UNDER SEAL

MEMORANDUM OPINION AND ORDER

RICHARD W. ROBERTS, United States District Judge

Plaintiff Maureen Hill, a former employee of the Department of Defense ("DoD"), brings this suit against the DoD1 alleging that it violated the Privacy Act, 5 U.S.C. § 552a et seq., by accessing and distributing her personnel records, medical information, security file, and leave requests on eleven occasions. The DoD has filed a motion to dismiss and argues in the alternative for summary judgment. The DoD is entitled to summary judgment on Count One, because the disclosure alleged in that count falls within the need-to-know exception to the Privacy Act, and on Counts Ten and Eleven, because the violations alleged are time-barred. Genuine issues of material fact exist, however, regarding the timeliness of Counts Two through Nine, precluding summary judgment on those counts. The DoD's motion therefore will be granted in part and denied in part.

BACKGROUND

Hill served as a technical information specialist in the records management and directive branch/unit of the Office of the Chairman of the Joint Chiefs of Staff, an entity within the DoD, until her employment was terminated on August 10, 2007. Compl. ¶¶ 9, 11. William Kane directly supervised Hill from October 17, 2005 to April 25, 2007. Id. ¶ 12. Commander Leslie Spanheimer succeeded Kane and directly supervised Hill from April 30, 2007 to until Hill's termination. Id. ¶ 13. Erica Langerman served as the Director of Security for the Joints Chiefs of Staff ("JCOS") at all relevant times. Id. ¶ 14. Hill's complaint alleges that actions taken by Kane, Spanheimer, and Langerman, which occurred during discussions regarding Hill's use of leave and regarding Hill's proposed removal violated the Privacy Act on multiple occasions. Each of the eleven counts in the complaint alleges an intentional disclosure of specific protected information without Hill's consent.

In 2006, Langerman asked a JCOS employee to retrieve Hill's security file from the agency's filing system. Id. ¶ 18. The employee retrieved the file and provided it to Langerman, who in turn contacted Kane, Hill's supervisor at the time, to inform him that the file was "available for his review if he would like to access it." Id. ¶¶ 19-20. Count One alleges that the DoD violated the Privacy Act "when Langerman invited Kane to read through Ms. Hill's security file ... without reason or knowledge of what Kane would do with the information." Id. ¶ 66.

Hill's removal was proposed on April 20, 2007, and Hill submitted a response to that proposal. Id. ¶¶ 23, 44. On April 30, 2007, Spanheimer, having just replaced Kane as Hill's supervisor, sent a memorandum to Hill "outlining and clarifying restrictions on [Hill's] use of leave." Id. ¶ 25. The same day, Hill submitted to her employer a memorandum, dated April 26, 2007, from her treating medical providers verifying Hill's medical diagnosis and treatment and restricting Hill to working part-time, along with a letter from Hill requesting that work hours that had previously been classified as absent without leave ("AWOL") be converted to leave without pay under the Family and Medical Leave Act of 1993 ("FMLA"), 29 U.S.C. § 2601 et seq. Id. ¶¶ 26-27. Hill submitted a follow-up letter on May 1 "clarifying the part-time working hours recommended by her doctor." Id. 1128. Spanheimer notified Hill in writing that Hill would be required to "submit additional medical documentation to support her part-time working hours recommendation from her doctor." Id. 1129. The next day, Spanheimer issued a memorandum denying Hill's request to convert AWOL hours to leave without pay. Id. ¶ 30. On May 11, 2007, Hill submitted two more requests to have previous AWOL leave converted to leave without pay. Id. ¶ 31.

