UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLUMBIA
AMERICA FIRST LEGAL FOUNDATION, : : Plaintiff, : Civil Action No.: 24-1092 (RC) : v. : Re Document No.: 6 : XAVIER BECERRA, et al., : : Defendants. :
MEMORANDUM OPINION
GRANTING PLAINTIFF’S MOTION FOR A PRELIMINARY INJUNCTION
I. INTRODUCTION
Upon learning that the Centers for Disease Control and Prevention (“CDC”) deletes the
emails of its former employees shortly after the employee leaves the agency, Plaintiff America
First Legal Foundation alerted the U.S. Department of Health and Human Services (“HHS”) and
the National Archives and Records Administration (“NARA”) to CDC’s allegedly unlawful
records-retention practice. NARA conducted an investigation but ultimately concluded that
CDC’s policies and practices were consistent with the Federal Records Act. It therefore declined
to further pursue the matter. Dissatisfied with that result, Plaintiff filed suit against HHS; Xavier
Becerra, in his official capacity as Secretary of HHS; NARA; and Colleen Shogan, in her official
capacity as Archivist of the United States (collectively, “Defendants”). Generally speaking,
Plaintiff alleges that CDC’s disposition of its former employees’ emails violates the Federal
Records Act and the Administrative Procedure Act, as does Secretary Becerra’s and Archivist
Shogan’s decision not to refer the issue to the Attorney General. Before the Court is Plaintiff’s
motion for a preliminary injunction. For the reasons discussed below, the Court grants Plaintiff’s
motion. II. BACKGROUND
A. The Federal Records Act
Congress has enacted various statutory provisions, collectively known as the Federal
Records Act (“FRA”), that govern “the creation, management and disposal of federal records.”
See Armstrong v. Bush (“Armstrong I”), 924 F.2d 282, 284 (D.C. Cir. 1991). The FRA requires
heads of federal agencies to “make and preserve records containing adequate and proper
documentation of the organization, functions, policies, decisions, procedures, and essential
transactions of the agency.” 44 U.S.C. § 3101. The statute also requires agencies to establish
and maintain an active records management program that complies with the FRA and regulations
promulgated by NARA, id. § 3102, and to establish safeguards “against the removal or loss of
records” that the agency head determines should be preserved, id. § 3105.
When those safeguards fail, the FRA provides for a “system of administrative
enforcement,” Armstrong I, 924 F.2d at 294, whereby agency heads and the Archivist (the head
of NARA) “are to work together to ensure that no documents are unlawfully” lost or destroyed,
Jud. Watch, Inc. v. Tillerson, 293 F. Supp. 3d 33, 37 (D.D.C. 2017), aff’d sub nom. Jud. Watch,
Inc. v. Pompeo, 744 F. App’x 3 (D.C. Cir. 2018). Specifically, the statute mandates that:
The head of each Federal agency shall notify the Archivist of any actual, impending, or threatened unlawful removal, defacing, alteration, corruption, deletion, erasure, or other destruction of records in the custody of the agency, and with the assistance of the Archivist shall initiate action through the Attorney General for the recovery of records the head of the Federal agency knows or has reason to believe have been unlawfully removed from that agency, or from another Federal agency whose records have been transferred to the legal custody of that Federal agency.
Id. § 3106(a). If a reasonable time passes yet the agency head does not enlist the Attorney
General’s assistance, “the Archivist shall request the Attorney General to initiate such an action,
and shall notify the Congress when such a request has been made.” Id. § 3106(b). And if both
2 the agency head and the Archivist fail to initiate remedial action in a timely manner, “private
litigants may sue under the [Administrative Procedure Act] to require them to do so.” Armstrong
I, 924 F.2d at 296 n.12; see also Judicial Watch, Inc. v. Kerry, 844 F.3d 952, 954 (D.C. Cir.
2016).
B. Factual Background
In March 2023, Plaintiff filed a Freedom of Information Act (“FOIA”) request with CDC
for records relating to the agency’s publication of a document entitled LGBTQ Inclusivity in
Schools: A Self-Assessment Tool. Compl. ¶ 25. After Plaintiff and the agency agreed to narrow
the scope of the search to a list of specific custodians, a CDC FOIA analyst informed Plaintiff
that although three employees had worked on publishing the document, only one of those
employees still worked at CDC. Id. ¶ 26. That was significant, the FOIA analyst explained,
because it was CDC’s practice to delete former lower-level employees’ email accounts (and any
emails remaining in those accounts) thirty days after the employee’s departure from the agency. 1
Id. ¶ 27. Consequently, the FOIA analyst informed Plaintiff that potentially responsive emails
belonging to the two former employees would have already been destroyed. Id. ¶ 26.
Concerned that CDC was “willfully disregarding” its “duties and obligations” under the
FRA, Plaintiff sent a letter describing CDC’s alleged noncompliance to the HHS Office of
Inspector General. Id. ¶ 28; see also Compl., Ex. A, ECF No. 1-1. Plaintiff sent a “courtesy
copy” to the NARA Records Management Oversight and Reporting Program. Compl. ¶ 29.
Plaintiff’s letter spurred NARA to action. On April 7, 2023, NARA informed CDC that it had
1 That information appears to have been slightly incorrect. CDC relinquishes control of its former employees’ email accounts ninety days—not thirty days—after the employee leaves the agency. See Defs.’ Opp’n to Pl.’s Mot. for Prelim. Inj. at 6, ECF No. 13; see also Tr. of Mot. Hearing at 8:6–10, ECF No. 15. The difference is immaterial for present purposes.
3 received “a complaint . . . alleging that the CDC has had a pattern and practice of unlawfully
deleting the emails of employees who separate from employment within as little as thirty days
from the date of separation” notwithstanding the fact that the applicable records disposition
schedule—General Records Schedule (“GRS”) 6.1—required the agency to preserve employee
emails for a minimum of three years. See Compl., Ex. C (“Apr. 2023 Letter”), ECF No. 1-3;
Compl., Ex. E (“General Records Schedule 6.1”) at 5, ECF No. 1-5.
At this point, it is worth pausing to briefly discuss GRS 6.1. GRS 6.1 is one of a number
of general records schedules issued by the Archivist pursuant to her authority under the FRA to
promulgate “schedules authorizing the disposal, after the lapse of specified periods of time, of
records of a specified form or character.” See 44 U.S.C. § 3303a(d). GRS 6.1 applies to email
and other electronic messages for agencies which, like CDC, have adopted the so-called
Capstone approach to records management. See General Records Schedule 6.1 at 1; see also id.
