This is an action brought under the Privacy Act, 5 U.S.C. Sec. 552a, by 13 employees at the Hanford Nuclear Reservation. Plaintiffs claim that unlawful disclosures of information in their personnel security files by the Department of Energy (DOE) to the DOE Inspector General (IG) and subsequently to the United States Department of Justice (DOJ) led to criminal prosecutions against them. Although none of those prosecutions resulted in convictions, plaintiffs claim damages consisting of costs and attorney's fees incurred in defense of the criminal prosecutions.

The district court held that disclosure of the personnel security file information to the IG was lawful under the Privacy Act, but that the IG's disclosure of this information to the DOJ was not. The district court then ruled that this violation of the Privacy Act was "willful or intentional," so that damages were appropriate under the Act. See Covert v. Herrington, 667 F. Supp. 730 (E.D.Wash.1987). On appeal, the government challenges all of the rulings of the district court. On cross-appeal, plaintiffs challenge the district court's ruling that disclosure to the IG was lawful. We affirm the judgment of the district court.

* BACKGROUND

As a condition of their employment at the Hanford Reservation, plaintiffs were required to complete and execute forms DOE-1,--"Personnel Security Questionnaire," (PSQ) and Supplement to Form DOE-1. The supplement stated that "personal information on the form(s) will be used to determine eligibility for a DOE personnel security clearance or access authorization." It also provided, in pertinent part, that

[a]ccess to or use of the information provided is permitted only to the authorized Federal Government investigative agencies conducting the investigations and to DOE personnel directly involved in the processing of the determination of the eligibility of the individual for security clearance or access authorization (emphasis added).

In December 1982, Fourth District Congressman Sid Morrison received a letter from a constituent charging that a number of employees at the Hanford Reservation were falsely claiming permanent residences more than 50 miles from the job site in order to obtain per diem subsistence payments from the DOE. To receive such a payment, an employee had to execute a Certificate of Permanent Residence, acknowledging that the signing party understood he was eligible for subsistence payments only during such periods as he maintained two residences--a permanent residence more than 50 miles from the worksite, and a temporary one within 50 miles of the worksite. Plaintiffs all signed such Certificates of Permanent Residence.

The charge that some employees were falsely claiming permanent residences more than 50 miles from the site found its way into the office of the DOE's IG. On September 9, 1985, and on various dates thereafter, agents of the IG, in an attempt to uncover the possible fraud alleged in the letter to Congressman Morrison, examined the personnel security files of the plaintiffs. This examination was undertaken without a written request by or prior consent of plaintiffs. These files were maintained pursuant to the Privacy Act, 5 U.S.C. Sec. 552a.

Following their investigation, the agents of the IG presented a prosecutive report for each named plaintiff to an Assistant United States Attorney for the Eastern District of Washington. Each report contained details of the IG investigations, copies of the Certificates of Permanent Residence signed by the plaintiffs, and copies of Part I of plaintiffs' PSQs. The latter included extensive details regarding present and past residences of the plaintiffs. The IG's disclosure to the DOJ was without written request by, or prior consent of, the individuals to whom the information pertained. The disclosure was not made pursuant to any court order. Nor was it made in response to any request by the DOJ.

We review de novo the district court's ruling that disclosure to the IG did not violate the Privacy Act, since the issue turns on an interpretation of the statute. United States v. McConney, 728 F.2d 1195, 1201 (9th Cir.) (en banc), cert. denied, 469 U.S. 824, 105 S. Ct. 101, 83 L. Ed. 2d 46 (1984).

The relevant portions of the Privacy Act of 1974, 5 U.S.C. Sec. 552a, provide that

(b) No agency shall disclose any record which is contained in a system of records by any means of communication to any other person, or to another agency, except pursuant to a written request by, or with the prior written consent of, the individual to whom the record pertains, unless disclosure of the record would be--

(1) to those officers and employees of the agency which maintains the record who have a need for the record in the performance of their duties; ...

(3) for a routine use as defined in subsection (a)(7) of this section and described under subsection (e)(4)(D) of this section; ...

(7) to another agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States for a civil or criminal law enforcement activity if the activity is authorized by law, and if the head of the agency or instrumentality has made a written request to the agency which maintains the record specifying the particular portion desired and the law enforcement activity for which the record is sought; ...