On May 14, 2007, Spanheimer e-mailed Kane the series of agency memoranda and responses from Hill described above. Id. 1141. Counts Two through Nine are each based on the disclosure of a separate document attached to the May 14 e-mail: the agency's April 30, 2007 Leave Restriction Memorandum (Count Two, id. 1176), Hill's April 26, 2007 medical memorandum requesting FMLA leave (Count Three, id. 1188), Hill's April 30, 2007 leave request to convert AWOL time to FMLA leave (Count Four, id. ¶ 99), Hill's May 1, 2007 Work Schedule Memorandum clarifying her doctor's working hours recommendation (Count Five, id. ¶ 111), the agency's May 1, 2007 memorandum denying Hill's request to work part-time (Count Six, id. 11123), the agency's May 2, 2007 denial of Hill's request to convert AWOL time to FMLA leave (Count Seven, id. 11135), Hill's first May 11, 2007 request for accrued annual and sick leave (Count Eight, id. ¶ 147), and Hill's second May 11, 2007 request for accrued annual and sick leave (Count Nine, id. ¶ 159).

On May 23, 2007 and June 11, 2007, Spanheimer sent Kane other documents relating to Hill. Count Ten is based on the disclosure of Hill's response to the agency's first proposed removal, which was attached to Spanheimer's May 23 e-mail to Kane. Id. 11171. Count Eleven is based on the disclosure of the agency's second proposed removal of Hill, which was attached to Spanheimer's June 11 e-mail to Kane. Id. ¶ 183.

Hill and the DoD were involved in separate litigation and, in connection with that litigation, Hill received discovery and conducted depositions regarding the events surrounding the termination of her employment. Id. ¶¶ 50, 52. In the course of the separate litigation, Hill received a Report of Investigation ("ROI") concerning a discrimination claim filed by Hill against the agency which included copies of the May 23, 2 007 and June 11, 2007 emails. Defs.' Mem. at 4-5; Defs.' Mot., Attach. B, ROI at 307-308. The ROI was delivered to Hill and her counsel by commercial mail on June 16, 2008. Defs.' Mot., Attach. B, ROI transmittal letter; Pl.'s Am. Mem. and Points of Law in Opp'n ("Pl.'s Opp'n") at 13, 15. On February 27, 2009, Hill received additional copies of e-mails Spanheimer sent to Kane attaching the documents underlying Counts Two through Ten. Compl. ¶ 50. Hill's counsel deposed Kane on February 11, 2009 and again on May 27, 2009, and deposed Spanheimer on January 7, 2009. Defs.' Mot., Attach. A; Pl.'s Opp'n, Ex. 1; Defs.' Reply, Attachs. C, D. Hill alleges that she learned of the disclosure underlying Count One through Kane's testimony on May 27 that "he had accessed and read her security file through the actions of Langerman." Compl. 1152.2

This action, docketed on February 14, 2011,3 alleges that the DoD's disclosures violated the Privacy Act and caused Hill mental distress, emotional trauma, embarrassment, humiliation and jeopardized her future financial and employment opportunities. Id. ¶ 53. The DoD moved to dismiss or, in the alternative, for summary judgment, arguing that Count One falls within the Privacy Act's need-to-know exception and that Counts Two through Eleven are time-barred.

DISCUSSION

The Privacy Act prohibits an agency from disclosing "any record which is contained in a system of records by any means of communication to any person, or to another agency, except ... with the prior written consent of ... the individual to whom the record pertains" and provides a cause of action for parties aggrieved by such an unauthorized disclosure. 5 U.S.C. §§ 552a(b), (g)(1)(D). "Privacy Act claims for monetary damages based on improper disclosure ... have four elements: `1) the disclosed information is a record contained within a system of records; 2) the agency improperly disclosed the information; 3) the disclosure was willful or intentional; and 4) the disclosure adversely affected the plaintiff.'" Doe v. U.S. Dep't of Justice, 660 F.Supp.2d 31, 44-45 (D.D.C.2009) (quoting Logan v. Dep't of Veterans Affairs, 357 F.Supp.2d 149, 154 (D.D.C. 2004)). The plaintiff bears the burden of proof. Id. at 45; see also Reuber v. United States, 829 F.2d 133, 141 n. 58 (D.C.Cir. 1987).