(explaining that agencies that use GRS 6.1 “must apply it to email records” (including associated
attachments) “regardless of how the email messages are managed or what email technology is
used”). The Capstone approach distinguishes between Capstone and non-Capstone officials.
“Capstone Officials are senior officials designated by account or position level,” id. at 3, whereas
non-Capstone officials are “all other officials, staff, and contractors,” id. at 5. For Capstone
officials, GRS 6.1 provides a disposition instruction for emails of “permanent” retention. Id. at
3. For non-Capstone officials, GRS 6.1 sets a retention period of three years for “support” and
“administrative” staff, id. at 5, and seven years for everyone else, id. The “majority” of an
agency’s employees fall into the category of employees whose email must be retained for seven
years. Id.
4 With that context in mind, NARA requested that CDC “determine whether email records
of separated employees have been prematurely deleted, and are not being preserved and managed
in accordance with GRS 6.1.” Apr. 2023 Letter. A month later, CDC reported that it had
investigated the matter and “conclude[d] [that] CDC policies and procedures prohibit disposing
of separated employees’ email accounts without authorization and not before stringent criteria
has been met.” See Decl. of Laurence Brewer (“First Brewer Decl.”) ¶ 14, ECF No. 13-2. This
did not sufficiently address NARA’s query into CDC’s “use of GRS 6.1 to manage emails” so,
on August 4, 2023, CDC further explained that the agency does not use GRS 6.1 to manage all
employee emails, but rather only uses GRS 6.1 to manage and preserve the emails of Capstone
officials. See id. ¶ 15. For all other emails, the agency relies on its employees to “use traditional
records management practices, meaning that they must file and preserve their records based on
their subject matter.” 2 Id.
NARA acknowledged CDC’s findings in a letter NARA sent to CDC on February 23,
2024. In the letter, NARA confirmed that CDC policy does “not require the preservation of all
emails,” but rather requires employees to “preserve[] all records from [their] email accounts.”
See Compl., Ex. D (“Feb. 2024 Letter”) at 1, ECF No. 1-4. NARA further explained that
“CDC’s records management policy instructs all agency personnel to maintain records outside of
email accounts in a proper record-keeping system, shared drive, personal drive, or physical
format,” and that “CDC instructs individual email account holders to apply retention based on
the email’s content value and its applicability to a NARA-approved records schedule.” Id. In
the letter, NARA further stated “that the CDC’s policies and procedures prohibit disposing of
2 In contrast to a traditional records management approach, GRS 6.1 is content agnostic—the period of time that an email must be retained depends on the role of the sender, not the content of the email. See Decl. of Mary Wilson ¶ 6, ECF No. 13-1.
5 separated employees’ email accounts without authorization, and specific criteria must be met
before the email accounts of separated employees’ are deleted.” Id. All that being so, NARA
determined that CDC’s policy was consistent with the FRA and closed the investigation. Id.
C. Procedural History
Less than two months later, Plaintiff filed suit in federal district court. Generally
speaking, Plaintiff’s complaint alleges that CDC’s policy and practice of deleting non-Capstone
employees’ emails months after their departure violates GRS 6.1 and therefore also violates the
FRA and Administrative Procedure Act (“APA”). See Compl. ¶¶ 37–44, 77–83. Plaintiff further
alleges that, despite their awareness of this allegedly unlawful removal and deletion of CDC
records, neither the Secretary nor the Archivist have referred the matter to the Attorney General.
See id. ¶¶ 62–64, 68–76.
Two weeks after filing its complaint, Plaintiff filed a motion for a preliminary injunction.
See Pl.’s Mem. in Supp. of Appl. for Prelim. Inj. (“Pl.’s Mot.”), ECF No. 6-1. Plaintiff’s motion
asks the Court to “enjoin HHS from permitting the unlawful removal or destruction of lower-
level employee emails by the CDC before the periods prescribed by [GRS] 6.1.” Id. at 3.
Plaintiff also requests that the Court order the Secretary and the Archivist “to initiate an action
through the Attorney General for the recovery of records already removed by the CDC, including
those records responsive to AFL’s FOIA request.” Id. Defendants oppose Plaintiff’s motion, see
Defs.’ Opp’n to Pl.’s Mot. for Prelim. Inj. (“Defs.’ Opp’n”), ECF No. 13, and Plaintiff has filed a
reply, see Pl.’s Reply in Supp. of Appl. for Prelim. Inj. (“Pl.’s Reply”), ECF No. 14. The Court
heard oral argument on May 23, 2024, after which the parties submitted supplemental briefing on
certain factual and legal issues that arose during argument. See Defs.’ Suppl. Br. to Defs.’ Opp’n
6 to Pl.’s Mot. for Prelim. Inj. (“Defs.’ Suppl. Br.”), ECF No. 16; Pl.’s Resp. to Defs.’ Suppl. Br.
in Opp’n to Pl.’s Appl. for Prelim. Inj. (“Pl.’s Suppl. Resp.”), ECF No. 18.
III. LEGAL STANDARD
“A preliminary injunction is an extraordinary remedy never awarded as of right.” Winter
v. Nat. Res. Def. Council, Inc., 555 U.S. 7, 24 (2008). The party seeking relief “must make a
‘clear showing’” that (1) it is likely to succeed on the merits; (2) it is likely to suffer “irreparable
harm in the absence of preliminary relief;” (3) the “balance of the equities [is] in its favor;” and
(4) an injunction “accord[s] with the public interest.” Archdiocese of Wash. v. Wash. Metro.
Area Transit Auth., 897 F.3d 314, 321 (D.C. Cir. 2018) (quoting League of Women Voters of the
U.S. v. Newby, 838 F.3d 1, 6 (D.C. Cir. 2016)). “The last two factors ‘merge when the
Government is the opposing party.’” Guedes v. Bureau of Alcohol, Tobacco, Firearms &
Explosives, 920 F.3d 1, 10 (D.C. Cir. 2019) (quoting Nken v. Holder, 556 U.S. 418, 435 (2009)).