(11) pursuant to the order of a court of competent jurisdiction.

"Routine use" is defined in subsection (a)(7) as, "with respect to the disclosure of a record, the use of such a record for a purpose which is compatible with the purpose for which it was collected." Subsection (e)(4)(D) requires that "each routine use of the records contained in the system, including the categories of users and the purpose of such use" be published in the Federal Register at least annually as part of "a notice of the existence and character of the system of records...."

In addition, subsection (e)(3)(C) requires that each agency maintaining record systems

(3) inform each individual whom it asks to supply information, on the form which it uses to collect the information or on a separate form that can be retained by the individual--

(C) the routine uses which may be made of this information as published pursuant to paragraph (4)(D) of this subsection; ... (emphasis added).

The district court ruled that disclosure of the PSQ to the agents of the IG was permissible under the "need to know" provision of the Privacy Act, Sec. 552a(b)(1). We agree. The IG is responsible for detection and prevention of fraud or abuse in DOE programs and operations. See 42 U.S.C. Sec. 7138. Even the plaintiffs concede that the IG has the "authority to conduct investigations with respect to promoting economy and efficiency in the administration of programs of DOE, and for the prevention or detection of fraud and abuse." Brief of Plaintiffs-Appellees/Cross-Appellants at 11. Plaintiffs argue, however, that the IG agents did not need to examine the entire PSQ of each plaintiff (which plaintiffs contend they did), but rather only needed to examine the portions of the PSQ relating to a plaintiff's past and present residences. This argument, while appealing on the surface, does not withstand scrutiny. The injuries that plaintiffs allege consist of the costs incurred in the criminal prosecutions. The criminal proceedings, in turn, resulted from the DOJ's awareness of information regarding plaintiffs' residences that was discovered by the IG agents' examination of the PSQs. Thus, even if the entire PSQ of each plaintiff was disclosed to the IG agents, only the disclosure of the residence information allegedly harmed the plaintiffs. And this information the IG needed to know to discharge its duties.1

The district court's ruling that disclosure of the personnel security file information by the IG to the DOJ was unlawful under the Privacy Act is also subject to de novo review, as the question is purely a legal one. The district court, characterizing this issue as "more difficult" than the disclosure to the IG, concluded that the IG's disclosure of parts of the PSQs to the DOJ did not fall within any of the exceptions provided in Sec. 552a. On appeal, the government makes essentially the same argument that the district court rejected below. The government argues that disclosure to the DOJ was authorized under the routine use exception, Sec. 552a(b)(3).2

The district court reasoned that two requirements had to be met by the government before it could invoke the "routine use" exception. First, the government had to show that disclosure was within the scope of an agency's routine use regulations as published in the Federal Register. Second, the government had to show that disclosure of the record must be for a purpose which is compatible with the purpose for which the record was collected. These two requirements come from Sec. 552a(b)(3) and its references to subsection (a)(7) and subsection (e)(4)(D). The government agrees that these two requirements must be met, and argues, contrary to the district court's rulings, that these requirements were in fact met in the instant case.

As to the first question, whether the disclosure to the DOJ was within the scope of the agency's routine use regulation as published in the Federal Register, the district court's answer was in the negative. The routine use published in the Federal Register provided:

In the event that a record within this system of records maintained by this agency indicates a violation or potential violation of law, ... the relevant records in the system of records may be referred to as a routine use to the appropriate agency....

47 Fed.Reg. 14,333 p 1 (1982).

The district court ruled that this "routine use" was only applicable if the records at issue here, the PSQs, on their face revealed a violation or potential violation of law. Since the PSQs alone revealed no such violation or potential violation, the district court reasoned, the exception was inapplicable. The government argues that if the PSQs, when viewed in conjunction with other information (in this case the Certificates of Permanent Residence), revealed a violation or potential violation of law, then disclosure to law enforcement authorities would be a "routine use" for the purposes of the Federal Register. In essence, the government argues that the relevant "record" for the purpose of the Federal Register and Sec. 552a is not the PSQ, but rather the entire prosecutive report the IG sent to the DOJ, which included the PSQ and other information.

