Plaintiff-Appellant John R. Williams, Jr. appeals from a final judgment determining that materials he requested pursuant to the Privacy Act of 1974, 5 U.S.C. § 552a, were draft documents and not "records" within the meaning of the Act and, as such, were not records that were kept in the normal "system of records." Nevertheless, these materials were substantially "about" Williams. The statutory language, legislative history, and case law indicate no exception for requested access to "drafts." We reverse the legal determination that the requested materials were not "records" within the meaning of 5 U.S.C. § 552a(a)(4).

The determination of whether these records are contained within a "system of records" is much more problematic and cannot be properly resolved on the record before us. The nature of Defendant-Appellee Department of Veterans Affairs's (DVA's) system of records, as well as its storage and retrievability characteristics in practice, are too uncertain. Therefore, we vacate the judgment below and remand for further factual development.

John R. Williams, Jr. is a Vietnam veteran who suffers from posttraumatic stress disorder. He sought treatment at the DVA's Vet Center in Springfield, Virginia, in the fall of 1992. In February 1993, he phoned and wrote to the director of the Center to complain about the conduct of his psychologist. Dr. W. Sherod Williams was assigned to investigate Appellant Williams's complaints.1 As part of the investigation, Dr. Williams wrote a summary of his review, called a Report of Contact, and drafted a letter to Appellant Williams that contained his conclusions and gave suggestions to Appellant Williams about the future course of his treatment. The record contains two versions of this draft letter.

Although Dr. Williams promised to provide Appellant Williams with a copy of the letter on or around February 18, 1993, Dr. Williams did not receive approval from his supervisors to do so, apparently because the letter was critical of the DVA. For the next several months thereafter, Appellant Williams made various attempts to obtain copies of the material prepared by Dr. Williams related to the investigation, invoking both the Freedom of Information Act and the Privacy Act. On April 8, 1993, Appellant Williams was informed that no letter could be found, and on April 14 that the draft of "findings" had, in fact, been destroyed.

Although Dr. Williams had apparently not retained paper copies of the materials, on or about April 30 and May 3, he discovered he did possess them as computer files. One version of the letter to Appellant Williams was discovered in a floppy disk box in the "clinical" section, on a floppy disk titled "clinical correspondence," under the filename "WILLIAMS.LTR". A second version of the letter was discovered on an unlabeled floppy disk under the filename "WILLIAMS.LTR", presumably in the disk's main directory. A draft of the Report of Contact (ROC) was discovered on an unlabeled floppy disk with the filename "228.ROC", also presumably in the disk's main directory. The actual content of the ROC refers to Appellant Williams's assigned client number, "Client # 0402". In addition, one version of the letter was found on the hard disk of the office's network server (called by the DVA the "transporter") in drive "c:" in the "wp51" (WordPerfect 5.1) directory under the filename "WILLIAMS.LTR".

On May 24, 1993, Appellant Williams was informed about the existence of these computer files. However, he was denied access to this material. The DVA's stated ground for the denial was that

since the records you are seeking are not retrieved by either your name or other identifier assigned to you, and since the records you seek are not contained in any file that is retrievable by your name or other identifier assigned to you, your appeal is not subject to consideration under the Privacy Act of 1974.

J.A. at 111.

On November 22, 1994, Appellant Williams filed a three-count complaint against the DVA, including in Count II, the issue on appeal here, allegations of violations of the Privacy Act for refusal to comply with Appellant Williams's records request and seeking injunctive relief, damages, costs, and attorney's fees. The draft letters and Report of Contact were provided to Appellant Williams during discovery.2 Both parties filed motions for summary judgment on Count II and both were denied. Following a bench trial, judgment was pronounced in favor of the DVA on all counts.

The legal issues on appeal are whether the materials Appellant Williams requested were (1) "records" and (2) if so, were records within the "system of records" maintained by the DVA within the meaning of 5 U.S.C. § 552a(a) and thus subject to disclosure under the Privacy Act. Appellant Williams contends that the district court erred because the requested documents concerned him and were retrieved by accessing his name or assigned client number from a computer disk, thereby falling within the broad terms of the Act. The DVA maintains that the materials Appellant Williams sought were neither his "records" nor contained within the DVA's "system of records."

Appellant Williams instituted the present action pursuant to the Privacy Act, 5 U.S.C. § 552a(g)(1), which grants federal jurisdiction. See also 28 U.S.C. § 1331. This appeal arises from a final decision below, and thus we possess appellate jurisdiction under 28 U.S.C. § 1291. This appeal involves questions of law, which we review de novo. Bose Corp. v. Consumers Union of the United States, Inc., 466 U.S. 485, 104 S. Ct. 1949, 80 L. Ed. 2d 502 (1984); Waters v. Gaston County, N.C., 57 F.3d 422, 425 (4th Cir.1995) ("We review the district court's legal conclusions de novo and its factual findings for clear error.").