Before the Supreme Court’s decision in Winter, courts in this circuit applied a “sliding-
scale” approach to the preliminary injunction analysis under which “a strong showing on one
factor could make up for a weaker showing on another.” Sherley v. Sebelius, 644 F.3d 388, 392
(D.C. Cir. 2011). Since Winter, the D.C. Circuit has hinted on several occasions that “a
likelihood of success is an independent, free-standing requirement for a preliminary injunction,”
id. (citation omitted), but it has repeatedly declined to decide the issue, see, e.g., Changji Esquel
Textile Co. v. Raimondo, 40 F.4th 716, 726 (D.C. Cir. 2022); Archdiocese of Wash., 897 F.3d at
334; see also League of Women Voters, 838 F.3d at 7. Here, because the Court concludes that all
four factors weigh in favor of granting a preliminary injunction, Plaintiff is entitled to
preliminary relief regardless of whether the sliding-scale approach applies.
7 IV. ANALYSIS
A. Likelihood of Success on the Merits
The first aspect of the Court’s analysis considers Plaintiff’s likelihood of success on the
merits of its claims. A plaintiff’s likelihood of success is the “most important factor” in
determining whether preliminary injunctive relief is warranted. See Aamer v. Obama, 742 F.3d
1023, 1038 (D.C. Cir. 2014). Indeed, “a failure to show a likelihood of success on the merits
alone is sufficient to defeat a preliminary-injunction motion.” Standing Rock Sioux Tribe v. U.S.
Army Corps of Engineers, 205 F. Supp. 3d 4, 26 (D.D.C. 2016).
Plaintiff’s complaint advances two claims. Count One charges that the Secretary and the
Archivist violated the APA and the FRA by declining to alert the Attorney General to CDC’s
allegedly unlawful deletion of its former employees’ emails. See Compl. ¶¶ 68–76. Count Two
charges HHS with violating those same statutes by failing to maintain an adequate recordkeeping
system. See id. ¶¶ 77–83. The Court addresses these claims in turn.
1. Count I: Referral to the Attorney General
The APA provides that courts “shall . . . hold unlawful and set aside agency action,
findings, and conclusions” that are “arbitrary, capricious, an abuse of discretion, or otherwise not
in accordance with law,” 5 U.S.C. § 706(2)(A), and “compel agency action unlawfully withheld
or unreasonably delayed,” id. § 706(1). “Although the Federal Records Act does not contain an
express or implied private right of action,” the APA permits a claim pursuant to section 706(1)
“that an agency failed to take a discrete agency action that it is required to take.” Kerry, 844
F.3d at 954 (quoting Norton v. S. Utah Wilderness All., 542 U.S. 55, 64 (2004)).
Count One of Plaintiff’s complaint alleges such a claim. Specifically, Plaintiff alleges
that the Secretary and the Archivist violated the APA and the FRA by failing to ask the Attorney
8 General to initiate legal action to remedy CDC’s deletion of former employees’ emails. See id.
¶¶ 68–76. Plaintiff contends that all it needs to show to prevail on this claim is that (1) CDC was
(or is) removing or destroying former employees’ emails, (2) that the removal or destruction of
those emails was (or is) unlawful, and (3) that the Secretary and Archivist were aware of CDC’s
unlawful practice yet failed to refer the matter to the Attorney General. See Pl.’s Mot. at 12–13;
see also Price v. U.S. Dep’t of Just., No. 18-cv-1339, 2019 WL 2526439, at *6 (D.D.C. June 19,
2019) (explaining that, to show a likelihood of success on similar claim, plaintiff needed to
“convincingly (1) identify records that fall under the FRA; (2) allege that those records are being
removed or destroyed in violation of the FRA; and (3) allege that the relevant agency
head . . . and/or Archivist knew about the FRA violations and yet failed to initiate corrective
action”). Plaintiff argues that all three of those requirements are satisfied here because (1) CDC
concededly deletes its former, lower-level employees’ emails within ninety days of their
departure, see Pl.’s Mot. at 13; (2) CDC’s deletion of its former employees’ emails is
inconsistent with GRS 6.1 and thus unlawful, see id. at 13–14; and (3) both the Secretary and
Archivist were aware that CDC was deleting emails within months of employees’ departure, but
neither alerted the Attorney General, see id. at 14.
At least to some extent, Defendants contest Plaintiff’s ability to establish each of the
three elements of its claim. First, although Defendants concede that CDC deletes its former
employees’ emails, Defendants argue that the agency does not remove those emails. See Defs.’
Opp’n at 13–16. This is significant, they say, because the FRA only compels agency heads and
the Archivist to initiate legal action through the Attorney General when an agency removes—not
deletes or destroys—records. See id. Defendants therefore contend that neither the Secretary nor
the Archivist were legally obliged to alert the Attorney General that CDC was deleting employee
9 emails within months of their departure. See id. Second, Defendants argue that CDC’s deletion
of its former employees’ emails was not unlawful—thus providing another reason that referral to
the Attorney General was not warranted. See id. at 16; see also id. at 12–13. Third, Defendants
argue that, even if CDC’s deletion of emails was unlawful, the Secretary’s and Archivist’s
decision not to initiate legal action was not “final agency action” and is thus unreviewable. See
id. at 16–17 (quoting Lujan v. Nat’l Wildlife Fed., 497 U.S. 871, 882 (1990)).
a. Circumstances Under Which the FRA Requires the Secretary to Refer Matters to the Attorney General
The Court turns first to Defendants’ contention that the FRA only requires agency heads
and the Archivist to initiate legal action through the Attorney General to recover records that
have been improperly removed from agency custody. According to Defendants, the FRA does
not require either the Secretary or the Archivist to refer matters to the Attorney General in cases
in which an agency destroys or deletes records. In their words, “[t]he FRA does impose duties
on agency heads and the Archivist to make a referral to the Attorney General in certain
circumstances, but those duties apply only to removed records, not to alleged destruction or
deletion of records.” See Defs.’ Opp’n at 13 (internal quotation marks and citation omitted).
And because Plaintiff only alleges that CDC destroys or deletes former employees’ emails, see
id. at 14–15, Defendants conclude that Plaintiff cannot establish that either the Secretary or the
Archivist violated the FRA by declining to make a referral to the Attorney General.
To the extent Defendants contend that the FRA only requires agency heads—here, the
Secretary—to initiate an enforcement action to recover records that were improperly removed
from agency custody, the Court agrees. To see why, recall the text of 44 U.S.C. § 3106(a).
Section 3106(a) provides, in relevant part, that:
The head of each Federal agency shall notify the Archivist of any actual, impending, or threatened unlawful removal, defacing, alteration, corruption,
10 deletion, erasure, or other destruction of records in the custody of the agency, and with the assistance of the Archivist shall initiate action through the Attorney General for the recovery of records the head of the Federal agency knows or has reason to believe have been unlawfully removed from that agency . . . .
