Georgia Andrews, Erin Brett, Frances E. Cassle, B.j. Durham,maureen Engert, Mary Fox, Maxine Griffin, Betty Grubb, Ruthholmes, Lucille Hoppe, Dorothy Homyak, Sharon K. Kaiser,chandra K. Lillemoen, Carolyn O'brien, Deloris O'brien, Maryjane Prysock, Laura Russell, Laura Scherr, Joan Schick,brenda Schulz, Victoria Smith, Kathryan Toulouse, Margaretwickham, Norman Wilde, and All Others Similarly Situated,plaintiffs-appellees, v. Veterans Administration of the United States of America,defendant-appellant,american Federation of Government Employees, Afl-cio, Amicus Curiae, 838 F.2d 418 (10th Cir. 1988)

The Veterans Administration of the United States of America ("VA") appeals from a judgment of the United States District Court for the District of Wyoming finding that the VA's disclosure of certain personnel records violated the Privacy Act rights of plaintiffs, registered nurses employed at a VA Medical Center ("Medical Center") in Cheyenne, Wyoming. We reverse.

BACKGROUND

On June 4, 1984, Ms. Pat Sanchez, president of the union local which was the exclusive bargaining representative for nurses employed at the Medical Center, made a written request to Ms. Hazel Gilligan, the Chief of Personnel Service at the Medical Center, seeking copies of proficiency reports (essentially job performance evaluations) for all registered nurses at the Medical Center for the years 1982-84. The request acknowledged that such reports would have to be "sanitized" by deleting all information that might tend to identify the subjects of the reports prior to disclosure. Pursuant to a written inquiry from Ms. Gilligan, Ms. Sanchez stated that the proficiency reports were needed in connection with a grievance the union would possibly file and to facilitate preparation for upcoming labor-management negotiations. Certain of the plaintiff nurses, upon learning of the request for the reports, asked both orally and in writing that the records not be released.

Ms. Gilligan sought the advice of VA personnel in Washington, D.C. in determining how to respond to the request.¹  The Labor Relations Department of the VA advised her that the Federal Service Labor-Management Relations Act, 5 U.S.C. § 7101-7135, ("FSLRA") required disclosure of the reports, but that they should be sanitized prior to disclosure to preserve the anonymity of the subjects of the reports. Accordingly, Ms. Gilligan attempted to sanitize the reports by deleting with a black felt-tip pen any information which she felt would identify the subjects of the reports.²  She then asked her assistant to further sanitize the reports. Finally, Ms. Gilligan asked the head nurse at the Medical Center to review the reports and make any other deletions she felt necessary to protect the identities of the nurses. On June 19, she released the sanitized reports to Ms. Sanchez. Ms. Sanchez and two other nurses reviewed the records but no other people obtained access to them.

On June 20, in response to requests from the nurses that the reports not be released, Ms. Gilligan sent a letter to all the nurses at the Medical Center stating that the FSLRA required release of the reports but that they had been sanitized. To demonstrate that the identities of the nurses had been adequately protected, Ms. Gilligan's letter included as an attachment a copy of the sanitized proficiency report relating to plaintiff Laura Scherr. As the district court found, the report regarding Ms. Scherr was inadequately sanitized and several co-workers could identify her as the subject of the report.

As it turned out, the reports released were never in fact used in connection with any grievance or other union activity.³  The district court concluded that "Mrs. Sanchez was on a general fishing expedition, which may have been motivated by spite or anger resulting from her own failure to obtain a requested promotion." Andrews, 613 F. Supp. at 1412.

The plaintiffs, registered nurses employed at the Medical Center, brought this action, seeking to enjoin the VA and the Medical Center from releasing the personnel records of the plaintiffs and others similarly situated "in an unsanitized or improperly sanitized condition" and seeking damages for the release of the records which, they alleged, was an intentional and willful violation of the Privacy Act of 1974, 5 U.S.C. § 552a. They alleged that the disclosure of the reports resulted in "injury and damages including, but not limited to, mental distress and embarrassment" and they sought damages of $1,000 for each plaintiff as well as attorneys' fees. During pretrial discovery, plaintiffs sought and obtained production under court seal of the records released to the union. When plaintiffs reviewed the records, ten of the plaintiffs were recognized by their coplaintiffs from information contained in the reports and four plaintiffs were able to identify their own reports, although no other plaintiffs could so identify them. Three plaintiffs were unable to identify their own reports, nor could any other plaintiff so identify them.