Courts have discretion to convert a motion to dismiss into one for summary judgment where the movant's challenge to the plaintiff's case relies on matters outside the pleadings. On a motion to dismiss, attached documents "whose authenticity is not disputed ... may be considered ... [when] they are referred to in the complaint and are integral to [plaintiff's] claim." Kaempe v. Myers, 367 F.3d 958, 965 (D.C.Cir.2004). Here, the DoD relies on the ROI and on deposition testimony from Kane, Spanheimer, and Langerman, all of which are integral to Hill's claims of unauthorized disclosure and are of undisputed accuracy. However, although Hill refers to deposition testimony in her complaint, she does not refer to the Report of Investigation. By relying on the ROI, the DoD's statute of limitations arguments go beyond simply challenging the adequacy of the complaint's allegations. Cf. Jones v. Bock, 549 U.S. 199, 215, 127 S.Ct. 910, 166 L.Ed.2d 798 (2007) ("If the allegations... show that relief is barred by the applicable statute of limitations, the complaint is subject to dismissal for failure to state a claim[.]") (emphasis added); see also Ramirez v. Dep't of Justice, 594 F.Supp.2d 58, 62 (D.D.C.2009) (citing Richards v. Mileski, 662 F.2d 65, 73 (D.C.Cir.1981)) ("Because statute of limitations issues often depend on contested questions of fact, the Court must exercise caution before dismissing a complaint on statute of limitations grounds based solely on the face of the complaint."). The DoD's motion therefore will be treated as one for summary judgment. See, e.g, Doe, 660 F.Supp.2d at 40.4

Summary judgment may be granted when "the movant shows that there is no genuine dispute as to any material fact and the movant is entitled to judgment as a matter of law." Fed.R.Civ.P. 56(a); see also Moore v. Hartman, 571 F.3d 62, 66 (D.C.Cir.2009). A court considering a motion for summary judgment must draw all "justifiable inferences" from the evidence in favor of the nonmovant. Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 255, 106 S.Ct. 2505, 91 L.Ed.2d 202 (1986). The nonmovant must either "come forward with specific facts showing that there is a genuine issue for trial[,]" Matsushita Elec. Indus. Co., Ltd. v. Zenith Radio Corp., 475 U.S. 574, 587, 106 S.Ct. 1348, 89 L.Ed.2d 538 (1986) (internal quotation marks and emphasis omitted), or show that the materials cited by the movant do not establish the absence of a genuine dispute. Fed. R.Civ.P. 56(c)(1)(B). A dispute is genuine when the nonmovant cites "evidence on which the jury could reasonably find" in her favor. Anderson, 477 U.S. at 252, 106 S.Ct. 2505.

Hill argues that there are material facts in genuine dispute regarding all counts. On Count One, Hill posits a genuine dispute regarding whether Hill's supervisor had a need to know the information within Hill's security file in order to determine Hill's ability to continue in a security-sensitive position and whether Kane reviewed the file in connection with an investigation of an alleged breach of security by Hill in 2006. Pl.'s Opp'n at 6. On Counts Two through Eleven, Hill contends that there are genuine disputes regarding whether, by virtue of Hill's receipt of the ROI in 2008 and the deposition testimony in early 2009, Hill knew or should have known of the disclosures associated with the three e-mails more than two years before she filed her complaint. Id.