44 U.S.C. § 3106(a). Section 3106(a) consists of two clauses, each of which establishes a
separate duty. The first clause—which establishes a duty of notification—requires the Secretary
to notify the Archivist if any one of “seven triggers” occurs. See Am. C.L. Union Found. of Fla.
v. U.S. Immigrs. & Customs Enf’t (“ACLU”), No. 22-cv-1129, 2023 WL 6461053, at *7 (D.D.C.
Aug. 31, 2023). That is, the Secretary must notify the Archivist if there is a risk of unlawful
“removal, defacing, alteration, corruption, deletion, erasure, or other destruction” of agency
records. Id. The second clause—which establishes a duty of enforcement and referral—is only
triggered in one instance: if agency records are unlawfully “removed.” See 44 U.S.C. § 3106(a).
Taken together, section 3106(a) requires agency heads “to notify the Archivist of any removal,”
deletion, “or destruction of records, but mandates initiation of an enforcement action upon only
removal of records.” Citizens for Resp. & Ethics in Wash. v. U.S. Dep’t of Homeland Sec.
(“CREW II”), No. 22-cv-3350, 2024 WL 1178472, at *9 (D.D.C. Mar. 19, 2024).
This reading of the statute has been adopted by multiple judges within this circuit. See
ACLU, 2023 WL 6461053, at *7; CREW II, 2024 WL 1178472, at *9–11; Citizens for Resp. &
Ethics in Wash. v. U.S. Sec. and Exch. Comm’n (“CREW I”), 916 F. Supp. 2d 141, 146–48
(D.D.C. 2013). As those judges have explained, section 3106(a)’s inclusion of “removal”
alongside a list of six other triggers in the first clause, and then its inclusion of only “removal” in
the second clause is significant for at least two reasons. CREW II, 2024 WL 1178472, at *10.
“First, the rule against superfluity tells courts that ‘removal’ has a distinct meaning from
‘defacing, alteration, corruption, deletion, erasure, or other destruction of records.’” Id.; see also
TRW Inc. v. Andrews, 534 U.S. 19, 31 (2001) (explaining that it is “‘a cardinal principle of
11 statutory construction’ that ‘a statute ought . . . to be so construed that, if it can be prevented, no
clause, sentence, or word shall be superfluous, void, or insignificant’” (quoting Duncan v.
Walker, 533 U.S. 167, 174 (2001))). Put another way, if “removal” included “defacing,
alteration, corruption, deletion, erasure, and other destruction,” there would have been no need
for Congress to list the latter six terms. See ACLU, 2023 WL 6461053, at *7; see also CREW I,
916 F. Supp. 2d at 146. Second, courts generally assume both that Congress “acts intentionally
when it uses particular language in one section of a statute but omits it in another,” see Dep’t of
Homeland Sec. v. MacLean, 574 U.S. 383, 391 (2015), and that Congress’s omission of language
from one section of a statute “convey[s] a difference in meaning,” Bittner v. United States, 598
U.S. 85, 94 (2023). Here, then, the Court must assume that Congress intentionally excluded
“destruction” and “deletion” from the second clause of section 3106(a), and that its decision to
do so conveys the legislature’s intent that only the unlawful “removal” of agency records triggers
the Secretary’s mandatory duty of enforcement. See CREW II, 2024 WL 1178472, at *10;
ACLU, 2023 WL 6461053, at *7; CREW I, 916 F. Supp. 2d at 147.
Plaintiff resists this reading of section 3106(a) on multiple grounds, but none is
persuasive. First, Plaintiff contends that this reading of the statute is inconsistent with the
Circuit’s decisions in Kerry and Armstrong I. See Pl.’s Reply at 6–7. In particular, Plaintiff
highlights language in both opinions which, on its face, would seem to suggest that the
destruction of records triggers an agency head’s duty of enforcement. See Kerry, 844 F.3d at
954 (“[I]f the agency head and the Archivist do not take the required action to prevent the
unlawful destruction or removal of records, private litigants may sue under the APA to require
them to do so.” (cleaned up)); Armstrong I, 924 F.2d at 295 (“[I]f the agency head or Archivist
does nothing while an agency official destroys or removes records in contravention of agency
12 guidelines and directives, private litigants may bring suit to require the agency head and
Archivist to fulfill their statutory duty . . . .”). This language, while “helpful” to Plaintiff, is also
dicta. See CREW II, 2024 WL 1178472, at *10 (quoting CREW I, 916 F. Supp. 2d at 147); see
also ACLU, 2023 WL 6461053, at *7. As Judge Nichols previously explained, Armstrong I
analyzed “whether an agency’s duties under the [FRA] may be enforced by a private litigant
through the APA” and did not address “the specific statutory question at issue here.” ACLU,
2023 WL 6461053, at *7. Likewise, “the question presented [in Kerry] was whether a private
litigant can still bring suit if the agency and Archivist had made a ‘sustained effort’ to recover
missing records.” Id. (quoting Kerry, 844 F.3d at 954). Because neither decision directly
addressed the issue of statutory interpretation raised in this case, Judge Nichols concluded—and
this Court agrees—that “[a]ny dicta indicating that enforcement duties for the agencies are
triggered by anything other than removal is not enough to overcome the plain meaning” of
section 3106(a). Id.; see also CREW II, 2024 WL 1178472, at *10; CREW I, 916 F. Supp. 2d at
147–48.
Plaintiff next points to legislative history. See Pl.’s Reply at 10. But “relying on
legislative history is improper” where, as here, the meaning of a statute’s text is plain and
unambiguous. CREW II, 2024 WL 1178472, at *10; see also CREW I, 916 F. Supp. 2d at 147
(declining to consider legislative history to interpret section 3106(a) given that “legislative
history cannot trump a statute’s plain meaning”). After all, even when courts “consult legislative
history,” they do not “allow it to be used to ‘muddy’ the meaning of ‘clear statutory language.’”
See Food Mktg. Inst. v. Argus Leader Media, 588 U.S. 427, 436 (2019). Here, because section
3106(a)’s language and meaning are clear, the Court’s “inquiry is complete” without recourse to
13 legislative history. See Conn. Nat. Bank v. Germain, 503 U.S. 249, 254 (1992) (citation
omitted).
