advocated),[8] but does not address what actions a court could examine in making its finding. 120 Cong. Rec. 40,406-07; SOURCE BOOK, supra, at 861-62 (explaining that "[o]n a continuum between negligence and the very high standard of willful, arbitrary, or capricious conduct, this standard is viewed as only somewhat greater than gross negligence"). Not once did the Congress address the scope of a court's analysis under § 552a(g)(4).
Consistent with the language of the Act, other courts' interpretations, and the legislative history, we conclude that a court may consider the entire course of conduct that resulted in the disclosure in making its required finding under § 552a(g)(4). Such an interpretation will allow recovery under circumstances similar to those here, where an agency's actions, although inadvertent at the last step, were in flagrant disregard of the plaintiff's rights under the Privacy Act at other steps along the way and afterward, but would deny recovery where an agency's actions were conscientious of Privacy Act rights throughout and contravened the Act inadvertently only at the last stepas where an employee with full rights to access personal information took every precaution to safeguard that information, but had it stolen and disclosed through no fault of his or her own while working away from the office.[9] Only a context-based analysis will allow a court to distinguish between such situations and fulfill the Privacy Act's intended purpose"`to strike a balance between the government's need to collect and maintain information and the privacy interests of the persons to whom such information pertains.'" Cardamone, 241 F.3d at 524 (quoting Hudson, 130 F.3d at 1204); see Pilon v. U.S. Dep't of Justice, 73 F.3d 1111, 1118 (D.C.Cir.1996) ("Recognizing the [Privacy] Act's varied ambiguities, we *552 have consistently turned back `neat legal maneuver[s],' attempted by the government that, while literally consistent with the Act's terms, were not in keeping with the privacy-protection responsibilities that Congress intended to assign to agencies under the Act." (quoting Benavides v. U.S. Bureau of Prisons, 995 F.2d 269, 272 (D.C.Cir.1993))); see also United Savings Ass'n v. Timbers of Inwood Forest Assocs., 484 U.S. 365, 371, 108 S. Ct. 626, 98 L. Ed. 2d 740 (1988) ("Statutory construction.. . is a holistic endeavor. A provision that may seem ambiguous in isolation is often clarified by the remainder of the statutory scheme. . . because only one of the permissible meanings produces a substantive effect that is compatible with the rest of the law. . . ." (citations omitted)); Kostyu v. United States, 742 F. Supp. 413, 417 (E.D.Mich.1990) ("By requiring a showing that any violation of the Act be willful and [sic] intentional, it is clear that Congress intended to reserve civil liability only for those lapses which constituted an extraordinary departure from standards of reasonable conduct.").
With this framework in mind, we may now decide whether the district court erred in finding that SIA Jones's actions satisfied the "intentional or willful" standard of conduct. Here, the district court applied the correct legal standard, and its credibility-based findings of fact are supported by the record and not clearly erroneous. The Defendants are correct that the district court's finding that SIA Jones's final act of leaving the folder was "inadvertent" appears to be inconsistent with a finding that the agency's course of conduct was "intentional or willful." An action that is inadvertent likely is not intentional, but could still be sufficiently willful to violate the Act. Albright, 732 F.2d at 189. A review of the facts in the instant case supports the district court's conclusion.
Although neither party here could point to a case factually similar to the instant case, we conclude that the district court did not commit clear error in finding that SIA Jones's course of conduct was "willful." SIA Jones carried the folder, which he knew to contain confidential and sensitive information, into an inmate-accessible work area for the purpose of carrying out his own investigative work should he need to call a UNICOR computer administrator at home. Yet the roster not only listed the home telephone numbers of UNICOR computer administrators but also included detailed private and personal information related to all FMC employees. SIA Jones's asserted need for some of the information while inside the UNICOR facility did not provide a legitimate basis for him to have the entire contents of the folder with him at the time to mitigate his Privacy Act violation. Moreover, the roster was contained in a folder not properly marked LOU-Sensitive,[10] and this and other instances of SIA Jones's conduct violated several BOP Program Statements. See White v. Office of Pers. Mgmt., 840 F.2d 85, 87 (D.C.Cir.1988) ("A plain failure to comply with established [agency] policy might constitute `willful' or `intentional' conduct actionable under § 552a(g)(4)."). Thus the district court's finding that SIA Jones willfully violated the Privacy Act by flagrantly disregarding the FMC employees' rights under the Act was not clearly erroneousSIA Jones's course of conduct that resulted in his leaving the unmarked *553 folder in an inmate-accessible area did not just "inadvertently contravene one of the Act's strictures" and could properly be viewed as "the intentional or willful failure of the agency to abide by the Act." Albright, 732 F.2d at 189; cf. Wiley v. Dep't of Veterans Affairs, 176 F. Supp. 2d 747, 756-57 (E.D.Mich.2001) (finding agency's mere inattention to detail in disclosing entire file, seemingly without any effort to identify those items within scope of request, rose at most to level of gross negligence). Therefore, we affirm the district court's judgment that "the agency acted in a manner which was . . . willful" under § 552a(g)(4), triggering liability under the Act.
We review for abuse of discretion the district court's decision to impose sanctions for evidence spoliation. See Adkins v. Wolever, 554 F.3d 650, 652 (6th Cir. 2009) (en banc) (holding federal courts have broad discretion in such decisions). The district court imposed a non-rebuttable adverse inference of disclosure as an evidentiary sanction against the Defendants because the court found that the Defendants intentionally destroyed the folder. Beaven, 2007 WL 1032301, at *17 ("The court will therefore infer that the appearance of the file folder would have been unfavorable to the defendants, in that its inspection would have provided proof that disclosure to an inmate actually occurred."). The Defendants argue that the district court abused its discretion because they assert that the Plaintiffs failed to establish the culpable mental state and relevance of the folder as evidence required to impose an adverse inference, and that, even if such an adverse inference was warranted, it was legal error to impose such a severe sanction.