As to the second prerequisite to the invocation of the routine use exception, the district court concluded that disclosure to the DOJ was not "compatible with the purpose for which the information was sought" because the information in the PSQs was collected solely in order to help the DOE determine eligibility for security clearances.

The government argues that disclosure to the DOJ of the record (which it views as the prosecutive report rather than the PSQ) was compatible with the purpose for which such information was collected because the prosecutive report was collected by the IG for the purpose of criminal investigation. The government's position necessarily stands or falls on its reading of the term "record" as described above. If the "record" is the PSQ, then the record was not collected by the IG at all, but rather was collected by the DOE for security clearance purposes, which are unrelated to criminal investigation. If the "record" is the prosecutive report, then the purpose for which the record was collected was law enforcement itself, and the government's argument seems convincing.

Whether the government's or the district court's interpretation of the term "record" is correct is a difficult question. We need not decide that question in this case, however, because we hold that disclosure to the DOJ was unlawful because the government did not comply with another provision of the Privacy Act, Sec. 552a(e)(3)(C). Although the district court did not rely on this subsection, we are free to affirm on any ground supported by the record. See, e.g., United States v. County of Humboldt, 628 F.2d 549 (9th Cir.1980).

As noted above, subsection (e)(3)(C) provides that an Agency collecting information shall

(3) inform each individual whom it asks to supply information, on the form which it uses to collect the information or on a separate form that can be retained by the individual--

(C) the routine uses which may be made of this information as published pursuant to paragraph (4)(D) of this subsection; ... (emphasis added)

It is beyond dispute that the government did not comply with this provision in this case. The government did not indicate to plaintiffs that the PSQ information would be used for law enforcement purposes; indeed the government explicitly stated that the information would only be used for security clearance purposes.

The government argues that non-compliance with subsection (e)(3)(C) should not prevent the government from invoking the routine use exception, Sec. 552a(b)(3). Specifically, the government makes two arguments--that the plain language of the routine use exception, Sec. (b)(3), makes no mention of actual notice or Sec. (e)(3)(C), and that plaintiffs can point to no "link" between Sec. (b)(3) and Sec. (e)(3)(C). We find both of these arguments unpersuasive.

Although the language of Sec. (b)(3) makes no mention of actual notice, the plain language of Sec. (e)(3)(C) could not be clearer. Found under the heading "Agency Duties," Sec. (e)(3)(C) states that the agency "shall ... inform each individual whom it asks to supply information, on the form which it uses to collect the information or on a separate form that can be retained by the individual ... the routine uses which may be made of this information as published pursuant to paragraph (4)(D) of this subsection" (emphasis added). Under the plain terms of the statute, a collecting agency is under a duty to inform the individuals from whom it is collecting information of the routine uses to which that information may be put. The statute gives the agency no discretion not to discharge this duty.

We also reject the government's argument that noncompliance with Sec. (e)(3)(C) is irrelevant in this case because plaintiffs have failed to establish a "link" between the two sections. Subsection (e)(3)(C) "links itself" to the routine use exception provision, Sec. (b)(3), by invoking the technical term "routine use" and by referring back to Sec. (e)(4)(D), the provision requiring publication of routine uses in the Federal Register. There is simply no "missing link" in plaintiffs' claim.

This reading of the statutory scheme is consistent with our view, and that of the First Circuit, that "the purpose of the statute is to let citizens know why and for what reasons the United States is asking them questions." Usher v. HHS, 721 F.2d 854, 856 (1st Cir.1983) quoting Saunders v. Schweiker, 508 F. Supp. 305, 309 (W.D.N.Y.1981). Like the First Circuit, we think that the government cannot simply disregard or read out of the statute Sec. (e)(3)(C). See Usher, 721 F.2d at 856 (awarding costs to individuals on appeal because there was "no basis in the statute for an agency's refusing to give the information specified in 5 U.S.C. Sec. 552a(e)(3).") We note that requiring the government to comply strictly with the terms of Sec. (e)(3)(C) does not place an unreasonable burden on the government. Indeed, the government often indicates on questionnaires that the information gathered can be used for law enforcement. See, e.g., Form 171, the standard form for federal employment. Providing persons with actual notice of the routine uses of government collected information is a sound and inexpensive policy. Because the government did not comply with Sec. (e)(3)(C) and that policy here, the "routine use" exception is inapplicable to the case at hand.3