Finally, Plaintiff argues that even if section 3106(a) only requires the Secretary to refer
matters to the Attorney General when agency records are wrongfully removed, that condition is
satisfied here. In support, Plaintiff points to 36 C.F.R. § 1230.3(b), which defines “removal” as
“selling, donating, loaning, transferring, stealing, or otherwise allowing a record to leave the
custody of a Federal agency without the permission of the Archivist of the United States.” 36
C.F.R. § 1230.3(b). Plaintiff argues that CDC allows former employees’ emails to leave the
agency’s custody when the agency “transfers” the emails to Microsoft ninety days after the
employee departs. 3 See Pl.’s Suppl. Resp. at 3–5; see also Pl.’s Reply at 5–6. At that point,
Plaintiff contends that CDC has permanently relinquished “actual custody and control” of those
emails, thereby constituting removal. See Pl.’s Suppl. Resp. at 4; see also Pl.’s Reply at 5–6.
Defendants counter that Plaintiff’s focus on physical custody and control is misplaced,
and that the relevant question is whether CDC maintains “legal custody” of its employees’
emails at all times. See Defs.’ Suppl. Br. at 1. With that focus, they argue that CDC’s use of
Microsoft’s “cloud-based platforms” to “stor[e] or maintain[] records does not amount to a
removal under the FRA because those records remain in [CDC’s] legal custody” until they are
permanently deleted from Microsoft’s servers. Id. In support, they cite NARA’s guidance
regarding agencies’ use of cloud-based platforms, see id. at 2, CDC’s contract with Microsoft,
including provisions “prohibit[ing] Microsoft from removing records from the legal custody of
3 For context, CDC loses access to its former employees’ emails ninety days after the employee leaves the agency. See Decl. of Mary Wilson ¶ 15, ECF No. 13-1. No more than ninety days later, Microsoft “permanently deletes all emails and associated data within the [former employee’s] Microsoft 365 suit[e].” Id.
14 CDC or destroying records except . . . pursuant to CDC’s authorization,” see id. at 3 (internal
quotation marks omitted), and various authorities suggesting that a removal of records does not
occur unless an agency loses legal custody of those records, see id. at 4–9.
It is not readily apparent which party has the better argument on this front.
Consequently, it is possible that Plaintiff will prevail in showing that CDC “removes” its former
employees’ emails when it loses access to them ninety days after an employee departs, and thus
that the Secretary’s enforcement obligation was triggered by that removal. At this stage,
however, the Court need not conclusively determine whether Plaintiff is likely to succeed on the
merits of this aspect of its claim. That is because, as discussed in the next section, the Court
concludes that the Archivist was required to refer the matter of CDC’s deletion of its former
employees’ emails to the Attorney General regardless of whether the Secretary should have done
the same.
b. Circumstances Under Which the FRA Requires the Archivist to Refer Matters to the Attorney General
Plaintiff claims that, once the Archivist learned of CDC’s allegedly unlawful deletion of
agency records and a “reasonable period of time” had passed, the Archivist had an independent
obligation to refer the matter to the Attorney General. Pl.’s Mot. at 14. Defendants disagree;
they again argue that the FRA only imposes a referral duty upon the Archivist when agency
records are unlawfully removed from an agency. See Defs.’ Opp’n at 13–16. This time,
however, the text of section 3106 is not on Defendants’ side.
In advancing the argument that “section 3106(b) imposes a referral obligation duty on the
Archivist as to all forms of record destruction listed in section 3106(a), not just removal,”
Plaintiff relies heavily on Judge Nichols’s decision in ACLU. See Pl.’s Reply at 12–13 (quoting
ACLU, 2023 WL 6461053, at *7). There, the government argued that section 3106(b)
15 establishes a referral obligation upon the Archivist that is “essentially derivative” of the referral
duty imposed upon agency heads by section 3106(a). ACLU, 2023 WL 6461053, at *7. In other
words, according to the government in that case, the scope of the Archivist’s referral duty under
section 3106(b) extends no further than does the scope of an agency head’s enforcement duty
under section 3106(a). See id. The government’s argument was based both on its reading of the
text of the relevant sections, as well as the “logical” argument that it would not make sense to
impose “greater referral obligations on the Archivist than on the agencies.” Id.
Judge Nichols rejected the government’s argument and concluded that, unlike section
3106(a), “section 3106(b) imposes a referral obligation duty on the Archivist as to all forms of
record destruction listed in section 3106(a), not just removal.” Id. at *8. The Court finds Judge
Nichols’s reasoning persuasive and agrees that section 3106(b) imposes a broader enforcement
duty on the Archivist than section 3106(a) does upon agency heads. To see why, consider the
text of the two subsections within section 3106. As discussed, section 3106(a) requires agency
heads to “notify the Archivist of any actual, impending, or threatened unlawful removal,
defacing, alteration, corruption, deletion, erasure, or other destruction of records,” and to “initiate
action through the Attorney General for the recovery of records [that] have been unlawfully
removed.” 44 U.S.C. § 3106(a). If a reasonable time passes and the agency head “does not
initiate an action for such recovery or other redress . . . after being notified of any such unlawful
action described in subsection (a),” then section 3106(b) requires the Archivist to “request the
Attorney General to initiate such an action.” Id. § 3106(b) (emphasis added). The premise of
section 3106(b), then, is “that the agency did not initiate an action ‘for such recovery or other
redress.’” ACLU, 2023 WL 6461053, at *8 (quoting 44 U.S.C. § 3106(b)). Section 3106(a), on
the other hand, “only speaks of actions for the ‘recovery’ of records.” Id. (quoting 44 U.S.C.
16 § 3106(a)). The best reading of the difference between the two subsections is that “recovery” in
section 3106(b) corresponds with “removal” (like it does in section 3106(a)), while “other
redress” corresponds with actions to remedy the other six types of prohibited actions listed in
section 3106(a). Id. To read the statute otherwise would risk rendering the “or other redress”
language surplusage. Id.; but see CREW II, 2024 WL 1178472, at *11.
Further support for Judge Nichols’s reading of the statute comes from the fact that the
Archivist’s referral duty is triggered when an agency head does not initiate an action “after being
notified of any such unlawful action described in subsection (a).” 44 U.S.C. § 3106(b)
(emphasis added). Subsection (a) lists seven types of unlawful action: “unlawful removal,
defacing, alteration, corruption, deletion, erasure, or other destruction.” See id. § 3106(a). Had
Congress meant only to refer to “removal”—and not “any such unlawful action described in
subsection (a)”—it could have, and presumably would have, done so. See ACLU, 2023 WL
6461053, at *8 (explaining that “[i]t would be anomalous at best for Congress to have written
‘any such unlawful action described in subsection (a)’ if it meant just ‘removal’ (a word that
appears several times in the statute)”).