After the district court's decision, this court clarified that a federal court in this circuit should apply federal law in determining whether spoliation sanctions are appropriate. Adkins, 554 F.3d at 652. Because earlier precedents in this circuit applied state law on spoliation, we look to other circuits for guidance in this inquiry.
[A] a party seeking an adverse inference instruction based on the destruction of evidence must establish (1) that the party having control over the evidence had an obligation to preserve it at the time it was destroyed; (2) that the records were destroyed "with a culpable state of mind"; and (3) that the destroyed evidence was "relevant" to the party's claim or defense such that a reasonable trier of fact could find that it would support that claim or defense.
Residential Funding Corp. v. DeGeorge Fin. Corp., 306 F.3d 99, 107 (2d Cir.2002) (quoting Byrnie v. Town of Cromwell, Bd. of Educ., 243 F.3d 93, 107-12 (2d Cir. 2001)). Thus, an adverse inference for evidence spoliation is appropriate if the Defendants "`knew the evidence was relevant to some issue at trial and . . . [their culpable] conduct resulted in its loss or destruction.'" Hodge v. Wal-Mart Stores, Inc., 360 F.3d 446, 450 (4th Cir.2004) (quoting Vodusek v. Bayliner Marine Corp., 71 F.3d 148, 156 (4th Cir.1995)). This depends on the alleged spoliator's mental state regarding any obligation to preserve evidence and the subsequent destruction. An obligation to preserve may arise "when a party should have known that the evidence may be relevant to future litigation," Kronisch v. United States, 150 F.3d 112, 126 (2d Cir.1998), but, if there was "no notice of pending litigation, the destruction of evidence does not point to consciousness of a weak case" and intentional destruction, Joostberns v. United Parcel Servs., Inc., 166 F. App'x 783, 797 *554 (6th Cir.2006) (unpublished opinion) (applying federal law). "[T]he `culpable state of mind' factor is satisfied by a showing that the evidence was destroyed `knowingly, even if without intent to [breach a duty to preserve it], or negligently.'" Residential Funding Corp., 306 F.3d at 108 (quoting Byrnie, 243 F.3d at 109). When appropriate, "a proper spoliation sanction should serve both fairness and punitive functions," but its severity should correspond to the district court's finding after a "fact-intensive inquiry into a party's degree of fault" under the circumstances, including the recognition that a party's degree of fault may "`rang[e] from innocence through the degrees of negligence to intentionality.'" Adkins, 554 F.3d at 652-53 (quoting Welsh v. United States, 844 F.2d 1239, 1246, (6th Cir.1988), overruled on other grounds by Adkins, 554 F.3d 650). "Thus, a district court could impose many different kinds of sanctions for spoliated evidence, including dismissing a case, granting summary judgment, or instructing a jury that it may infer a fact based on lost or destroyed evidence." Id. at 653 (citing Vodusek, 71 F.3d at 156).
The district court here did not abuse its broad discretion in finding that an adverse inference was appropriate here as a spoliation sanction. As the Second Circuit has noted, the "veracity of [defendant's] stated reasons for destroying the [evidence] `is an issue of credibility.'" Kronisch, 150 F.3d at 127. Giving great deference to the district court's credibility determinations and findings of fact, we accept the district court's findings that the Defendants were sufficiently on notice of potential claims to have an obligation to preserve the evidence as a result of the Defendants' repeated statements that concerned persons could file tort claims, and that the later destruction prior to the issuance of the second memorandum was intentional. Cf. Silvestri v. Gen. Motors Corp., 271 F.3d 583, 591-92 (4th Cir.2001) (upholding dismissal as spoliation sanction for plaintiff who anticipated filing suit, knew evidence was relevant to potential claims, and preserved evidence for only three months, but did not file suit until three years later). Although in Joostberns, an unpublished opinion, we held that a completed union grievance proceeding does not suffice to prove an obligation to preserve based on notice of potential litigation arising from the same facts, especially if the allegedly spoliated evidence would have been available at the time of the grievance proceeding and was not destroyed until afterwards in the course of regular business practice, Joostberns, 166 Fed.Appx. at 796-97, the facts of the instant case support the district court's decision. Unlike the facts the court found influential in Joostberns, the Defendants' actions in destroying the folder were not part of a regular business practice. In Joostberns, the court found that the defendants had no notice of potential litigation or the need for the evidence in their possession at the time that they destroyed the evidence. Id. But here, the Defendants preserved the folder as direct evidence of the alleged disclosure at the same time that they made repeated statements that actual evidence would be necessary to pursue claims, demonstrating their awareness that claims could be filed and that direct evidencethe folderwould be necessary. The Defendants also had not completed their official response to the incident at the time that they destroyed the folderarbitration was complete, but Thoms had not yet issued the second memorandum on behalf of FMC.
The district court also did not abuse its discretion in holding that the folder was relevantthat the Plaintiffs had made "some showing indicating that the destroyed evidence would have been relevant to the contested issue" of who may have accessed the folder, Kronisch, 150 F.3d at 127, such that "a reasonable *555 trier of fact could find that it would support that claim," Residential Funding Corp., 306 F.3d at 107. "[A] party seeking an adverse inference may rely on circumstantial evidence to suggest the contents of destroyed evidence." Byrnie, 243 F.3d at 110. The Defendants' argument that the folder was not "relevant" because of uncertainty regarding whether it would provide "credible evidence" is unconvincing, especially given their attempts to prove non-disclosure at trial by introducing testimony about the results of their own inspection of the folder. The Plaintiffs' proof at trial included testimony from inmates present at the time who stated that another inmate had accessed the folder. The physical appearance and condition of the folder was clearly relevant to this offer of proof because it would make the existence of a favorable material factdisclosure of the folder to unauthorized personsmore probable. See Residential Funding Corp., 306 F.3d at 109 (holding evidence of bad faith or gross negligence that satisfies the culpable-state-of-mind requirement is also usually sufficient to satisfy the relevance requirement).