WHETHER THE VIOLATION WAS INTENTIONAL OR WILLFUL

The government argues that even if unauthorized by the "routine use" exception, the IG's disclosure to the DOJ was not an "intentional or willful" violation of Sec. 552a(b) for the purpose of awarding damages under the Privacy Act. The statute provides for damages only where "the court determines that the agency acted in a manner which was intentional or willful ..." 5 U.S.C. Sec. 522a(g)(4)(A). Since the district court did not rely on the government's violation of Sec. (e)(3)(C), we must determine for ourselves whether this violation was "willful or intentional." This does not mean, however, that we receive no assistance from the district court on this question. The district court did discuss the willful or intentional standard and characterized it, correctly we think, as "only somewhat greater than gross negligence." 667 F. Supp. at 740. In Albright v. United States, 732 F.2d 181, 189 (D.C.Cir.1984), the leading D.C.Circuit case on the question, the court held that the damage provision of the Privacy Act "imposes liability only when the agency acts in violation of the Act in a willful or intentional manner, either by committing the act without grounds for believing it to be lawful, or flagrantly disregarding others' rights under the Act." The government argues that this standard has not been met on the facts of this case. Specifically, the government argues that the IG had a reasonable basis for believing it could disclose the prosecutive reports to the DOJ. In this regard, the government notes that the IG's disclosure was in full compliance with the IG's own internal regulations.

The fact that the IG was following its own regulations cannot be decisive because, as the district court noted, an agency "cannot promulgate regulations which ignore the dictates of the Privacy Act." 667 F. Supp. at 742. The real question becomes, then, how tenable the government's legal arguments are, and whether the IG agents could reasonably have relied upon them. Because we see no legitimate basis for the government's failure to comply with Sec. (e)(3)(C), as discussed above, we conclude that the violation was intentional or willful for the purposes of the damage award.

Accordingly, the judgment of the district court is AFFIRMED.

I agree with parts I and II of the majority opinion. The disclosure of the information contained on the Personnel Security Questionnaires (PSQs) to the Inspector General (IG) was lawful under the Privacy Act. I respectfully disagree, however, with part III of the majority opinion in which the majority holds that the IG's disclosure of the PSQs to the Department of Justice (DOJ) was not lawful as well.

The majority's conclusion in Part III is based upon the failure of the Department of Energy (DOE) to advise the individuals who filled out PSQs that the information they supplied might be used against them in a criminal prosecution. It reaches this conclusion by equating "routine use" as defined by section 552a(e)(3)(C) of the Privacy Act with "routine use" as defined by section 552a(b)(3). The two sections are quite different. And the "routine use" referred to in each section is different.

As used in section (e)(3)(C), "routine use" refers to the use the agency which requests information may make of the information it obtains. In the present case, individuals who completed the PSQs were asked to give residence information to the DOE. The Supplement to Form DOE-1 stated that "personal information on the [PSQ] form(s) will be used to determine an individual's eligibility for a DOE personnel security clearance or access authorization." Obtaining a security clearance or access authorization was the "routine use" for which information on the PSQs was collected.

On the other hand, section (b)(3) permits disclosure by one agency (in this the IG which investigated the fraud) to another agency (the Department of Justice) if the disclosure is "for a routine use as defined in subsection (a)(7) of this section and described under subsection (e)(4)(D) of this section." As the majority acknowledges, "routine use" as used in section (b)(3) is defined by subsection (a)(7): "The term 'routine use' means, with respect to the disclosure of a record, the use of such record for a purpose which is compatible with the purpose for which it was collected." It is beyond cavil that the IG collected the information from the PSQs for the purpose of investigating fraud. It is equally clear that disclosure of the IG's record of its investigation (which included the PSQs) to the DOJ was for the purpose of possible criminal fraud prosecutions, a purpose obviously compatible with the purpose for which the IG collected the information in the first place. This being so, one wonders why there should be any question about the propriety of this disclosure.