I. STATUTE OF LIMITATIONS

Actions under the Privacy Act must be brought "within two years from the date on which the cause of action arises." 5 U.S.C. § 552a(g)(5). "[T]he cause of action does not arise and the statute of limitation does not begin to run until the plaintiff knows or should know of the alleged violation." Tijerina v. Walters, 821 F.2d 789, 798 (D.C.Cir.1987) (emphasis added). To determine when a plaintiff "`knows or should know'" of a Privacy Act violation, courts inquire whether a plaintiff has received adequate notice that an agency or its employees are engaged in practices inconsistent with the agency's obligations under the Act. Farrero v. NASA, 180 F.Supp.2d 92, 95-97 (D.D.C.2001) (quoting Tijerina, 821 F.2d at 798). A plaintiff need not actually know the exact details of the violative practices or be aware of exact documents improperly maintained or disclosed in order for the cause of action to "arise" for statute of limitations purposes. See id. at 95 (noting that "the statute of limitations does not require actual knowledge of the alleged violation"). In Tijerina, the D.C. Circuit recognized that the "[Privacy] Act seeks to provide a remedy for governmental conduct that by its very nature is frequently difficult to discover." Tijerina, 821 F.2d at 797. The court, however, did not trace the inception of a cause of action to the plaintiffs receipt of the disclosure alleged to be in violation of the Act. Rather, the court reasoned that "[a]n authorized, unconsented-to disclosure ... is unlikely to come to the [plaintiffs] attention until it affects him adversely[.]" Id. The plaintiff in Tijerina was deemed to have reason to know that the Veterans Administration had disclosed allegations of his misconduct to a state board of bar examiners when the board notified him that it had scheduled a hearing to consider the allegations. Id. at 797-98.

In order to determine when the statute of limitations begins to run, courts in this circuit have accordingly focused on a plaintiffs awareness that a disclosure has occurred, rather than knowledge of precise details of the disclosure. In Farrero, for example, the court considered a former federal employee's claims that an agency violated the Privacy Act by "fabricating and maintaining false information about him and by releasing it to other agencies." Farrero, 180 F.Supp.2d at 93. The employee and the agency had been in discussions regarding the employee's suspension and subsequent reinstatement, during which the employee had been notified of reports that he had threatened and assaulted other agency employees. Id. at 93-94. The crux of the employee's Privacy Act case was that the agency had created and distributed records including the reports of this alleged misconduct, reports the employee contended were false. The court found a letter sent to the employee by human resources sufficient to put him on notice of the alleged violations where the letter, summarizing discussions of a telephone conference regarding the personnel actions, stated that "[one conference participant] informed you that his attention has been called to certain documents which cause concern regarding your conduct around the time of your resignation." Id. at 96. Even though the letter did not describe with specificity the documents referred to, and even though the employee may not have known what specific errors those documents may have contained, the court concluded that, under the circumstances, "the plaintiff knew, or should have known, [by the date of the letter] that the defendant kept records on him that he believed to be erroneous." Id. at 97. The court dismissed the action as untimely because it was filed more than two years after the plaintiff received the letter. Id.

When multiple violations of the Privacy Act are alleged, an event might put a plaintiff on notice of some but not all of the violations. This is particularly so where, as here, a plaintiff's cause of action arises under 5 U.S.C. § 552a(b), the provision prohibiting unconsented dissemination of protected information. Unlike a Privacy Act claim alleging, for example, maintenance of false records, an improper disclosure generally takes place at a distinct time. Each disclosure of protected information represents a separate violation of the Privacy Act. 5 U.S.C. § 552a(b) (prohibiting agency disclosure of "any record" contained in a system of records without consent of the subject of the records); see also Pilon v. U.S. Dep't of Justice, 73 F.3d 1111, 1124 (D.C.Cir.1996) ("Our review of the Privacy Act's purposes, legislative history, and integrated structure convinces us that Congress intended the term `disclose' to apply in virtually all instances to an agency's unauthorized transmission of a protected record[.]"); Oja v. U.S. Army Corps of Eng'rs, 440 F.3d 1122, 1132-34 (9th Cir.2006) (concluding that posting protected information on a website is a "single, discrete act" that triggers the statute of limitations for Privacy Act claims, and that publishing the same information at a different internet address constitutes a separate and distinct publication triggering a separate limitations period). "[I]n interpreting the terms of the Privacy Act," the D.C. Circuit has "taken particular care not to undermine the Act's fundamental goals." Pilon, 73 F.3d at 1118. Accordingly, in determining when the statute of limitation begins to run on multiple distinct claims, the inquiry into when the "cause of action arises," 5 U.S.C. § 552a(g)(5), should distinguish carefully among distinct disclosures because each gives rise to potential liability. In light of these principles, certain counts of Hill's complaint are time-barred, while others might not be.