Pursuant to a stipulation of the parties, the Medical Center was dismissed as a party and the case was tried to the court. The court denied the VA's motion to dismiss or, in the alternative, for summary judgment. After a two day trial, the district court entered its findings of fact and conclusions of law. It found that the record established that third parties acquainted with ten of the plaintiffs⁴  could and did recognize their identity from information released in the reports. The court found that

" [i]ndirect evidence adequately establishes that the identity of the following plaintiffs could be determined through the information released in their proficiency reports, though no third party did in fact so identify them: Diane Ingle, Carolyn O'Brien, Ada Shader, and Victoria Smith.... [A] review of the reports themselves, as well as the other evidence in the record is adequate to lead to a logical inference that persons acquainted with such plaintiffs, including their coemployees, could readily identify their reports based upon the information released."

Andrews, 613 F. Supp. at 1409. With regard to three plaintiffs, Frances Cassle, Dorothy Honyak, and Margaret Wickham, the district court concluded that " [n]o evidence was submitted to show that the information in the proficiency reports ... was such as would enable any third party to identify the subject of the report." Id.⁵ 

The district court [held] that each plaintiff "suffered some degree of anguish, embarrassment, or other mental trauma" from the release of the reports, but that "none suffered any pecuniary loss." Id. Finally, the court found that the release of the reports adversely affected the Medical Center's entire proficiency reporting system "due to fear that the information contained in the reports may later be disclosed to third persons," and harmed the working environment at the Center, causing increased "tensions and antagonism." Id.

In assessing the culpability of the VA, the district court found that Ms. Gilligan "acted conscientiously, in good faith, though inadvertently negligently, in releasing the proficiency reports in an inadequately sanitized condition." She failed to balance the privacy interests of the nurses against the interests of the union in having the reports, "which interests were ambiguous and virtually undefined." Id. The court further held that the VA personnel in Washington were "grossly negligent" in failing to adequately train or guide Ms. Gilligan regarding the release of information subject to the Privacy Act and in directing her in this case that release was required by FSLRA. It found that the gross negligence of the Washington VA personnel was a willful or intentional violation of the Privacy Act.

In its conclusions of law, the district court held that where identification of the subjects of the reports was possible, as here, "a violation of the subject's privacy interests occurs." It found that the numerical ratings portion of the reports contained sensitive information, but that such sensitive information could be deleted and the remainder disclosed without violation of a person's privacy interests. On the other hand, the narrative portions of the reports contained identifying information "so inextricably intertwined with other materials that segregation is not reasonably possible," such that disclosure "of any meaningful part of this portion of the reports" would "result in an invasion of the privacy interests of the subject in the context of a relatively small facility such as the Medical Center." Id. at 1411.

Having concluded that the VA erred in failing to balance the interests of the various parties in this case prior to disclosure, the court then conducted its own balancing. It found the violation of the nurses' privacy interests was "substantial" and that the union's interest in obtaining the documents was "minimal."⁶  It therefore concluded that the disclosure of inadequately sanitized reports to Ms. Sanchez "constituted a clearly unwarranted invasion of the privacy interests of the subjects" in violation of the Privacy Act.⁷  The court denied plaintiffs' request for injunctive relief but awarded them $1,000 per plaintiff, finding that emotional trauma, even without pecuniary loss, was sufficient to sustain such an award. Finally, the court awarded plaintiffs, as prevailing parties, attorneys' fees of $5,000.

The VA appeals, alleging that the plaintiffs failed to show that the VA committed a willful or intentional violation of the Privacy Act. It essentially argues that it was faced with the difficult task of reconciling the pro-disclosure mandates of FSLRA and the Freedom of Information Act, 5 U.S.C. § 552 ("FOIA") with the anti-disclosure mandate of the Privacy Act. While it concededly may have been negligent, the VA argues it did not act in an intentional or willful manner. The VA also challenges the district court judgment with regard to the four plaintiffs who were able to identify their own reports but whose identities remained concealed from their co-plaintiffs. For the reasons set forth below, we reverse.

DISCUSSION

A. Relevant Provisions of Privacy Act, FOIA and FSLRA.

Several provisions of the Privacy Act, FOIA and FSLRA are relevant to this appeal.

