Supreme Court Holds Only Pecuniary Damages Available Under Federal Privacy Act

Privacy/Cyber Risk & Data Security

On March 28, the U.S. Supreme Court ruled 5-3 that the Privacy Act of 1974, which regulates how federal agencies handle personal information, does not unequivocally authorize damages for mental or emotional distress. Cooper v. FAA, No. 10-1024, 2012 WL 1019969 (U.S. Mar. 28, 2012). In this case, an airline pilot sued the Federal Aviation Administration (FAA) and other federal agencies for impermissibly exchanging information about his HIV status in connection with a criminal investigation. The pilot claimed to suffer emotional and mental distress due to the disclosure. The U.S. Court of Appeals for the Ninth Circuit held that the term “actual damages” in the Privacy Act is not ambiguous and includes damages for mental and emotional distress. The Supreme Court reversed, holding, as the district court originally held, that the term is ambiguous and therefore does not waive the government’s sovereign immunity from liability for nonpecuniary damages. The narrow ruling only directly impacts actions under the Privacy Act, and the court notes that “actual damages” can mean different things in different contexts. As such, the holding does not invalidate prior lower court rulings that “actual damages” under other statutes, including the Fair Credit Reporting Act and the Fair Housing Act, can include damages for emotional or mental distress.