A. Counts Ten and Eleven

Counts Ten and Eleven are based on Hill's allegations that Spanheimer e-mailed to Kane a copy of Hill's response to the first proposed removal on May 23, 2007 and a copy of the second proposed removal on June 11, 2007, respectively. The DoD argues that these counts are time-barred because Hill knew or should have known about the disclosures over two years before she filed her complaint in 2011 since in June 2008, Hill received copies of the emails as part of a string of e-mail communications between Kane and Spanheimer concerning Hill, and because Kane provided deposition testimony about the disclosures on February 11, 2009.5 Hill argues that it was "not readily apparent from the face of the exhibit [received in 2008] that Spanheimer actually transmitted the documents to Kane in the email chain as there are no icons or other indicia that documents were attached to the e-mails." Pl.'s Opp'n at 15. She further maintains that "[o]nly once [she] received different copies of the same e-mail chain on February 26, 2009, was it readily apparent that Spanheimer transmitted the Privacy Act protected documents to Kane." Id.

1. Count Ten

The May 23, 2007 e-mail from Spanheimer to Kane of which Hill received a copy in 2008 is titled "RE: Update" and includes three short paragraphs, the last of which says "Here's a little light reading for you — a poorly written misrepresentation of the facts — enjoy." The next e-mail in the string, sent from Kane to Spanheimer on the same day, begins "Thanks for a copy of the reply." Defs.' Mot., Attach. B, ROI at 308. Another e-mail in the string that was also sent to Kane by Spanheimer on May 23, 2007, Def.'s Reply, Attach. C, Feb. 11, 2009 Kane Dep. ("Kane Dep.") at 64:19-65:18, made reference to Spanheimer planning to send Kane a copy of Hill's reply, Defs.' Mot., Attach. B, ROI at 309 (the email concluding "I'll get you the written reply shortly"). The e-mail about Kane's receiving Hill's response to the first proposed removal said "They finally delivered on Monday morning. I'll scan it and send it separately. It was crap." Kane Dep. at 66:8-10. Hill knew or should have known from the copy of the e-mail received in June 2008, more than two years before she filed her complaint, that Spanheimer had disclosed to Kane a copy of Hill's reply to the first proposed removal. Although the June 2008 copy of the e-mail did not include an icon indicating that Hill's response was attached, Kane's response to the e-mail thanking Spanheimer for a "copy of the reply" makes it sufficiently clear that Spanheimer had transmitted something. Moreover, references in the previous e-mail sent the same day, of which Hill had a copy in 2008, to "scan[ing] it and sen[ding] it separately" and "get[ting] [Kane] the written reply shortly[,]" Defs.' Mot., Attach. B, ROI at 309, provide ample context to have enabled Hill to understand that the May 23, 2007 email disclosed her response to the first proposed removal. There is no genuine dispute about the facts demonstrating that Hill knew or should have known about the disclosure underlying Count Ten more than two years before she filed her complaint.

2. Count Eleven

The claim based upon the June 11, 2007 disclosure is time-barred for similar reasons. The copy of the e-mail that Hill received in June 2008 was entitled "New Proposal to Remove" and begins "Here's the new draft removal proposal (14 pages!)." Defs.' Mot., Attach. B, ROI at 307. Although the June 2008 copy did not include an icon revealing an actual attachment, the subject line of the e-mail and its body reflect that Spanheimer was sending Kane an actual document. Kane's short, same-day response to Spanheimer's e-mail further confirms that a document was transmitted. Kane responded "I made some edits — mostly minor." Id. Having received a copy of these communications, Hill knew or should have known in June 2008 about the disclosure underlying Count Eleven. In light of this evidence, Hill has not shown a genuine dispute about which a jury could reasonably find that she did not know or should not have known of the disclosure of the second proposed removal more than two years before she filed her complaint.6