The Privacy Act, 5 U.S.C. § 552a was enacted " 'to protect the privacy of individuals identified in information systems maintained by Federal agencies' by preventing the 'misuse' of that information." Thomas v. United States Dep't. of Energy, 719 F.2d 342, 345-46 (10th Cir. 1983) (quoting Privacy Act of 1974, Pub. L. No. 93-579, Sec. 2, 88 Stat. 1896, reprinted in 1974 U.S.Code Cong. & Ad.News 2177-78 (congressional findings and statement of purpose)). It states in pertinent part:

"No agency shall disclose any record which is contained in a system of records by any means of communication to any person, or to another agency, except pursuant to a written request by, or with the prior written consent of, the individual to whom the record pertains, unless disclosure would be--

* * *

"(2) required under section 552 of this title [FOIA];"

5 U.S.C. § 552a(b) (2). Thus, in this case, without the consent of the nurses who were the subjects of the proficiency reports, the VA was prohibited from disclosing the reports unless disclosure was required by FOIA.

The Privacy Act further provides:

"(g) (1) Civil remedies--Whenever any agency

* * *

"(D) fails to comply with any other provision of this section, or any rule promulgated thereunder, in such a way as to have an adverse effect on an individual, the individual may bring a civil action against the agency ...

* * *

"(4) In any suit brought under the provisions of subsection (g) (1) (C) or (D) of this section in which the court determines that the agency acted in a manner which was intentional or willful, the United States shall be liable to the individual in an amount equal to the sum of--

"(A) actual damages sustained by the individual as a result of the refusal or failure, but in no case shall a person entitled to recovery receive less than the sum of $1,000; and

"(B) the costs of the action together with reasonable attorney fees as determined by the court."

5 U.S.C. § 552a(g) (1) (emphasis added). Accordingly, if release of the reports was not required by FOIA and had an "adverse effect" upon the nurses, and if the VA's action amounted to an "intentional or willful" violation of the Privacy Act, the nurses are entitled to damages and attorneys' fees.

FOIA generally provides for public disclosure of information contained in agency files, with specified exceptions. "The primary thrust of the Freedom of Information Act is to 'pierce the veil of administrative secrecy and to open agency action to the light of public scrutiny.' " Wren v. Harris, 675 F.2d 1144, 1145 (10th Cir. 1982) (quoting Dept. of the Air Force v. Rose, 425 U.S. 352, 361, 96 S. Ct. 1592, 1599, 48 L. Ed. 2d 11 (1976)) (quoting Rose v. Dept. of the Air Force, 495 F.2d 261, 263 (2d Cir. 1974)). The FOIA exception relevant to this case provides as follows:

"(b) This section does not apply to matters that are--

* * *

"(6) personnel and medical files and similar files the disclosure of which would constitute a clearly unwarranted invasion of personal privacy; ... Any reasonably segregable portion of a record shall be provided to any person requesting such record after deletion of the portions which are exempt under this subsection."

5 U.S.C. § 552(b) (emphasis added). As the district court acknowledged, an agency must attempt to segregate sensitive from nonsensitive material, if a document contains both, and release the nonsensitive information. See 5 U.S.C. § 552(b); Dept. of the Air Force v. Rose, 425 U.S. 352, 96 S. Ct. 1592, 48 L. Ed. 11 (1976). "If the exempt materials are inextricably intertwined with the non-exempt materials, the entire document is exempt from mandatory disclosure under the Freedom of Information Act." Andrews, 613 F. Supp. at 1411 (citations omitted).

In this case, if the disclosure of the personnel files at issue "would constitute a clearly unwarranted invasion of personal privacy" such files are not subject to mandatory disclosure under FOIA; as such, they are protected from disclosure under the Privacy Act.⁸ 

Finally, FSLRA sets forth the rights and obligations of federal employees vis-a-vis the government. 5 U.S.C. § 7114 provides in pertinent part:

"(b) The duty of an agency and an exclusive representative to negotiate in good faith under subsection (a) of this section shall include the obligation--

* * *

"(4) in the case of an agency, to furnish to the exclusive representative involved, or its authorized representative, upon request and, to the extent not prohibited by law, data--

* * *

"(B) which is reasonably available and necessary for full and proper discussion, understanding, and negotiation of subjects within the scope of collective bargaining;"

5 U.S.C. § 7114(b) (4) (B). See generally Am. Fed'n. of Gov't. Employees, Local 1345 v. Fed. Labor Relations Auth., 793 F.2d 1360 (D.C. Cir. 1986).