The district court did not abuse its discretion in imposing a non-rebuttable adverse inference after finding that the Defendants' destruction of the folder "severely compromised" the Plaintiffs' case by depriving the Plaintiffs of the most relevant piece of evidence to prove their claims. Beaven, 2007 WL 1032301, at *16. The Plaintiffs' case hinged on whether or not the folder was compromised, constituting disclosure to unauthorized persons. The district court's spoliation sanction was "necessary to further the remedial purpose of the inference." See Residential Funding Corp., 306 F.3d at 108 ("[The] sanction [of an adverse inference] should be available even for the negligent destruction of documents if that is necessary to further the remedial purpose of the inference." (citation omitted)); Silvestri, 271 F.3d at 593-95 (upholding dismissal as sanction for plaintiff's negligent spoliation where highly prejudicial to other party because the plaintiff "denied . . . [the defendant] access to the only evidence from which it could develop its defenses adequately"). The district court's use of a spoliation inference for a critical element of the case is not unprecedented. See Rogers v. T.J. Samson Cmty. Hosp., 276 F.3d 228, 232 (6th Cir.2002) ("`When . . . a plaintiff is unable to prove an essential element of her case due to the negligent loss or destruction of evidence by an opposing party, . . . it is proper for the trial court to create a rebuttable presumption that establishes the missing elements of the plaintiff's case that could only have been proved by the availability of the missing evidence.'" (quoting Welsh, 844 F.2d at 1248)). And although an adverse inference is usually only permissive for the factfinder, not mandatory, see Blinzler v. Marriott Int'l, Inc., 81 F.3d 1148, 1158-59 (1st Cir.1996), here the district court judge was the factfinder and therefore was free to accept the inference and discredit the Defendants' proffered testimony to the contrary.[11]
*556 Even if the Defendants were correct, however, that the district court erred in imposing the evidentiary sanction, we conclude that it would be harmless error because the district court's alternative finding that the Plaintiffs proved disclosure by a preponderance of the evidence, without considering the adverse inference, was not clearly erroneous.
We review the sufficiency of the district court's findings of fact for clear error, and we may not reverse a "district court's account of the evidence [that] is plausible in light of the entire record . . . even if convinced that, had [we] been sitting as trier of fact, [we] would have weighed the evidence differently." Harlamert v. World Finer Foods, Inc., 489 F.3d 767, 771 (6th Cir.2007) (citing Anderson v. City of Bessemer City, N.C., 470 U.S. 564, 574-75, 105 S. Ct. 1504, 84 L. Ed. 2d 518 (1985)). We cannot deem "the factfinder's choice" between two permissible views of the evidence clearly erroneous. Id. "[W]hen a trial judge's finding is based on his decision to credit the testimony of one of two or more witnesses, each of whom has told a coherent and facially plausible story that is not contradicted by extrinsic evidence, that finding, if not internally inconsistent, can virtually never be clear error." Anderson, 470 U.S. at 575, 105 S. Ct. 1504. We must "liberally construe[ ]" findings in support of the district court's judgment, "even if the findings are not as explicit or detailed as we might desire." Truform, Inc. v. Gen. Motors Corp., 80 Fed.Appx. 968, 973 (6th Cir.2003) (unpublished opinion) (citing Grover Hill Grain Co. v. Baughman-Oster, Inc., 728 F.2d 784, 793 (6th Cir.1984)). "[T]he failure to even make an express finding of a particular fact does not require reversal if a complete understanding of the issues may be had without the aid of separate findings." Grover Hill, 728 F.2d at 793; Truform, 80 Fed.Appx. at 973.
Contrary to the Defendants' contentions, the district court here did not rely on legally insufficient circumstantial evidence and credibility determinations in finding proof of disclosure by a preponderance. Although the district court did not explicitly state that it was crediting the Plaintiffs' proffer of inmate testimony respecting other inmates' access to the folder and use of the information over the Defendants' proffered testimony regarding the appearance of the folder, the court did explicitly state it was discrediting all of the Defendants' testimony. See Beaven, 2007 WL 1032301, at *17. We conclude that, when viewed in context, the findings in the remainder of the opinion confirm that the district court accepted the inmates' testimony of disclosure. See id. at *2-3. These findings support the district court's judgment and permit us to have a clear understanding of the reasoning behind the district court's decision. Grover Hill, 728 F.2d at 793 ("If, from the facts found, other facts may be inferred which will support the judgment, such inferences should be deemed to have been drawn by the District Court.").
We therefore affirm the district court's judgment that a disclosure occurred. Because we have affirmed the district court's judgment that a Privacy Act disclosure occurred in violation of § 552a(g)(1)(D) and that "the agency acted in a manner that was intentional or willful," we conclude that the district court properly determined *557 that the Plaintiffs were entitled to damages under § 552a(g)(4) of the Privacy Act. The Defendants do not challenge the district court's damages award on appeal, but our conclusion does require us to address one of the Plaintiffs' cross-appeal contentions.
On cross-appeal, the Plaintiffs argue that the district court's damages award does not make them "whole" because, although the court awarded mitigation damages, it disallowed recovery for "lost time" and "future protective measures" that the Plaintiffs assert should qualify as "actual damages" under common-law tort principles. The Plaintiffs asserted that they should be compensated at their regular hourly rate as BOP employees for the time they had already spent dealing with the disclosure so that damages would exceed the $1,000 statutory minimum for actual damages. The district court disagreed, but found that all of the Plaintiffs were entitled to recover the $1,000 statutory minimum because the costs of the prophylactic measures each took to prevent harm from the disclosure constituted actual damages. The court concluded that compensation for lost time was unavailable under the Privacy Act because it must narrowly construe the waiver of sovereign immunity in the damages provision. The court found that only two of the Plaintiffs had incurred costs above $1,000, and the court awarded the respective amount of actual damages to each. The court rejected the claim for damages for any future protective measures, finding that such damages would be unreasonable given the court's earlier finding that none of the Plaintiffs had suffered adverse effects from the disclosure. Beaven, 2007 WL 1032301, at *28; Doc. 353 (Damages Op. at 3-5).