B. Counts Two through Nine

Counts Two through Nine are based on the disclosure of seven documents relating to leave policies and decisions regarding Hill that were all attached to an e-mail sent by Spanheimer to Kane on May 14, 2007. Unlike the two e-mails that are discussed above, the May 14 e-mail was not included in the ROI that Hill received in June 2008, and they were not discussed specifically in the depositions that took place in early 2009. The DoD nonetheless argues that the counts are time-barred because the e-mail chain that Hill did receive in 2008 put Hill on notice that Spanheimer and Kane were communicating extensively about Hill outside the chain of the command, thereby triggering the statute of limitations for Counts Two through Nine. Defs.' Reply at 8-12. Hill maintains that the statute of limitations was not triggered in 2008 because none of the e-mails that she received in discovery then indicates or suggests that the documents underlying Counts Two through Nine were disclosed.

Although the e-mail chain, as well as deposition testimony by Kane and by Spanheimer in early 2009, make it clear that "there was contact between Plaintiff's current and former supervisors on the leave and work schedule issues that relate to the attachments to the May 14, 2007 email at issue[,]" id. at 10, there is a triable issue whether either the e-mails or the deposition testimony sufficed to alert Hill that leave-related documents had been disseminated in potential violation of the Privacy Act. The first e-mail in the chain that Hill received in 2008 was from Kane to Spanheimer, is entitled "Update" and dated May 22, 2 007, and states "Sorry to bug you but I'm dying to know what happened with the Maureen [Hill] meeting on Mon?" Defs.' Mot., Attach. B, ROI at 309. Kane's request to "know what happened" at a meeting regarding Hill does not establish that any disclosure of personnel files occurred before that communication. Moreover, the deposition testimony that was taken in early 2009 reflects only that Kane and Spanheimer had discussed Hill's absences from work, but does not make clear that protected information was disclosed. In a January 7, 2009 deposition, Hill's counsel elicited from Spanheimer only general admissions that Spanheimer and Kane had discussed leave issues. For example:

Defs.' Reply, Attach. D, Spanheimer Dep. ("Spanheimer Dep.") at 53:11-17, 53:21-54:2.

Reasonable jurors, however, could disagree on whether Hill should have known from this testimony that protected personnel information had been disclosed. Although a plaintiff need not actually know what precisely was disclosed in order to be charged with knowledge of potential Privacy Act violation, and accordingly to trigger the statute of limitations, the limitations period does not begin to run until the plaintiff has fair notice that some disclosure has occurred. On the one hand, knowledge of oral communications between Kane and Spanheimer regarding Hill's absences from work could have sparked Hill's suspicions such that she could have brought a Privacy Act case against the DoD alleging generally that Spanheimer disclosed to Kane protected documents relating to leave. See, e.g., Diliberti v. United States, 817 F.2d 1259, 1263-64 (7th Cir.1987) (affirming dismissal of Privacy Act claim where "[t]he hearsay and rumors which the plaintiff described in his affidavit were enough to put him on notice of the possible existence of the records at issue here and to impose upon him a duty to inquire into the veracity of those rumors for purposes of bringing an action under the Privacy Act"). A complaint stating a general allegation of improper disclosures between Kane and Spanheimer might well state a plausible claim to relief. See, e.g., Kvech v. Holder, Civil Action No. 10-545(RLW), 2011 WL 4369452, at *3 (D.D.C. Sept. 19, 2011) (denying motion to dismiss claim for unauthorized disclosure where plaintiff alleged that agency improperly disclosed "`details concerning Plaintiff's administrative' investigation and provided [an agency official] with `selective records,'" and that "`on information and belief" agency officials "`made repeated disclosures as to the status and results of the investigation' to `persons as yet unknown' in the [agency]") (quoting complaint).