All that being so, the Court concludes that section 3106(b) imposes a duty on the
Archivist to refer matters to the Attorney General when an agency unlawfully deletes or
destroys—not just removes—records. And because there is no dispute that CDC deleted and
destroyed its former employees’ emails (regardless of whether CDC can be said to have also
removed them), the Court finds that CDC’s actions may—if unlawful—trigger the Archivist’s
duty of enforcement.
17 c. Whether CDC’s Deletion of Former Employees’ Emails Was Unlawful
Defendants next argue that the Archivist was not required to request that the Attorney
General initiate legal action because CDC’s deletion of its former employees’ emails was lawful.
See Defs.’ Opp’n at 12–13, 16; 44 U.S.C. § 3106(b). Plaintiff, of course, disagrees. See Pl.’s
Mot. at 4–6, 13–14.
It is well-settled that “the FRA establishes the exclusive means by which records subject
to the FRA may be discarded.” 4 Pub. Citizen v. Carlin, 184 F.3d 900, 902 (D.C. Cir. 1999); see
also 44 U.S.C. § 3314; Competitive Enter. Inst. v. U.S. E.P.A., 67 F. Supp. 3d 23, 27 (D.D.C.
2014) (“A document that qualifies as a federal record may not be discarded except as provided
by statute.”). The FRA, in turn, requires agencies to “get the approval of the Archivist before
disposing of any record.” Pub. Citizen, 184 F.3d at 902; see also Armstrong v. Exec. Off. of the
President, Off. of Admin. (“Armstrong II”), 1 F.3d 1274, 1279 (D.C. Cir. 1993). And “[a]gencies
may only dispose of records on terms approved by the Archivist.” Competitive Enter. Inst. v.
Off. of Sci. & Tech. Pol’y, 241 F. Supp. 3d 14, 18 (D.D.C. 2017). An agency typically obtains
the Archivist’s approval to dispose of records in one of two ways. Pub. Citizen, 184 F.3d at 902.
Under the first method, “an agency may submit a schedule of records sought to be discarded to
the Archivist, who will sign off on the records’ destruction only if she concludes that they do not
4 Of course, “[n]ot all documents in an agency’s possession qualify as ‘records’ under the FRA.” Competitive Enter. Inst. v. Off. of Sci. & Tech. Pol’y, 241 F. Supp. 3d 14, 17 (D.D.C. 2017). Instead, “records” include any “recorded information” “made or received by a Federal agency under Federal law or in connection with the transaction of public business and preserved or appropriate for preservation by that agency . . . as evidence of the organization, functions, policies, decisions, procedures, operations, or other activities of the United States Government or because of the informational value of data in them.” 44 U.S.C. § 3301. All the same, NARA has previously explained that most email “meets the definition of a federal record as provided in the Federal Records Act.” NARA, White Paper on the Capstone Approach and Capstone GRS at 4 (April 2015) (available at https://bit.ly/3Jm5Nfm).
18 ‘have sufficient administrative, legal, research, or other value to warrant their continued
preservation.’” 5 Armstrong II, 1 F.3d at 1279 (quoting 44 U.S.C. § 3303a(a)). Under the second
method, an “agency may jettison certain common types of records pursuant to disposal schedules
promulgated in advance by the Archivist.” Id.; see also 44 U.S.C. § 3303a(d). In other words,
the FRA and regulations promulgated thereunder enable agencies to dispose of certain categories
of records on a recurring basis as long as they have first sought and obtained the Archivist’s
permission to do so. See Competitive Enter. Inst., 67 F. Supp. 3d at 27.
With this backdrop in mind, the Court returns to the present dispute. As framed by the
parties, the issue of whether CDC unlawfully deleted (or deletes) its former employees’ emails
turns on the extent to which the agency committed to following GRS 6.1—the records-
disposition schedule promulgated by the Archivist that applies to agency emails. Plaintiff argues
that CDC is required to follow GRS 6.1 in full. See Pl.’s Mot. at 4–6, 13–14. And because GRS
6.1 requires agencies to retain lower-level employees’ emails for at least three years, Plaintiff
contends that CDC acted unlawfully by deleting former employees’ emails ninety days after their
departure—well-short of the three-year minimum mandated by GRS 6.1. See Pl.’s Mot. at 13–
14.
Defendants dispute the premise on which Plaintiff’s argument rests: they argue that CDC
did not, in fact, adopt GRS 6.1 in full, but rather chose to adopt GRS 6.1 only “in part.” See
Defs.’ Opp’n at 4–6, 12. According to Defendants, CDC employs “two different record
management policies regarding email records”: one that applies to its “most senior” (Capstone)
officials and another that applies to “all its other employees.” Id. at 4. For Capstone officials,
Defendants claim that CDC “utilizes . . . GRS 6.1.” Id. For all other employees, the agency says
5 Neither party suggests that CDC used that method here.
19 that it continues to “use traditional record management practices.” Id. at 5. Those traditional
record management practices require employees to “determin[e] whether emails are, or contain,
federal records” and, if so, to “save such emails in a shared drive with related documents.” Id. at
5. Additionally, when an employee departs CDC, the employee’s supervisor meets with the
employee prior to the employee’s departure “to discuss where the individuals’ records . . . should
be filed” and, following the employee’s departure, acquires access to the former employee’s
“Microsoft 365 suite for record management purposes.” Id. at 6. The upshot, CDC says, is that,
when the agency deletes a former employee’s email account ninety days after the employee’s
departure, all of the records that were contained in the account are adequately preserved
elsewhere.
After considering the parties’ positions and the record evidence in support thereof, the
Court concludes that CDC’s policy and practice of disposing of former employees’ emails ninety
days after the end of their employment is likely unlawful. That is because the available evidence
suggests that CDC did indeed commit to manage and dispose of its employees’ emails pursuant
to the schedule established by GRS 6.1. The records management policy for HHS—of which
CDC is a component—states in relevant part and without qualification that “HHS has adopted
the Capstone approach (GRS 6.1).” See HHS Policy for Records Management, § 6.2 (Feb. 2024)
(available at https://perma.cc/D3KFNU28). A letter sent by NARA to CDC on April 7, 2023,
confirms as much: HHS “adopted the Capstone approach in 2016 to manage agency emails/email
accounts.” See Apr. 2023 Letter at 1.