The Supreme Court in Doe v. Chao held that a Privacy Act plaintiff must prove some actual damages before she is entitled to the minimum statutory damages under § 552a(g)(4), specifically rejecting "general" or "presumed" damages available in other common-law privacy torts. Doe, 540 U.S. at 621-23, 124 S. Ct. 1204. The Court also noted that, from a review of the legislative history, "it is implausible that Congress intended tacitly to recognize a nominal damages remedy after eliminating the explicit reference to general damages." Id. at 623 n. 6, 124 S. Ct. 1204. In Hudson v. Reno, we noted that although "actual damages" as required under § 552a(g)(4) "has no plain meaning or consistent legal interpretation, . . . when it is being applied against the government [as a waiver of sovereign immunity] it must be narrowly interpretedhere that requires finding that actual damages only mean out-of-pocket losses, not emotional distress." Hudson, 130 F.3d 1193, 1207 n. 11 (6th Cir.1997) (declining to follow Johnson v. Dep't of Treasury, 700 F.2d 971 (5th Cir. 1983), abrogated by Doe, 540 U.S. at 618, 124 S. Ct. 1204), cert. denied, 525 U.S. 822, 119 S. Ct. 64, 142 L. Ed. 2d 50 (1998), abrogated on other grounds by Pollard v. E.I. du Pont de Nemours & Co., 532 U.S. 843, 848, 121 S. Ct. 1946, 150 L. Ed. 2d 62 (2001); see Fanin v. U.S. Dep't of Veterans Affairs, 572 F.3d 868, 874 (11th Cir.2009) (acknowledging Hudson and reiterating that the Sixth and Eleventh Circuits follow the same rule requiring proof of actual pecuniary loss), cert. denied, ___ U.S. ___, 130 S. Ct. 1755, 176 L. Ed. 2d 212 (2010). In Hudson, this court specifically rejected an attempt to broaden actual damages to include compensatory damages such as "`mental injuries, loss of reputation, embarrassment or other non-quantifiable injuries,'" but did not actually decide whether § 552a(g)(4) foreclosed such damages. Hudson, 130 F.3d at 1207 (quoting Fitzpatrick v. I.R.S., 665 F.2d 327, 331 (11th Cir.1982), overruled on other grounds by Doe, 540 U.S. at 618, 124 S.Ct. *558 1204). The Hudson court's finding that the plaintiff could not prove actual damages was not necessary to its decision; indeed, the court introduced its actual damages discussion as "[a] final basis for affirming the District Court's decision" that the plaintiff had presented no viable Privacy Act claims. Hudson, 130 F.3d at 1207. We need not now decide whether this circuit should adopt the Hudson court's rationale expressed in dicta because it is not necessary to do so to reach a decision in this case.[12]
First, even if we determined that the Plaintiffs' alleged "future protective measures" damages are cognizable "out-of-pocket losses," the Plaintiffs are unable to prove causation. See Doe, 540 U.S. at 621-22, 124 S. Ct. 1204 (holding a plaintiff must prove causation in order to obtain damages); Hudson, 130 F.3d at 1207 (same). The Plaintiffs do not challenge the district court's factual finding that it was unreasonable to believe that the disclosure would cause any adverse effects in the future based on the lack of adverse effects to date, Doc. 353 (Damages Op. at 3-4), and, by extension, it is only logical that the Plaintiffs also cannot prove that the disclosure would cause any future "out-of-pocket losses." See Hudson, 130 F.3d at 1207 n. 11; Brown v. U.S. Dep't of Justice, 169 Fed.Appx. 537, 541 (11th Cir. 2006) (unpublished opinion) (§ 552a(g)(4) actual damages claims cannot be merely speculative). We therefore affirm the district court's decision to deny the "future protective measures" damages.
The additional "lost time" damages sought by the Plaintiffs may qualify as "out-of-pocket losses" under the rationale in Hudson.[13] The Plaintiffs do not challenge the district court's finding that the out-of-pocket costs that the Plaintiffs incurred for taking prophylactic measures did not exceed $1,000, and they have not included a calculation of any "lost time" damages as an out-of-pocket cost incurred at their hourly rate in their briefing on appeal.[14] However, we conclude *559 that the district court erred in denying the Plaintiffs'"lost time" damages on the ground that their failure to assert valid FTCA claims precluded them from recovering damages for their valid Privacy Act claims. We agree with the Hudson court's determination that the sovereign immunity waiver in § 552a(g)(4) requires a narrowing construction, and that this narrowing construction when applied here justifies requiring the Plaintiffs to prove "out-of-pocket losses" for their "lost time" damages. Hudson, 130 F.3d at 1207 n. 11. We therefore reverse the district court's damages decision to the extent that it denies the Plaintiffs' recovery for "lost time" damages on the theory of sovereign immunity, and we remand to the district court for a finding on the amount of "lost time" damages for each Plaintiff. Such damages are neither "general damages" nor "presumed damages" within the meaning accorded to those terms in Doe. Doe, 540 U.S. at 620-27, 124 S. Ct. 1204. If the district court finds that a Plaintiff is able to prove that his or her "lost time" coupled with the costs of his or her prophylactic measures taken exceeds $1,000, then that Plaintiff should be entitled to recover the total amount of his or her actual damages rather than the statutory minimum of $1,000.
The Plaintiffs raised the three remaining issues in their cross-appeal only as alternative grounds for relief "[i]f for any reason this Court does not affirm the trial court's determination that an actual disclosure occurred, `intentionally or willfully,' within the meaning of the Privacy Act." Pls.-Appellees/Cross-Appellants Br. at 55, 62, 63. Because we have affirmed the district court's judgment in this respect, we conclude that we do not need to address the remaining issues on cross-appeal.