It embodies important public policies concerning the collective bargaining process.⁹  Of course, section 7114 only requires disclosure to the extent not prohibited by law. Although there is little case law on the subject, no party in this case contends that the Privacy Act operates as an absolute bar to disclosure of information to union representatives under FSLRA. All parties here impliedly concede that the FOIA exemption to the Privacy Act, removing Privacy Act protection if disclosure is required by FOIA, applies in this case. The dispute centers largely on the alleged failure of the VA to do the balancing required under FOIA.¹⁰  Indeed, there are important policy reasons why the Privacy Act should not absolutely bar disclosure of relevant information to unions. See generally Local 2047, Am. Fed'n. of Gov't. Employees v. Defense Gen. Supply Center, 423 F. Supp. 481, 485 n. 7 (E.D. Va. 1976), ("Disclosing relevant information to recognized unions may easily be seen to advance the nation's federal labor-management relations policy by providing the union with data necessary to pursue its representational duties."), aff'd, 573 F.2d 184 (4th Cir. 1978) (per curiam).

As the foregoing discussion of the relevant statutes indicates, if the reports in this case were "personnel ... files the disclosure of which would constitute a clearly unwarranted invasion of personal privacy" under 5 U.S.C. § 552(a) of FOIA, the Privacy Act prohibited their disclosure absent the consent of the nurses. And if the Privacy Act thus prohibited disclosure in this case, they could not be disclosed to Ms. Sanchez pursuant to FSLRA.

B. Standard for Privacy Act Liability.

As previously indicated, even if the Privacy Act is violated, no punishment may be imposed unless the agency acted in a manner which was intentional or willful. In this case the district court equated "intentional or willful" with gross negligence. The district court founded the VA's gross negligence, and therefore its willful or intentional violation of the Privacy Act, on its failure to adequately train or guide Ms. Gilligan on the Privacy Act and in directing her that FSLRA mandated release in this case. We hold that the district court erred as a matter of law when it equated gross negligence with a willful or intentional violation of the Privacy Act.

In Parks v. United States Internal Revenue Serv., 618 F.2d 677 (10th Cir. 1980), a widely cited decision of this circuit on the Privacy Act, this court attempted to elucidate the meaning of "willful or intentional." While noting that something more than negligence is required, the court rejected the view that "premeditated malice" is required. It called it "noteworthy" that the Privacy Act's legislative history states:

"In a suit for damages, the [compromise] amendment reflects a belief that a finding of willful, arbitrary or capricious action is too harsh a standard of proof for an individual to exercise the rights granted by this legislation. Thus the standard for recovery of damages was reduced to 'willful or intentional' action by an agency. On a continuum between negligence and the very high standard of willful, arbitrary, or capricious conduct, this standard is viewed as only somewhat greater than gross negligence."

Id. at 683 (citing Analysis of House and Senate Compromise Amendments to the Federal Privacy Act, reprinted in 120 Cong.Rec. 40405, 40406 (1974)) (emphasis added).

Thus, the legislative history suggests that something more than gross negligence is required. Some courts have explicitly so stated. See Tijerina v. Walters, 821 F.2d 789, 799 (D.C. Cir. 1987); Moskiewicz v. United States Dept. of Agriculture, 791 F.2d 561, 564 (7th Cir. 1986) ("Evidence of conduct which would meet a greater than gross negligence standard, focusing on evidence of reckless behavior and/or knowing violation of the Act on the part of the accused, must be advanced ..."); Hill v. U.S. Air Force, 795 F.2d 1067, 1070 (D.C. Cir. 1986) (per curiam) (citing Parks) ; Doe v. Gen. Serv. Admin., 544 F. Supp. 530, 541 (D. Md. 1982); South v. FBI, 508 F. Supp. 1104, 1108 (D. Ill. 1981).