Even more tellingly, however, there is evidence that CDC specifically sought and
obtained NARA’s permission to adopt GRS 6.1 to manage the retention and disposition of all of
its employees’ emails. In a form submitted to NARA on October 25, 2016, CDC checked a box
20 specifying that the agency would use GRS 6.1 to manage the email records for “all” of its
employees. 6 See Verification for Implementing GRS 6.1: Email Managed Under a Capstone
Approach (“Verification Form”) at 1, (available at https://perma.cc/CA3N-MC4U). NARA
approved CDC’s implementation of GRS 6.1 on March 28, 2017, see id., and there is nothing in
the record that suggests NARA ever approved of an alternate records-disposal schedule. Thus, it
is unsurprising that, at least as of April 2023, NARA was under the impression that “all HHS
components”—including CDC—“must follow the recordkeeping requirements in General
Records Schedule (GRS) 6.1.” See Apr. 2023 Letter.
Defendants counter by pointing to the fact that NARA investigated CDC’s recordkeeping
policies and concluded that they conform with the FRA. See Defs.’ Opp’n at 12–13, 16.
According to NARA, CDC’s policies “appropriately exercise agency discretion to manage email
records in proper recordkeeping systems and . . . the policies direct employees to organize and
preserve their files in accordance with CDC records schedules.” Id. at 8 (quoting First Brewer
Decl. ¶ 17); see also Feb. 2024 Letter at 1. The problem, however, is that nowhere in the
summary of its findings does NARA ever state that NARA actually approved CDC’s use of that
alternate recordkeeping system. And given that NARA did approve of CDC’s use of GRS 6.1 to
manage all employee emails, that omission is critical.
6 Defendants claim that CDC simply “checked the incorrect box” when submitting the form. Defs.’ Opp’n at 5 n.3. In support, they argue that the “narrative of the form” reflects that CDC uses two different approaches to manage its upper-level and lower-level employees’ emails. Id.; see also First Brewer Decl. ¶ 15. The Court disagrees. The form specifies that, unless an agency checked the “all” box, the agency must “summarize how other email is to be managed.” Verification Form at 2. Despite that instruction, the narrative to which Defendants point states only that “CDC is maintaining the emails of the CDC Director and all agency executives.” Id. The narrative does not, in other words, provide the slightest detail on “how other email is to be managed” if the CDC intended to follow a different approach. For that reason, the Court doubts that CDC simply checked the wrong box.
21 In short, the available evidence suggests that CDC committed to implementing GRS 6.1
to manage the emails of all of its employees, that NARA approved of CDC’s full implementation
of GRS 6.1, and that CDC did not seek—and NARA did not approve—an alternative schedule to
govern the disposition of CDC’s lower-level employees’ emails or records. At the same time,
there is evidence—provided by CDC itself—that the agency adopted and applied an alternate
records-disposal schedule pursuant to which former employees’ emails were deleted far more
quickly than they would have been under GRS 6.1. And though there is evidence in the record
showing that CDC has since sought the Archivist’s approval to use the bifurcated approach to
email retention that it appears to use in practice, the same evidence shows that the Archivist has
not yet formally authorized CDC’s use of that approach. See Decl. of Laurence Brewer
(“Second Brewer Decl.”) ¶ 15, ECF No. 16-1 (explaining that NARA is still “in the process of
reviewing” CDC’s amended Capstone verification form).
Because CDC disposed of former employees’ email records pursuant to a schedule that
was not approved by the Archivist, it is likely that Plaintiff is correct that records removed or
deleted under the CDC’s unapproved policy were removed or deleted unlawfully. See
Armstrong II, 1 F.3d at 1278 (“If a document qualifies as a record, the FRA prohibits an agency
from discarding it by fiat.”). In such circumstances, the FRA mandates that the Archivist refer
the matter to the Attorney General. See 44 U.S.C. § 3106(b); Kerry, 844 F.3d at 954. She has
not done so, and thus the Court concludes that Plaintiff has demonstrated a high likelihood of
success on this aspect of its claim. 7
7 Because the Court concludes that Plaintiff is likely entitled to relief under section 706(1) of the APA—which empowers courts to “compel agency action unlawfully withheld or unreasonably delayed,” 5 U.S.C. § 706(1)—it need not and does not address Defendants’ argument that the Archivist’s refusal to refer the case to the Attorney General does not qualify as “final agency action” for purposes of review under section 706(2)(A), see Defs.’ Opp’n at 16–17.
22 2. Count II: Adequacy of CDC’s Recordkeeping System
The second count in Plaintiff’s complaint alleges that CDC violated the FRA and APA by
failing to maintain an adequate recordkeeping system. See Compl. ¶¶ 77–83. According to
Plaintiff, CDC’s recordkeeping system is “inadequate, arbitrary, capricious, and otherwise not in
accordance with the [FRA]” because it does not “provide[] consistent, effective controls over the
maintenance” of employees’ emails. See id. ¶¶ 79–80; see also 5 U.S.C. § 706(2). Defendants
mount two principal arguments in opposition. First, they argue that the FRA precludes judicial
review of Plaintiff’s challenge. See Defs.’ Opp’n at 10–11. Second, they argue that CDC’s
recordkeeping program is consistent with the FRA and APA, and thus that Plaintiff’s claim fails
on its merits. See id. at 12–13. The Court will address these contentions sequentially.
a. Availability of Judicial Review
Defendants first contend that “Plaintiff cannot show it is likely to succeed on its
challenge to HHS and CDC’s recordkeeping practices because such challenges are precluded by
the FRA.” See Defs.’ Opp’n at 10–11. They argue that Plaintiff’s complaint does not actually
“challenge the adequacy of HHS or CDC’s recordkeeping guidelines,” but rather challenges
CDC’s compliance with the recordkeeping policies the agency has chosen to enact. See id.
(emphasis added). Plaintiff counters that Defendants mischaracterize the nature of the claim, and
that Plaintiff is “squarely challenging the adequacy of the CDC’s recordkeeping guidelines and
directives.” See Pl.’s Reply at 15–19. Plaintiff has the better argument.