The district court did not clearly err in finding that the agency's "inadvertent" final act was "willful" within the meaning of 5 U.S.C. § 552a(g)(4) because a court may consider the entire course of conduct that resulted in the Privacy Act violation in making its required finding under § 552a(g)(4). Further, the district court did not abuse its discretion in imposing a non-rebuttable adverse evidentiary inference of disclosure as a sanction for the Defendants' destruction of relevant evidence with the knowledge that the evidence would be necessary for known potential claims, as this was a proper sanction in light of the remedial purpose of evidentiary sanctions. Finally, from a review of the district court's opinion, we conclude that the court did not commit clear error in its alternative finding that the Plaintiffs did prove disclosure by a preponderance of the evidence. We cannot agree, however, with the Plaintiffs' contention that "actual damages" recoverable under the Act includes recovery for future protective measures, but we conclude that the Plaintiffs may be entitled to recovery for lost time if they can prove out-of-pocket losses. The district court correctly declined to extend the meaning of "actual damages" beyond the scope of our precedents, but it erred in extending sovereign immunity to preclude potential out-of-pocket losses. Therefore, we AFFIRM the district court's judgment finding the Defendants liable on the Plaintiffs' Privacy Act claims and finding that "future protective measures" damages are unavailable, *560 but we REVERSE the district court's judgment as it relates to the Plaintiffs'"lost time" damages and we REMAND for proceedings consistent with this opinion.
CORNELIA G. KENNEDY, Circuit Judge, dissenting.
Because I do not agree that bringing an unlabelled folder containing Plaintiffs' Privacy Act-protected information into an unsecured workspace rose to the level of "intentional or willful" agency action under 5 U.S.C. § 552a(g)(4), I must respectfully dissent.
The majority affirms the district court's award of Privacy Act damages to Plaintiffs, upholding the district court's conclusion that Defendants "acted in a manner which was intentional or willful" as required by § 552a(g)(4), despite that court's finding that the final act resulting in disclosureJones's leaving the folder unsecured on Moore's deskwas inadvertent. In order to support its ruling, the majority reads the Privacy Act to allow a court to consider "the entire course of conduct that resulted in [a violation]" when determining whether an agency acted intentionally or willfully under § 552a(g)(4). Maj. Op. at 551. While I agree with the substance of this interpretation, I would limit the "intentional or willful" inquiry to those agency actions that have a direct causal connection to the Privacy Act violation. As I read § 552a(g)(4), its application to suits brought under § 552a(g)(1)(D) implies that the agency's relevant actions are only those that constitute a failure to comply with a provision of the Privacy Act. Otherwise I fear that too wide a range of agency conduct could be swept within the "intentional or willful" analysis. Basing a finding of "intentional or willful" conduct on agency actions that are not causally connected to a Privacy Act violation would subvert Congress's efforts to strike a balance between providing an appropriate damage remedy to victims of Privacy Act violations and safeguarding the government from crippling liability under the Privacy Act. See Privacy Act of 1974, Pub.L. No. 93-579, § 2(b)(5), 88 Stat. 1896, 1896 (1974) ("The purpose of this Act is to provide certain safeguards for an individual against an invasion of personal privacy by requiring Federal agencies . . . to . . . be subject to civil suit for any damages which occur as a result of willful or intentional action which violates any individual's rights under this Act." (emphasis added)). This balance is evident in Congress's decision to select "intentional or willful" conduct as the standard of recovery for Privacy Act damages, instead of the stricter "willful, arbitrary or capricious" standard originally favored by the House of Representatives or the more lenient negligence standard proposed by the Senate. See Analysis of House and Senate Compromise Amendments to the Federal Privacy Act, reprinted in 120 Cong. Rec. 40,405, 40,406 (1974). It has also served as a guiding principle for several courts construing § 552a(g)(4). See, e.g., Albright v. United States, 732 F.2d 181, 189 (D.C.Cir. 1984) ("[T]he `intentional or willful' action requirement of Section 552a(g)(4) refers only to the intentional or willful failure of the agency to abide by the Act, and not to all voluntary actions which might otherwise inadvertently contravene one of the Act's strictures." (emphasis added)), abrogated on other grounds by Doe v. Chao, 540 U.S. 614, 124 S. Ct. 1204, 157 L. Ed. 2d 1122 (2004).
Applying this principle to Plaintiffs' claim, when determining whether Defendants acted intentionally or willfully we should consider only those acts of Defendants that played a part in causing the unauthorized disclosure of Plaintiffs' protected information. "An agency acts intentionally or willfully `either by committing the act without grounds for believing it to be lawful, or flagrantly disregarding *561 others' rights under the [Privacy] Act.'" Mount v. U.S. Postal Serv., 79 F.3d 531, 533 (6th Cir.1996) (alteration in original) (quoting Wilborn v. Dep't of Health & Human Servs., 49 F.3d 597, 602 (9th Cir. 1995)). As the majority notes, Defendants' actions were not "intentional" since the district court concluded that "leaving the folder unsecured on Moore's desk was inadvertent." Beaven v. U.S. Dep't of Justice, No. 03-84-JBC, 2007 WL 1032301, at *17 (E.D.Ky.2007). Therefore, Plaintiffs must prove that Defendants acted willfully by showing that Defendants flagrantly disregarded their rights under the Privacy Act through actions that made a prohibited disclosure unreasonably likely to occur. Based on the district court's factual findings in this case, I do not believe Plaintiffs satisfied their burden.
The district court determined that "Jones's conscious decision to ignore the risks associated with bringing unmarked confidential information into an area to which inmates have access" qualified as "willful" conduct under § 552a(g)(4). Id.[1] The district court's opinion did not explain what acts prior to leaving the documents on Moore's desk were relevant to its determination; it relied only on the conclusory testimony of Plaintiffs' expert that "the information was handled in reckless disregard of the Privacy Act and relevant guidelines." Id. However, I do not see how Jones's actions evidenced a "reckless disregard" of the danger that unauthorized persons would access the file. Jones carried the folder into an area where no one was present except himself and two experts from Washington, D.C. sent by the BOP to audit staff and prisoners' computer use. Inmates and other prison personnel did not have access to this workspace during the night-time hours Jones would be working; they were to return to the area the next day,[2] a time when, except for Jones' inadvertence, the folder would have been returned to his secure office.