Other courts have suggested that gross negligence is sufficient, some of them citing Parks for that proposition. See, e.g., Albright v. United States, 732 F.2d 181, 189 (D.C. Cir. 1984) (citing Parks) ; Chapman v. Nat'l. Aeronautics and Space Admin., 736 F.2d 238, 243 (5th Cir.) (per curiam) (equating gross negligence with willfulness), cert. denied, 469 U.S. 1038, 105 S. Ct. 517, 83 L. Ed. 2d 406 (1984). However, some of these courts, as well as others, have grappled with further definitions of willful or intentional. See, e.g., Laningham v. United States Navy, 813 F.2d 1236, 1242 (D.C. Cir. 1987) (intentional or willful means "so 'patently egregious and unlawful' that anyone undertaking the conduct should have known it 'unlawful' ") (quoting Wisdom v. Dept. of Hous. & Urban Dev., 713 F.2d 422, 425 (8th Cir. 1983), cert. denied, 465 U.S. 1021, 104 S. Ct. 1272, 79 L. Ed. 2d 678 (1984)); Albright, 732 F.2d at 189 (willful or intentional requirement met "by committing the act without grounds for believing it to be lawful, or by flagrantly disregarding others' rights under the Act."); Moskiewicz, 791 F.2d at 564 (7th Cir. 1986) (acts meeting greater than gross negligence standard require evidence of "reckless behavior and/or knowing violations of the Act."); Chapman, 736 F.2d at 243 (5th Cir. 1984) (court looks for evidence of "unlawful intent" or "ulterior motive"); Wisdom v. Dept. of Hous. & Urban Dev., 713 F.2d at 425 (8th Cir. 1983), cert. denied, 465 U.S. 1021, 104 S. Ct. 1272, 79 L. Ed. 2d 678 (1984) (willful or intentional means "patently egregious and unlawful").

We reiterate Parks ' conclusion that premeditated malice is not required to establish a willful or intentional violation of the Privacy Act. Nonetheless, the term "willful or intentional" clearly requires conduct amounting to more than gross negligence. We are persuaded by the District of Columbia Circuit's definitions of willful or intentional that contemplate action "so 'patently egregious and unlawful' that anyone undertaking the conduct should have known it 'unlawful,' " Laningham, 813 F.2d at 1242 (quoting Wisdom v. Dept. of Hous. & Urban Dev., 713 F.2d at 425 (8th Cir. 1983)), or conduct committed "without grounds for believing it to be lawful" or action "flagrantly disregarding others' rights under the Act," Albright, 732 F.2d at 189, and we adopt those definitions, and add the view expressed in Moskiewicz, 791 F.2d at 564 (7th Cir. 1986), that the conduct must amount to, at the very least, reckless behavior. Those, and similar definitions, describe conduct more extreme than gross negligence.

Applying that standard to this case, our review of the record convinces us that the VA's conduct falls far short of a "willful or intentional" violation of the Privacy Act. Indeed, we find that it falls short of even the gross negligence standard applied by the district court to that conduct.

More specifically, given the interpretation of FSLRA in other cases, we would not view the advice that FSLRA required release of the reports in sanitized form as even grossly negligent in the circumstances of this case. Furthermore, we do not view the evidence as supporting the conclusion that the VA was grossly negligent in failing to provide Ms. Gilligan with training or guidance. As the district court specifically found, "Ms. Gilligan had received some training concerning her duties under the Privacy Act, and was supplied with the Federal Personnel Manual which contains guidelines for responses to requests for information contained in personnel files." Andrews, 613 F. Supp. 1408. While neither Ms. Gilligan nor the Washington personnel specifically went through a balancing process denominated as such to determine whether the public interest in disclosure of the files outweighed any privacy interests the nurses had in such files, Ms. Gilligan's efforts to sanitize the files, pursuant to directions from the Washington VA personnel, themselves indicate some attempt to reconcile the two competing interests. See Sullivan v. Veterans Admin., 617 F. Supp. 258, 262 (D.D.C. 1985) ("While the VA was not completely successful in deleting all the personally identifiable references to plaintiff, its attempt to do so demonstrates that agency's consideration of and concern for plaintiff's privacy interests.") While Ms. Gilligan testified that she had received no formal training in sanitization of records, her efforts to sanitize the reports were substantial. We view the inadequacy of those sanitization efforts as indicative of negligence, at most, on the part of the VA, not the higher level of culpability necessary to establish liability under the Privacy Act.

For the foregoing reasons we REVERSE the decision of the district court finding the VA liable for a violation of the Privacy Act and awarding to plaintiffs damages and attorneys' fees.