On the other hand, Hill could also have known only that Kane and Spanheimer were discussing Hill's absences from work in general terms, without implicating protected information. Hill argues that "the testimony only indicates that Spanheimer verbally conveyed knowledge about Plaintiff to Kane, which is not a violation under the Privacy Act." Pl.'s Surreply at 2. In the January 7, 2009 deposition, Spanheimer for example stated "I'm sure I conveyed to [Kane] a great deal of frustration with Ms. Hill. (Pause) I probably conveyed to him my sense that Ms. Hill is probably capable of doing the job but spends most of her time avoiding the job." Spanheimer Dep. at 71:11-15. With justifiable inferences drawn in favor of the nonmovant, the DoD has not established that Counts Two through Nine are time-barred as a matter of law.

II. NEED-TO-KNOW EXCEPTION

Hill's complaint alleges that the DoD violated the Privacy Act when the JCOS director of security ordered the retrieval of Hill's security file and then invited Hill's then-supervisor Kane to read through Hill's security file "without reason or knowledge of what Kane would do with the information." Compl. 111118-21, 66. Notwithstanding the Privacy Act's general prohibition of an agency's unconsented disclosure of personnel files, the Act permits agency disclosure to individuals with "a need for the record in the performance of their duties[.]" 5 U.S.C. § 552a(b)(1). To determine whether the exemption applies, courts inquire "whether the official examined the record in connection with the performance of duties assigned to him and whether he had to do so in order to perform those duties properly." Bigelow v. Dep't of Defense, 217 F.3d 875, 877 (D.C.Cir.2000). In Bigelow, the D.C. Circuit considered whether a Defense Department employee's supervisor had a need to know information in the employee's security file to determine whether the employee should be retained in a sensitive position with the Joint Chiefs of Staff. The court found that the Department's regulations recognized that supervisors have a continuing duty to evaluate whether their employees properly handle classified material and other sensitive information and tasks. Department of Defense regulations authorize "access to personnel security investigative reports" for "those designated DoD officials who require access in connection with specifically assigned personnel security duties," 32 C.F.R. § 154.67(b), and for specified activities such as "determining eligibility of DoD ... civilian personnel... for access to classified information, assignment or retention in sensitive duties or other specified designated duties requiring such investigations," id. § 154.65. The D.C. Circuit further has acknowledged that under the regulations, "[a]n `individual's trustworthiness is a matter of continuing assessment,' and the `responsibility for such assessment must be shared by the organizational commander or manager, [and] the individual's supervisor[.]'" Bigelow, 217 F.3d at 877 (quoting 32 C.F.R. § 154.60(a)) (emphasis added).

In the complaint, Hill asserted that she learned of the disclosure in May of 2009 when in the course of separate litigation, Kane testified under oath "that he had accessed and read [Hill's] security file through the actions of Langerman." Compl. ¶ 52. The DoD contends that the sworn testimony to which Hill refers establishes that Kane reviewed Hill's file in connection with his investigation of an alleged breach of security by Hill, specifically, an allegation that Hill had provided her login and password to someone else while Hill was out of the office. Defs.' Mem. at 14; id., Attach. A, May 27, 2009 Kane Dep. ("May 27 Kane Dep.") at 68:22-69:6. Kane stated in the deposition that Langerman invited him to review the file because "there was a question of a security violation, and when one of those things occurs, one has to make a determination what action should be taken in the wake of it[,]" including possibly revoking an employee's security clearance. May 27 Kane Dep. at 84:3-6. Kane also said, "as Ms. Hill's supervisor, I was the one who had to make the recommendation or the decision about revocation of the security clearance." Id. at 67:9-11; see also id. at 84:11-13 ("I would have to make the proposal to revoke a security clearance. I wouldn't make the final decision on it."). Hill alleges that Kane's deposition testimony should not be credited and that there are genuine issues of material fact regarding Kane's motivation in reviewing the security file. Specifically, Hill argues that Kane acknowledged in his deposition that he never asked Hill about the alleged security breach, that he had never looked at an employee's security clearance before, that the information technology department had denied his request for a forensic review of Hill's computer, and that he failed to notify anyone in his chain of command that he had accessed Hill's security file until after the fact. Pl.'s Opp'n at 9-10.