Jones's decision to bring into an unsecured workspace more information than necessary to complete the investigation and his failure to properly label the information as "LOU-Sensitive" are clearly negligent. Nevertheless, since Jones fully intended to return the folder to the security of his office once he had completed his work and his failure to do so was merely inadvertent, I cannot view this as an "extraordinary departure from standards of reasonable conduct." Kostyu v. United States, 742 F. Supp. 413, 417 (E.D.Mich. 1990).[3] Though I believe that Jones's actions *562 might rise to the level of "willful" if his or other FMC employees' conduct established a pattern of mishandling sensitive information, the evidence does not support such a finding; instead, it indicates that Jones did not ordinarily take the file out of his secure office, and prior exchanges of this information between employees were made by hand without mishap. For these reasons, I would reverse the district court's award of Privacy Act damages to the Plaintiffs based on a violation of § 552a(b). This ruling requires me to consider Plaintiffs' cross-appeals for alternative grounds of relief.
Plaintiffs first contest the district court's summary judgment ruling denying its claim for Privacy Act damages based on Defendants' failure to follow BOP rules governing security procedures for sensitive information. Section 552a(g)(1)(D) provides a damage remedy for an agency's "fail[ure] to comply with any other provision of this section, or any rule promulgated thereunder, in such a way as to have an adverse effect on an individual." § 552a(g)(1)(D). Plaintiffs claim that the BOP Program Statements Jones disobeyed by failing to mark the folder and its contents as "LOU-Sensitive" before transporting it to an unsecured area constitute "rule[s] promulgated" under the Privacy Act, making Jones's violation actionable under § 552a(g)(1)(D).
The plain meaning and construction of § 552a suggests that "rule promulgated" as used in § 552a(g)(1)(D) refers only to an agency rule promulgated under the notice-and-comment procedures of the Administrative Procedure Act, 5 U.S.C. § 553. "Promulgate" appears in three other subsections of § 552a, all of which explicitly reference § 553; for example, § 552a(f), entitled "Agency rules," requires that "[i]n order to carry out the provisions of this section, each agency that maintains a system of records shall promulgate rules, in accordance with the requirements (including general notice) of section 553 of this title." § 552a(f); see also § 552a(j) ("The head of any agency may promulgate rules, in accordance with the requirements (including general notice) of sections 553(b)(1), (2), and (3), (c), and (e) of this title . . . ."); § 552a(k) (same). In contrast, the BOP Program Statement that forms the basis of Plaintiffs' claim was created under § 552a(e), which requires an agency to "establish rules of conduct for persons involved in . . . maintaining any record," § 552a(e)(9) (emphasis added), and to "establish appropriate administrative, technical, and physical safeguards to insure the security and confidentiality of records," § 552a(e)(10) (emphasis added). The difference in language between § 552a(f) and (g)(4) on the one hand, and § 552a(e)(9) and (10) on the other, suggests that "rules of conduct" or "safeguards" "established" under § 552a(e)(9) and (10) are not within the damage remedy provided in § 552a(g)(4) for an agency's failure to comply with "rules promulgated." See also Office of Mgmt. & Budget, Privacy Act GuidelinesJuly 1, 1975, 40 Fed.Reg. 28,949, 28,969 (July 9, 1975) ("In addition to the grounds specified in subsections (g)(1)(A) through (C) above, an individual may bring an action for any other alleged failure by an agency to comply with the requirements of the Act or failure to comply with any rule published by the agency to implement the Act (subsection (f)) . . . ."). Because a BOP Program Statement is not a rule promulgated through the notice-and-comment process, see Reno v. Koray, 515 U.S. 50, 61, 115 S. Ct. 2021, 132 L. Ed. 2d 46 (1995) (describing a BOP Program Statement as an "internal agency guideline" that is "akin to an `interpretive rule' that `do[es] not require *563 notice and comment'" (alteration in original) (quoting Shalala v. Guernsey Mem'l Hosp., 514 U.S. 87, 99, 115 S. Ct. 1232, 131 L. Ed. 2d 106 (1995))), the district court correctly concluded that its violation is not actionable under the Privacy Act, and I would affirm the grant of summary judgment to Defendants on this claim.
Plaintiffs have two remaining cross-appeals[4] based on the district court's dismissal of their Federal Tort Claims Act ("FTCA") claim for outrageous conduct and its denial of their motion for sanctions against Defendants. Plaintiffs' FTCA claim alleges that Defendants committed the tort of outrage through "Jones's improper access to the information in the folder, the failure to properly mark the documents or folder, the transportation of the folder without taking appropriate security precautions, leaving the folder unsecured in UNICOR, and FMC's fail[ure] to timely report to OIA the result of FMC's inquiry into Jones's handing of the Marion Johnson incident." Beaven, 2007 WL 1032301, at *26.[5] The district court dismissed this claim as moot, finding that "plaintiffs' damages are adequately compensated by the award under the Privacy Act." Id. at *27. Because I would make Plaintiffs' FTCA claim no longer moot by overturning their damage award, I would remand this claim to the district court.
Plaintiffs' motion for sanctions against Defendant for its destruction of the folder and for misrepresentations related to the folder made during discovery was denied by the district court on similar grounds. Because it had already imposed the nonmonetary sanction of the adverse inference of disclosure, which was dispositive of Plaintiffs' Privacy Act claim, and because Plaintiffs were entitled to move for attorneys' fees as a prevailing party under the Privacy Act, the district court concluded that further sanctions would be unjust under the circumstances and were not necessary to deter similar future abuses. Reversing the district court's ruling for Plaintiff on their Privacy Act claim takes the substance out of the district court's adverse inference and forecloses Plaintiffs from receiving attorneys' fees under the Privacy Act, so I would therefore remand Plaintiffs' motion for sanctions to the district court.
