Focusing public attention on emerging privacy and civil liberties issues

Doe v. Chao

Top News

  • Supreme Court Requires Actual Harm for Privacy Act Damages. The Supreme Court has ruled (pdf) in a 6-3 decision in Doe v. Chao that an individual must prove he has suffered actual harm before he can receive a $1,000 minimum statutory award when the government wrongfully discloses his Social Security Number. EPIC, along with a coalition of civil liberties organizations and technical and legal experts, filed a friend of the court brief (pdf) in the case, arguing that the Privacy Act provides damages for those who suffer "adverse effects," though no actual harm. (Feb. 24, 2004)

Background

EPIC collaborated with numerous consumer and privacy organizations, legal scholars and technical experts to submit an amicus brief in Doe v. Chao, an important privacy case before the Supreme Court. This case concerned the wrongful disclosure of the Social Security Number by a federal agency and whether a person should be required to prove actual damages to obtain relief under the Privacy Act. Our view, and the view of most federal courts, was that it should only be necessary to show "adverse effects" to obtain the minimal $1,000 damages under the Act.

In this case, the Department of Labor was sued by a class of coal miners who filed claims with the government for black lung benefits. To process the benefit claims, the Department of Labor used each applicant's SSN to identify that applicant's claim. As identification numbers, the SSNs were subsequently disclosed to other applicants, as well as those applicants' employers and lawyers. The SSNs were also made publicly available in administrative law decisions and computerized legal research databases.

Several coal miners filed suit against the government, alleging violations of the Privacy Act. The United States District Court for the Western District of Virginia consolidated the miner's claims and assigned their case to a magistrate to make recommendations with regard to motions for summary judgment and class certification. The magistrate recommended that the district court grant summary judgment against all the miners with the exception of Buck Doe, finding that they were unable to prove damages. The district court adopted the magistrate's recommendation and granted summary judgment in favor of the government on all claims except that of Doe. With respect to his claim, the court entered summary judgment in favor of Doe, awarding him $1,000 in statutory damages. The court explained that an individual must prove "actual damages" to obtain the $1,000 statutory damages available under the Privacy Act, and that because emotional distress is the chief means of proving damage in privacy cases, such emotional distress is sufficient evidence to allow recovery under the Privacy Act. The court found that Doe had demonstrated enough emotional distress to justify recovery, and thus was entitled to statutory damages.

The miners (other than Doe) appealed the district court's decision to the Fourth Circuit, arguing that proof of "actual damages" is unnecessary to recover under the Privacy Act, and in the alternative, that the district court's holding with respect to Doe was correct because emotional distress is sufficient evidence of injury to permit an award of damages under the Privacy Act. The government also appealed the district court's decision, claiming that recovery under the Privacy Act is limited to individuals who can produce evidence of "actual damages," which includes only monetary loss and not emotional harm. The Fourth Circuit adopted the government's view and determined that Doe was not entitled to damages under the Privacy Act because he failed to show that any tangible consequences flowed from the emotional distress he experienced due to the disclosure of his SSN.

The Supreme Court granted certiorari in June to consider the question of whether an individual bringing suit under the Privacy Act for wrongful SSN disclosure must prove that he suffered actual monetary damages as a result of the disclosure in order to recover the minimum damages provided by the Privacy Act. On February 24, 2004, the Supreme Court ruled (pdf) in a 6-3 decision that an individual must prove he has suffered actual harm before he can receive a $1,000 minimum statutory award when the government wrongfully discloses his Social Security Number.

Our Role

The amicus brief first outlined the grave dangers posed by SSN disclosure, specifically discussing identity theft. The brief then pointed out that Congress has provided liquidated damage-the amount of which is determined in advance so that a dollar amount doesn't have to be specifically proved-in other privacy laws to enforce rights that are difficult to put a money value on. Finally, the brief reviewed the Privacy Act's legislative history to demonstrate that Congress has long recognized the risks to privacy posed by unnecessary SSN disclosure. EPIC argued that the award of actual damages in compensation for SNN disclosure under the Privacy Act should be triggered not by a showing of specific monetary damages, but by a showing of adverse affect to the individual, defined as risk of SSN misuse.

Legal Documents

Doe v. Chao History

Briefs

Legislative Materials

News