The doubts about Kane's motivation that Hill posits fail to create a genuine dispute whether he had a need to know the information that Langerman invited him to review. At the time that Kane reviewed the security file, he was serving as Hill's supervisor. In Bigelow, the D.C. Circuit affirmed summary judgment for the employer in the face of a claim, analogous to Hill's, that a supervisor violated the Privacy Act when the plaintiff's supervisor "examine[d] the [plaintiffs] file in view of the doubts that had been raised in his mind about [plaintiff] and [plaintiffs] access to the country's top secrets." Bigelow, 217 F.3d at 877. The circuit cited the arguments of the government and the supervisor's declaration "assur[ing] [the court]... that [the supervisor's] duties entailed examining [plaintiffs] personnel security file because [plaintiff] was under his supervision." Id. at 876. Substantially similar facts exist here, where the DoD's brief and Kane's deposition testimony maintain that as Hill's supervisor, Kane was tasked with assessing her trustworthiness. Although Hill is entitled to have all justifiable inferences drawn in her favor, it is not justifiable to infer, as Hill urges, a triable issue that Kane did not have a need to know the information in Hill's security file because "Kane was working independently and without authority to trump up a reason to fire [Hill]." Pl.'s Opp'n at 11. As the Bigelow court recognized, Defense Department regulations provide the authority for supervisors responsible for sharing in decisions about suspending security clearances to independently review security files of their subordinates holding clearances.

Courts "determine[] the existence of a need to know objectively, based on the facts alleged[,]" and the examining official's "subjective intent is therefore immaterial." Doe, 660 F.Supp.2d at 47 n. 6; see also Hanna v. Herman, 121 F.Supp.2d 113, 123-24 (D.D.C.2000) (assessing objective facts to conclude that agency official who received information about plaintiff's demotion, in alleged violation of the Privacy Act, "would be covered by the `need to know' exception as a matter of law" because she was a supervisor at plaintiffs agency, even though she was not the plaintiffs supervisor). The facts alleged are that Kane looked at Hill's file in response to an invitation by the director of security. The Defense Department regulations provide specifically that an individual's supervisor has a responsibility to perform a "continuing assessment" of an employee's trustworthiness, 32 C.F.R. § 154.60(a), and that "access to personnel security investigative reports" under 32 C.F.R. § 154.67(b) is authorized for those who determine whether an employee should retain "access to classified information" or continue in "sensitive duties[,]" 32 C.F.R. § 154.65. As in Bigelow, these regulations establish that Kane had a "need to know" what was in Hill's security file to fulfill his ongoing duty to assess Hill's fitness to continue in sensitive employment. The DoD therefore is entitled to judgment as a matter of law on Count One.

CONCLUSION AND ORDER

Kane's review of Hill's security file in 2006, when Kane was serving as Hill's supervisor, did not violate the Privacy Act because the Act permits agency disclosure to individuals with a need for the record in the performance of their duties. Genuine issues of material fact exist as to whether Hill knew or should have known of the disclosures on May 14, 2007 from Spanheimer to Kane, after Kane had ceased supervising Hill. The undisputed facts, however, establish that Hill knew or should have known of the disclosures from Spanheimer to Kane on May 23, 2007 and June 11, 2007 more than two years before Hill filed her complaint. Accordingly, it is hereby

ORDERED that the DoD's motion [7] to dismiss, treated as a motion for summary judgment, be, and hereby is, GRANTED in part and DENIED in part. Judgment is granted to the DoD on Counts One, Ten, and Eleven. The motion is denied as to the remaining counts. It is further

ORDERED that the parties confer and prepare redacted versions of their motions papers and this memorandum opinion suitable for filing on the public docket, and attach them to a sealed motion for approval to file them publicly. The sealed motion is due by September 6, 2013. It is further

ORDERED that the Clerk substitute the Department of Defense as the sole defendant.