In summary, the record in this case does not support a determination that Defendants acted intentionally or willfully as required by the Privacy Act in order for Plaintiffs to recover damages from Defendants' inadvertent disclosure of protected information; I find unavailing the majority's attempt to use Defendants' negligent actsnamely, the failure to label the folder containing the prison employees' protected information as "LOU-Sensitive," and Jones's transferring of the entire folder, rather than only the information needed to perform the investigation of the computers, to an area that, though unsecured, was closed to prison employees and inmates during the nightto transform Jones's inadvertent failure to take the folder back to his secure office into an "intentional or willful" disclosure. For this reason, I respectfully dissent. I would reverse the district court's judgment holding Defendants liable for Plaintiffs' Privacy Act claim premised on unauthorized disclosure. On Plaintiffs' cross appeals, I would affirm the district court's grant of summary *564 judgment to Defendants on Plaintiffs' Privacy Act claim premised on Defendants' violation of internal BOP policies. I would reverse the district court's dismissal of Plaintiffs' FTCA claim and its denial of Plaintiffs' motion for sanctions and remand both issues to the district court for reconsideration.
[1] The section is a summary of the district court's lengthy findings of fact. Beaven v. U.S. Dep't of Justice, No. 03-84-JBC, 2007 WL 1032301, at *1-14 (E.D.Ky. Mar. 30, 2007) (unpublished opinion).
[2] UNICOR is the trade name of Federal Prison Industries, Inc.
[3] "LOU" stands for Limited Official Use.
[4] The district court found that Thoms's and Carter's explanations for their decisions during this time period were "not consistent with FMC security practices and policies" concerning a security breach. Beaven, 2007 WL 1032301, at *4.
[5] The remaining cross-appeal issues include: (1) Whether the district court erred in denying the Plaintiffs' motion for summary judgment by holding that a BOP Program Statement or Institution Supplement is not a "rule promulgated" actionable under 5 U.S.C. § 552a(g)(1)(D); (2) Whether the district court's Privacy Act damages decision should not have mooted the FTCA outrageous-conduct claims; and (3) Whether the district court's adverse evidentiary inference and related Privacy Act damages decision should have led the district court to grant the Plaintiffs' motion for discovery sanctions.
[6] Justice Ginsburg further explained that subsection (g)(4)'s opening clause requires that "the agency action triggering the suit under § 552a(g)(1)(C) or (D) must have been `intentional or willful,'" and also phrased the condition as "intentional or willful conduct." Doe, 540 U.S. at 629, 124 S. Ct. 1204 (Ginsburg, J., dissenting) (emphases added). And although the majority opinion questioned the deference owed to the 1975 Office of Management & Budget ("OMB") interpretations, id. at 627 n. 11, 124 S. Ct. 1204 (majority opinion), it is useful to note that the OMB's Privacy Act Guidelines interpret these subsections to provide for damages "[w]hen the court finds that an agency has acted willfully or intentionally in violation of the Act," Office of Mgmt. & Budget, Privacy Act Implementation: Guidelines & Responsibilities, 40 Fed. Reg. 28,970 (1975), cited in Doe, 540 U.S. at 633, 124 S. Ct. 1204 (Ginsburg, J., dissenting). In his separate dissent, Justice Breyer remarked on the likelihood of recovery based on the "intentional or willful" requirement, finding that "the lower courts have interpreted the phrase restrictively, essentially applying it where the Government's violation of the Act is in bad faith" and concluding that "[g]iven this prevailing interpretation, the Government need not fear liability based upon a technical, accidental, or good-faith violation of the statute's detailed provisions." Doe, 540 U.S. at 642, 124 S. Ct. 1204 (Breyer, J., dissenting) (citing, inter alia, Hudson v. Reno, 130 F.3d 1193, 1205 (6th Cir.1997), cert. denied, 525 U.S. 822, 119 S. Ct. 64, 142 L. Ed. 2d 50 (1998), abrogated on other grounds by Pollard v. E.I. du Pont de Nemours & Co., 532 U.S. 843, 848, 121 S. Ct. 1946, 150 L. Ed. 2d 62 (2001)).
[7] The "intentional or willful" qualifying language of § 552a(g)(4) is present in at least two other privacy statutes, the Electronic Communications Privacy Act of 1986, 18 U.S.C. § 2707(a) (granting relief to those "aggrieved by any violation of this chapter in which the conduct constituting the violation is engaged in with a knowing or intentional state of mind") and § 2707(c) ("If the [unauthorized access to electronic communications] violation is willful or intentional, the court may assess punitive damages."); and the Tax Reform Act of 1976, 26 U.S.C. § 6110(j)(2) (awarding damages under certain provisions if "the Court determines that an employee of the Internal Revenue Service intentionally or willfully failed to [comply with certain provisions]").
[8] In debate over what standard to include, members of the House attempted to amend the bill to allow actual damages without any finding of intent or other standard of conduct, 120 Cong. Rec. 36,658-60, 36,955-57, SOURCE BOOK, supra, at 919-29, as the original Senate version had read, 120 Cong. Rec. 36,893, 36,921, 39,204, S.REP. NO. 93-1183, at 83 (1974), SOURCE BOOK, supra, at 236, 370-71. The original House version awarded recovery for either willful or negligent actions. H.R. 16373, 93rd Cong. (as introduced Aug. 12, 1974), reprinted in SOURCE BOOK, supra, at 251-52. But, as reported by the House Committee on Government Relations, damages were available only if "the court determines that the agency acted in a manner which was willful, arbitrary, or capricious." H.R. 16373, 93rd Cong. (as reported by H.R. Comm. on Gov't Relations, Oct. 2, 1974), reprinted in SOURCE BOOK, supra, at 287-88; H.R.Rep. No. 93-1416, at 31-32, reprinted in SOURCE BOOK, supra, at 324-25. The compromise "intentional or willful" language reflected the desire to provide a way to limit the government's liability for monetary recoveries. (One Representative spoke out in opposition to the second proposed amendment to remove a standard of conduct and specifically argued against allowing recovery for a completely "inadvertent" violation because of the potential for "undue liability." 120 Cong. Rec. 36,956, SOURCE BOOK, supra, at 926-27.)