(d) Access to records.--Each agency that maintains a system of records shall--

(1) upon request by any individual to gain access to his record or to any information pertaining to him which is contained in the system, permit him ... to review the record and have a copy made of all or any portion thereof in a form comprehensible to him....

5 U.S.C. § 552a(d)(1). The access provision is thus confined to records or information within a system of records. Manuel v. Veterans Admin. Hosp., 857 F.2d 1112, 1116 (6th Cir.1988), cert. denied, 489 U.S. 1055, 109 S. Ct. 1317, 103 L. Ed. 2d 586 (1989). The Act defines "record" and "system of records" as follows:

(4) the term "record" means any item, collection, or grouping of information about an individual that is maintained by an agency, including, but not limited to, his education, financial transactions, medical history, and criminal or employment history and that contains his name, or the identifying number, symbol, or other identifying particular assigned to the individual, such as a finger or voice print or a photograph;

(5) the term "system of records" means a group of any records under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual....

5 U.S.C. § 552a(a)(4), (5).

In general, courts have been lenient in determining what information constitutes a "record" within the meaning of the Act. See, e.g., Quinn v. Stone, 978 F.2d 126, 131-33 (3d Cir.1992) (finding that both the information on a hunting roster and on a time card were "records" within the meaning of the Privacy Act); Bartel v. Federal Aviation Admin., 725 F.2d 1403, 1407-1411 (D.C.Cir.1984) (finding that letters sent by FAA official that indicated that plaintiff employee had improperly obtained access to files of FAA inspectors, although not themselves agency records, did not, as a matter of law, bar claim that Privacy Act's disclosure provisions had been violated); Boyd v. Secretary of the Navy, 709 F.2d 684, 686 (11th Cir.1983) (finding that supervisors' memorandum reflecting employee's failure to follow the chain of command was a "record" within the meaning of the Privacy Act), cert. denied sub nom. Boyd v. Lehman, 464 U.S. 1043, 104 S. Ct. 709, 79 L. Ed. 2d 173 (1984); cf. Manuel, 857 F.2d at 1116-17 (assuming, without deciding, that two Veterans Administration Reports of Contact generated by undercover investigators were records); Cuccaro v. Secretary of Labor, 770 F.2d 355, 360 (3d Cir.1985) (assuming, without deciding, that investigative files compiled as a result of plaintiff's complaints were records); Brooks v. Veterans Admin., 773 F. Supp. 1483, 1486 (D.Kan.1991) (finding that information that "an unidentified doctor supported or failed to support an employee's disability retirement application is an item of 'information about an individual' which is covered by the Privacy Act"); but see Bowyer v. United States Dep't of Air Force, 804 F.2d 428, 431 (7th Cir.1986) (finding that "private notes are not subject to the requirements of the Privacy Act" but that "once the notes are used by the agency to make a decision concerning an individual's employment status, the notes become subject to the provisions of the Act"); Johnston v. Horne, 875 F.2d 1415, 1423 (9th Cir.1989) (same). Nevertheless, the DVA asserts that what Appellant Williams sought were not his "records," but rather were "the results of an investigation into the conduct of VA personnel." Brief of Appellee at 16.

To this end, the DVA relies on Tobey v. NLRB, 40 F.3d 469 (D.C.Cir.1994), in which the court drew a distinction between, on the one hand, information that is "about" an individual, i.e. that "actually describes the individual in some way," and to which the Act applies and, on the other hand, information that simply "applies to" the individual by containing the individual's name and to which the Act does not apply. Id. at 471-72. Whether the Tobey court's distinction be accepted, the legislative history of the Act makes it clear that a "record" was meant to "include as little as one descriptive item about an individual." Analysis of House and Senate Compromise Amendments to the Federal Privacy Act, reprinted in Legislative History of the Privacy Act of 1974: Source Book on Privacy, at 866 (1976) (hereinafter Source Book ). Moreover, neither the Act itself, its legislative history, nor case law interpreting it indicates that a record's status as a "draft" somehow removes it from the Act's purview.3 Indeed, were that the case, agency bureaucrats could too easily circumvent the purposes of the Act by stamping all records "Draft."

An examination of the two versions of the letter from Dr. Williams to Appellant Williams and of the draft ROC plainly reveals that these materials substantially pertain to Appellant Williams. They clearly contain "information about" Appellant Williams, as well as his "name" or "identifying number," 5 U.S.C. § 552a(a)(4), and do more than merely apply to him. These materials discuss his medical history, clinical observations concerning him, suggested past therapies that were not undertaken, a possible future course of treatment, and information pertaining to his personal relationships. Given the language of the Act itself and the intent behind the words, we find that the documents sought by Appellant Williams were "records" within the meaning of 5 U.S.C. § 552a(a)(4).

