FOIA Cases

EPIC v. Education Department – Private Debt Collector Privacy Act Compliance

US District Court for the District of Columbia

DOWNLOAD ED-FOIA-Complaint pdf 328.5KB

Background

The Department of Education relies heavily on private debt collectors to recoup money from borrowers who have defaulted on student loans. As the total amount of outstanding student debt rises, private collection firms view student loans as a burgeoning market and are aggressively seeking contracts with the department. In 2011, the Education Department paid about $355 million to private debt collector companies. The Department has contracts with at least twenty-three private debt collectors.

Some of these debt collector companies have been accused of abusive or unsavory tactics. In 2011, the Education Department received 1,406 complaints about its collection contractors, a 41% increase from the previous year. Outsourcing the collection of student loans raises important questions about borrowers’ privacy. Private debt collectors are entrusted with sensitive personal and financial data of student borrowers. Under the Privacy Act of 1974, the Department may release certain information about student borrowers to collection firms, but those firms must in turn abide by the Privacy Act safeguards.

The Department publishes a detailed privacy manual, the “PCA Procedures Manual,” and distributes it to contractors in order to instruct debt collectors about federal statutory requirements. The most recent public version of the manual was published in 2013.

Collection firms with Department of Education contracts are required to submit various compliance and disclosure reports on a regular basis. Each student loan collection firm must sign a “Certification of Privacy Act Training” form certifying that the employee has received proper annual privacy training. Collection firms are required to submit monthly “Quality Control Reports” to the Department which must include a section on privacy and any problems or corrective actions. Collection firms must also submit “Security Awareness and Privacy Act Training Reports” which must state the date of the firm’s last privacy training.

All three of these compliance reports are matters of significant public interest because they represent the primary oversight mechanism for determining whether numerous federal contractors are adequately protecting the privacy of student-loan borrowers.

EPIC’s Freedom of Information Act Request and Subsequent Lawsuit

In September 2012, EPIC submitted a FOIA request to the Education Department requesting:

  • The most currently updated version of the “PCA Procedures Manual” that the Department of Education publishes as guidance for its debt-collection contractors. The 2009 version of this manual was prepared by the Federal Student Aid Operation Services Processing Division.
  • All “Certification of Privacy Act Training” forms, “Quality Control Reports,” and “Security Awareness and Privacy Act Training Reports” submitted by private debt-collection firms to the Department of Education during the last three years.

When the Education Department failed to produce any documents, EPIC filed its administrative appeal in November 2012.

On March 15, 2013, EPIC filed a lawsuit against the Education Department based on the agency’s failure to comply with statutory deadlines and unlawful withholding of agency records.

The Education Department released documents in response to EPIC’s lawsuit. On November 4, 2013, EPIC settled the case with the Education Department and was awarded $9,000.00 in attorney’s fees.

Legal Documents

EPIC v. Department of Education, Case No. 13-00345 (GK) (D.D.C. filed Mar. 15, 2013)

Freedom of Information Act Documents

Released Documents

News Items

Support Our Work

EPIC's work is funded by the support of individuals like you, who allow us to continue to protect privacy, open government, and democratic values in the information age.

Donate