The problem lies in the second qualifying phrase of section (b)(3). The disclosure must not only be for a routine use as defined in subsection (a)(7). It must also be for a routine use "described under subsection (e)(4)(D)." Section (e)(4)(D) requires that "each routine use of the records" must be published by the agency (the DOE in this case) in the Federal Register. The routine use published by the DOE in the Federal Register provides in relevant part:

1. In the event that a record within this system of records maintained by this agency indicates a violation or potential violation of law, whether civil, criminal or regulatory in nature, and whether arising by general statute or particular program pursuant thereto, the relevant records in the system of records may be referred as a routine use to the appropriate agency, whether Federal, State, local or foreign, charged with the responsibility of investigating or prosecuting such violation or charged with enforcing or implementing the statute, or rule, regulation or order issued pursuant thereto.

47 Fed.Reg. 14,333, Appendix B p 1 (1982).

The question is the same question the district court faced: Is the "record" which the IG turned over to the DOJ a "record within this system of records maintained by" the DOE? If it is, the disclosure was proper. If it is not, the disclosure was impermissible. The district court concluded the "record within this system of records maintained by" the DOE consisted solely of the PSQs; because no violation of law could be gleaned simply by looking at the information on the PSQs, their disclosure to the DOJ was improper.

In my view the "record within this system of records maintained by" the DOE is the record consisting of the relevant documents from the DOE files, including the PSQs, which the IG collected in compiling its investigative report. This collection of documents does indicate a "violation or potential violation of law" and the IG appropriately turned this record over to the DOJ for possible criminal fraud prosecutions. Obviously, this interpretation depends upon what is meant by a "record." This is answered by 5 U.S.C. Sec. 552a(a)(4):

[T]he term "record" means any item, collection, or grouping of information about an individual that is maintained by an agency, including, but not limited to, his education, financial transactions, medical history, and criminal or employment history and that contains his name, or the identifying number, symbol, or other identifying particular assigned to the individual, such as a finger or voice print or a photograph.

5 U.S.C. Sec. 552a(a)(4).

All of the information collected by the IG in its investigation was collected for the purpose of investigating possible criminal fraud. The collected information was incorporated into the investigative files of the IG as the investigation proceeded for each of the various individuals. These files were created and maintained pursuant to 54 Fed.Reg. 1439 DOE 54-Investigative Files of Inspector General. This provision of the Federal Register further states that this system of files

represents that portion of the files of the Inspector General which covers IG investigations of individuals. The records are used in IG investigations and for the referral of violations of law to law enforcement authorities. Records may be disclosed in accordance with routine uses listed in Appendix B. (emphasis added).

47 Fed.Reg. 14319 DOE-54 (1982).

It is in Appendix B at 47 Fed.Reg. 14333 (1982) that authorization is found for disclosure of the IG files--the "portion of the files of the Inspector General which covers IG investigations of individuals" as a "routine use" to the "appropriate agency," in this case the DOJ. 47 Fed.Reg. 14333, Appendix B, Sec. 1 (1982). Thus, the IG's disclosure to the DOJ of the investigative files of the various individuals the IG investigated was a routine use as defined by 5 U.S.C. Sec. 552a(a)(7), and as published in the Federal Register pursuant to section (e)(4)(D), and as authorized by section (b)(3).

The DOE did not violate section (e)(3)(C). It plainly told the individuals from whom it collected information on the PSQs that it would use this information to determine eligibility for security clearances or access authorizations. There is no claim the DOE did otherwise. The IG collected information from the PSQs as part of its fraud investigation. As the majority agrees, this collection of information was perfectly proper. How then was section (e)(3)(C) violated?The majority holds the violation occurred when the IG turned its investigative record over to the DOJ, because the DOE had failed to inform individuals who completed the PSQs that the information they supplied might be used for law enforcement purposes. But all section (e)(3)(C) requires is that the individuals be advised of the "routine uses" which may be made of the information collected. They were so advised. They were told that the information they furnished would be used by the DOE to determine their eligibility for security clearances or access authorization. This was the "routine use" for which the information was gathered. The DOE did not furnish this information to the DOJ for criminal prosecution. The IG did, and it did so pursuant to applicable law and only after it came into possession of the information properly.

For the foregoing reasons, I would reverse the decision of the district court and hold that there was no violation of the Privacy Act.