Whether these records were within the DVA's "system of records" and thus subject to the Act's access provision is a much more difficult problem. Courts have construed § 552a(a)(5) narrowly. See, e.g., Henke v. United States Dep't of Commerce, 83 F.3d 1453, 1459-61 (D.C.Cir.1996) (finding that retrieval capability is not the test since Congress's use of the words 'is retrieved' "suggest[s] strongly that a group of records should generally not be considered a system of records unless there is actual retrieval of records keyed to individuals" (emphasis added)); Baker v. Department of Navy, 814 F.2d 1381, 1384 (9th Cir.) (stating that "the definition of 'system of records' makes coverage under the Act dependent upon the method of retrieval of a record rather than its substantive content"), cert. denied, 484 U.S. 963, 108 S. Ct. 450, 98 L. Ed. 2d 390 (1987); Boyd v. Secretary of the Navy, 709 F.2d 684, 686 (11th Cir.1983) (finding that "a record must be maintained by the agency in a group of records cued to the requestor" (citations omitted)), cert. denied sub nom. Boyd v. Lehman, 464 U.S. 1043, 104 S. Ct. 709, 79 L. Ed. 2d 173 (1984); Savarese v. United States Dep't of Health, Educ. and Welfare, 479 F. Supp. 304, 307 (N.D.Ga.1979) (holding that neither a reading file nor a program file, since not keyed to retrieval by names or identifiers, were systems of records under the Act), aff'd sub nom. Savarese v. Harris, 620 F.2d 298 (5th Cir.1980), cert. denied, 449 U.S. 1078, 101 S. Ct. 858, 66 L. Ed. 2d 801 (1981); Smiertka v. United States Dep't of Treasury, 447 F. Supp. 221, 228-29 (D.D.C.1978) (holding that daily reports prepared by agency investigator were not records within a system of records since they were retrievable by the investigator's identifier and not accessed by plaintiff's name), vacated and remanded on other grounds, 604 F.2d 698 (D.C.Cir.1979); cf. Manuel v. Veterans Admin. Hosp., 857 F.2d 1112, 1117 (6th Cir.1988) (finding that two Reports of Contact, and a third report, were not within the VA's system of records under any name), cert. denied, 489 U.S. 1055, 109 S. Ct. 1317, 103 L. Ed. 2d 586 (1989); but see Bowyer v. United States Dep't of Air Force, 804 F.2d 428, 431-32 (7th Cir.1986) (finding that there was a factual question as to whether memos kept by supervisor on employee, that were in fact retrieved, were somehow keyed to employee's name). This narrow construction is further supported by OMB's Guidelines for Implementing Section 552a of Title 5 of the United States Code which states:

The definition of "system of records" limits the applicability of some of the provisions of the Act to "records" which are maintained by an agency, retrieved by individual identifier (i.e., there is an indexing or retrievel [sic] capability using identifying particulars ... built into the system), and the agency does, in fact, retrieve records about individuals by reference to some personal identifier.

Source Book at 1027 (emphasis in original). The United States Court of Appeals for the District of Columbia Circuit has recently relied on this language in determining that retrieval in practice and not retrieval capability is essential in order for a system of records to exist. See Henke, 83 F.3d at 1460 n. 12.

This close textual reading by courts of the statutory language and OMB implementing guidelines appears to focus on the trees at the expense of the forest. The careful analysis by the Henke court, for example, is suffused with the sense that the language of the Act is not so plain after all, but rather is ambiguous, although the court never comes out and says so. See id. at 1459-61. And while the OMB guidelines are useful as a general starting point, OMB is not the agency charged with the administration of the Privacy Act in this matter. Naturally, no agency or court, as it seeks to construe the Act, can escape the fact that there is no legislative history on why Congress chose the phrase "is retrieved." However, context for interpreting the statutory language, see King v. St. Vincent's Hosp., 502 U.S. 215, 221, 112 S. Ct. 570, 574, 116 L. Ed. 2d 578 (1991) (stating that "the meaning of statutory language, plain or not, depends on context"), is available on the larger scale. The Senate Report on the Privacy Act makes it clear that Congress's intent was much more expansive than the narrow construction heretofore given:

No exemption from or qualification of the right of data subjects to have full access to their records should be granted unless there is a clearly paramount and strongly justified societal interest in such exemption or qualification.... The instances in which it can be convincingly demonstrated that there is a paramount society [sic] interest in depriving an individual of access to data about himself would seem to be rare.

S.Rep. No. 1183, 93rd Cong., 2d Sess. (1974), reprinted in 1974 U.S.C.C.A.N. 6916, 6935 (quoting and adopting the report of the HEW Secretary's Advisory Committee on Automated Personal Data Systems).