[9] See Scrimgeour v. Internal Revenue, 149 F.3d 318, 323-26 (4th Cir.1998) (finding conduct not even grossly negligent where agency employees were simply careless in improperly handling initial disclosure request and other employees who delayed in handling request to stop improper disclosures exercised best professional judgment in how to protect plaintiff's rights); Sullivan v. Veterans Admin., 617 F. Supp. 258, 259 n. 2, 262 (D.D.C.1985) (finding agency did not act intentionally or willfully in releasing report that "inadvertently" included one instance of plaintiff's name because "[w]hile the VA was not completely successful in deleting all the personally identifiable references to plaintiff, its attempt to do so demonstrates that agency's consideration of and concern for plaintiff's privacy interests").
[10] The "LOU-Sensitive" marking is required under BOP Program Statement 1237.11 and Institutional Supplement 1237.11 A. Beaven, 2007 WL 1032301, at *2. "The purpose of marking sensitive information as `LOU-Sensitive' was to ensure that persons in possession of such documents were conscious of their sensitive nature and cautious to protect them from disclosure." Id.
[11] The district court's use of a conclusive, non-rebuttable inference of disclosure fulfilled the purpose of spoliation sanctions for the destruction of relevant evidence. See 2 John Henry Wigmore, Evidence in Trials at Common Law § 291, at 227-29 (Chadbourn rev. 1979) (noting that "there is no reason why the utmost inference logically possible should not be allowable, namely, that the contents of the document (when desired by the opponent) are what he alleges them to be, or (when naturally a part of the possessor's case) are not what he alleges them to be" and that in the case of spoliation, rather than mere nonproduction, "it is open to the larger inference . . ., namely, a consciousness of the weakness of the whole case"); id. at 228 ("[T]he rule might correctly be stated as follows: The failure or refusal to produce a relevant document, or the destruction of it, is evidence from which alone its contents may be inferred to be unfavorable to the possessor, provided the opponent, when the identity of the document is disputed, first introduces some evidence tending to show that the document actually destroyed or withheld is the one as to whose contents it is desired to draw an inference.").
[12] The Plaintiffs request that this panel reconsider Hudson in light of the circuit split acknowledged in Doe: "The Courts of Appeals are divided on the precise definition of actual damages. Compare Fitzpatrick v. IRS, 665 F.2d 327, 331 (11th Cir. 1982) (actual damages are restricted to pecuniary loss), with Johnson v. Department of Treasury, IRS, 700 F.2d 971, 972-974 (5th Cir.1983) (actual damages can cover adequately demonstrated mental anxiety even without any out-of-pocket loss). That issue is not before us. . . ." Doe, 540 U.S. at 627 n. 12, 124 S. Ct. 1204. Doe merely recognized the circuit split without resolving it. Because this court has already declined to follow Johnson, and we need neither accept nor reject Hudson's rationale for our decision in this case, we decline to reevaluate our position now.
[13] Our reference to the Hudson term here does not contradict our declination to embrace the full Hudson rationale because the Plaintiffs'"lost time" damages claim does not require us to decide whether actual damages may include non-pecuniary lossesany Privacy Act injury incurred in the form of lost time is necessarily a pecuniary harm that is readily determined and does not require the court to speculate in the same manner as general or presumed damages. This is in line with this court's recognition that "[a]lthough dictum is unnecessary to the decision, it may nevertheless be followed if `sufficiently persuasive.'" PDV Midwest Ref., L.L.C. v. Armada Oil & Gas Co., 305 F.3d 498, 510 (6th Cir.2002) (quoting Central Green Co. v. United States, 531 U.S. 425, 431, 121 S. Ct. 1005, 148 L. Ed. 2d 919 (2001)).
[14] The Plaintiffs' motion for entry of judgment (Doc. 335) in the district court did not include a calculation of "lost time" damages but instead stated that "about a dozen, more or less, of the Plaintiffs will exceed the $1,000.00 minimum threshold of damages" and "ask[ed] they be given leave to amend their motion for judgment to include the amounts they specifically claim for lost time" if the district court concluded that "lost time" was recoverable under the Privacy Act. Doc. 335 (Mot. for Entry of J. at 10-11). Therefore, even if the Plaintiffs did challenge the district court's finding, we would be unable to review whether the district court correctly determined the damages.
[1] The record indicates that all of the agency's acts relating to the disclosure were Jones' acts, except the initial failure to place the "LOU-Sensitive" label on the information lists he carried in the folder before they were turned over to Jones for his use every quarter. Since I do not think that a failure to label the lists could be a cause of the disclosureit had been the practice for years without incident I do not consider this action pertinent to the willfulness inquiry.
[2] While the office was not occupied after 7:00 PM by either staff or inmates, inmates' access began at 7:00 AM, a time at which only a skeleton staff was present in the area. The employee on whose desk Jones left the folder started work at 9:00 AM, though evidence indicates it would take her at least twenty minutes to reach her desk after entering the prison complex. Therefore, at most there was only a two-hour-and-twenty-minute window during which the folder sat unsecured and capable of being read by inmates.
[3] The majority points out that Jones violated BOP Program Statements by transporting the unlabelled folder into an unsecured area, and that "[a] plain failure to comply with established [agency] policy might constitute `willful' or `intentional' conduct actionable under § 552a(g)(4)." White v. Office of Pers. Mgmt., 840 F.2d 85, 87 (D.C.Cir.1988). However, given that Jones was aware of the sensitive nature of the information contained in the folder and he intended to return it to his office once he had completed his work, I do not think his violation of BOP policy has a sufficiently direct causal connection to the disclosure to support a finding that he acted willfully.
[4] I need not consider the fourth issue Plaintiffs assert on cross appealwhether the Privacy Act allows recovery for "lost time" and "future protected measures" as "actual damages"because I do not think Plaintiffs have stated a valid Privacy Act claim.
[5] In their original complaint, Plaintiffs included more of Defendants' actions as the basis of their outrage claim. However, the district court dismissed several of these counts for lack of jurisdiction, and Plaintiffs do not appeal this ruling.