With this broad intent in mind, and giving due deference to the statutory language, Appellant Williams's claim that his records "were in fact retrieved by accessing Plaintiff's name and personal identifier number," Brief of Appellant at 14, is very colorable, especially since all versions of Dr. Williams's letter to him possessed the filename "WILLIAMS.LTR". However, the question of whether these records were within a "system of records" remains. Unfortunately, we cannot properly determine this issue on the record before us.

Although not addressed below or by the parties on this appeal, the DVA has, in fact, established a formal system of records, 32VA00, titled "Veteran, Employee and Citizen Health Care Facility Investigation Records-VA" that includes as a category of individuals covered by the system "[v]eterans and private citizens who have alleged abuse by members of the health care facility staff." 2 Privacy Act Issuances, 1991 Compilation, 946. The categories of records in the system include "[c]opies of reports of investigations, findings, and follow-up concerning ... patients ..., complaints, ... unethical conduct, etc." Id. The letters and ROC of Dr. Williams, following from Appellant Williams's complaint about the conduct of his psychologist, including breaches of confidentiality, thus arguably fit within this system of records. Indeed, the existence of the 32VA00 system of records supports our conclusion above that these materials are, in fact, "records" within the meaning of § 552a(a)(4). The stated policies and practices for storage are "Paper documents and Photographs" and for retrievability are "Alphabetically by name." Privacy Act Issuances, supra, at 946. These policies and practices, however, have remained unchanged since the establishment of this system of records in the mid-1970s, see, e.g., 42 Fed.Reg. 49726, 49743 (1977); 41 Fed.Reg. 37718 (1976), that is, before the advent of the personal computer and floppy disks. It is an unanswered question of fact as to whether in 1993 the DVA only stored records within the 32VA00 system of records as paper documents or whether some or all of the records were then stored in digital format. Even though not directly at issue in this case, our suspicion has been raised as to whether the DVA has complied with its statutory duty to publish in the Federal Register any revisions in the character of its systems of records. See 5 U.S.C. § 552a(e)(4). Although we do not intend the analogy to be exact, surely at some point federal agencies must acknowledge that computer files are like paper documents, floppy disks are like file folders, and hard drives are like file cabinets.

It is also questionable whether an agency that assigns individuals client identification numbers, as the DVA did for Appellant Williams here, would have for its only method of retrievability "alphabetically by name." Yet notwithstanding this, it is undisputed that the filename of the draft ROC by Dr. Williams was "228.ROC". This filename is thus directly accessible by neither Appellant Williams's name nor client number. Nevertheless, common computer utility programs exist that can locate the occurrence of names or client numbers even if not contained in the filename. We find the narrow Henke rationale--that since this document was not in practice actually retrieved "by the name of the individual or by some identifying number," 5 U.S.C. § 552a(a)(5), it cannot be a record within a "system of records"--unconvincing in these circumstances where there appears to exist already a formal system of records of which the ROC may be a part; where it appears that the published characteristics of the agency's formal system of records have not kept current with advances in and typical uses of computer technology, even by government standards; and where, in general, the record we review is poorly developed on this point.4 Instead, we believe it is more important in this posture to be animated by the spirit of the Privacy Act. The foresight exhibited in the Act's raison d'etre, to provide for protection against possible abuses of governmental power to affect an individual's privacy and confidential information, has become only more manifest as our society enmeshes itself ever more deeply into the Information Age. Thus because the ROC can be retrieved by Appellant Williams's client number, and may in fact have been so, we vacate the judgment of the district court and remand. We naturally make no pronouncement on the merits of whether the ROC is, in fact, within the DVA's system of records; that is for the district court to determine on remand. We simply do not wish to foreclose the possibility on the incomplete record before us.

In addition to this disposition of the draft ROC, we also vacate the judgment below and remand for further factual findings with respect to the two versions of the letter addressed to Appellant Williams from Dr. Williams. Among those aspects needing further development are the nature of the 32VA00 system of records, how records are stored in practice (in paper or digital form or both), and how records are retrieved in practice (by client name or identifying number via filename or file number; utility program or search engine; or other means). Until these things are determined, it is not possible to properly decide whether either version of the letter, and perhaps the ROC as well, is within the "system of records" since it is clear that, at least as computer files, stored on both labeled and unlabeled floppy disks as well as on the DVA's network server, all versions were retrieved by Appellant Williams's name.

For the foregoing reasons, we reverse the district court's legal determination that the materials Appellant Williams requested were not "records" within the meaning of the Privacy Act, 5 U.S.C. § 552a(a)(4). These materials were substantially "about" Appellant Williams and did more than merely "apply to" him.

We also vacate the judgment below and remand the case for further factual development as to whether the requested records were contained within a "system of records." In particular, the district court should determine the storage and retrievability characteristics in practice of the 32VA00 system of records.

REVERSED IN PART, VACATED, AND REMANDED.