Though the FRA itself does not provide an express or implied private cause of action, see
Kissinger v. Reps. Comm. for Freedom of the Press, 445 U.S. 136, 148 (1980), there are limited
circumstances in which the APA empowers private litigants to sue to force agencies to comply
with the FRA, Citizens for Resp. & Ethics in Wash. v. Pompeo (“Pompeo”), No. 19-cv-3324,
23 2020 WL 1667638, at *3 (D.D.C. Apr. 3, 2020). In Armstrong I, the seminal case on the subject,
the D.C. Circuit recognized two APA-based challenges that courts may entertain regarding the
FRA: (1) a claim that an agency failed “to employ adequate recordkeeping guidelines and
directives” and (2) a claim challenging the Archivist’s or agency head’s failure to take
enforcement actions required by the statute. Citizens for Resp. & Ethics in Wash. v. Pruitt, 319
F. Supp. 3d 252, 257 (D.D.C. 2018); see also Armstrong I, 924 F.2d at 291, 293–94. In contrast,
the court held that “private litigants” may not sue directly “to enjoin agency actions in
contravention of agency guidelines.” Armstrong I, 924 F.2d at 294. The court thus distinguished
between “reviewable challenges to an agency’s record-keeping guidelines under the APA, and
unreviewable challenges to the agency’s day-to-day implementation of its guidelines.”
Competitive Enter. Inst., 67 F. Supp. 3d at 33. To permit the latter, compliance-based claims, the
Circuit explained, would impermissibly inject the court into the “details of record management,”
a task better left “to the discretion of agency heads.” Armstrong I, 924 F.2d at 293.
With that context in mind, the Court agrees with Plaintiff that its claim is reviewable.
Refined to bare essence, Plaintiff alleges that CDC enacted and obtained NARA’s approval to
use one recordkeeping policy and disposition schedule to govern retention of its employees’
emails (i.e., GRS 6.1), see Compl. ¶¶ 32, 37, 39, 78; see also Pl.’s Mot. at 4–5, but then turned
around and used some other “unknown, unpublished policy,” Compl. ¶ 44, that sets forth
different requirements than GRS 6.1 and pursuant to which the agency deletes former
employees’ emails on a much shorter timeframe than those established by GRS 6.1, see id. ¶¶ 34,
40–44; see also Pl.’s Mot. at 14–15. Plaintiff’s claim can thus be understood to allege that
CDC’s recordkeeping policy is unlawful and inadequate in at least two ways. First, CDC’s use
of an unknown, unpublished, and unapproved policy is unlawful and inadequate because the
24 FRA requires agencies to obtain the Archivist’s approval before destroying records on a
recurring basis and, relatedly, mandates that agencies dispose of records only on terms approved
by the Archivist. See Pub. Citizen, 184 F.3d at 902; Off. of Sci. & Tech. Pol’y, 241 F. Supp. 3d
at 18. Second, CDC’s record management is unlawful and inadequate because the policy that it
does follow—whatever that may be—does not provide for the preservation of employees’ emails
for the durations required by GRS 6.1.
Viewed in this light, Plaintiff is not challenging CDC’s noncompliance with GRS 6.1 but
rather the fact that the agency is apparently complying with whatever non-public recordkeeping
policy the agency chose to adopt in its stead. 8 And that policy is unlawful and inadequate,
Plaintiff says, both because it was not approved by NARA and also because it does not preserve
emails for a sufficient duration. A claim of that sort is the type of claim that the FRA permits
private litigants to bring and courts to review. See Pompeo, 2020 WL 1667638, at *5
(explaining that a claim alleging “isolated violations of [agency] guidelines” is not reviewable
but that a claim challenging “an agency-wide policy that violates the FRA” would be (emphasis
deleted)); Pruitt, 319 F. Supp. 3d at 260 (agreeing that plaintiff’s “claim that the Agency’s
current recordkeeping policy does not conform to the FRA and implementing NARA
regulations” was reviewable).
8 To be sure, if CDC is complying with a records disposition schedule that is materially different from GRS 6.1, that necessarily indicates that the agency is simultaneously not complying with GRS 6.1. And because Plaintiff alleges that CDC’s official, announced policy is to follow GRS 6.1, the Court can conceive of a way in which Count Two could be construed as a challenge to CDC’s compliance with its official policy. However, given that Plaintiff does not allege “isolated,” or ad hoc violations of GRS 6.1, Pompeo, 2020 WL 1667638, at *5, but rather an agency-wide policy of violating GRS 6.1, the Court concludes that this alternate construction of the complaint is not the best construction.
25 Defendants resist this conclusion principally on the ground that CDC’s policy regarding
the retention of employees’ emails is not as unknown as Plaintiff alleges. See Defs.’ Opp’n at
11. In support, Defendants point to NARA’s February 2024 case-closure letter and its
conclusion that “CDC’s record management policy instructs all agency personnel to maintain
records outside of email accounts in a proper recordkeeping system, shared drive, personal drive,
or physical format.” Id.; see also Feb. 2024 Letter at 1 (concluding that “CDC does not require
the preservation of all emails but rather preserves all records from email accounts”). But this
only serves to underscore the reviewability of Plaintiff’s claim: it strongly suggests that, like
Plaintiff alleges, CDC is in fact following a records-retention policy to manage employees’
emails that is distinct from GRS 6.1 and which NARA did not approve. Plaintiff’s claim is,
therefore, subject to judicial review.
b. Merits
Because Plaintiff’s challenge to CDC’s recordkeeping policy is reviewable, the Court
must next consider whether Plaintiff is likely to succeed in showing that CDC’s policy is
unlawful or inadequate. The Court finds that Plaintiff is likely to succeed in so showing for at
least two reasons.
First, it is well-established that “[a]gencies may only dispose of records on terms
approved by the Archivist.” Off. of Sci. & Tech. Pol’y, 241 F. Supp. 3d at 18; see also
Armstrong II, 1 F.3d at 1286 n.11 (reiterating “the FRA’s specific requirement that federal
records may be ‘alienated or destroyed’ only with the approval of the Archivist” (quoting 44
U.S.C. § 3314)). If, as here, an agency desires to dispose of certain categories of records on a
recurring basis, it must obtain the Archivist’s approval to do so. See Off. of Sci. & Tech. Pol’y,
241 F. Supp. 3d at 18. Following the Archivist’s approval of a disposal schedule, an agency
26 must preserve records in accordance with that schedule. See 36 C.F.R. §§ 1225.10, 1226.10. It
may not unilaterally decide to adopt a different schedule to govern retention of the same
material. See id. § 1226.10; see also Citizens for Resp. & Ethics in Wash. v. U.S. Dep’t of
Homeland Sec., 592 F. Supp. 2d 111, 121 (D.D.C. 2009).
Yet, as discussed above, that appears to be precisely what CDC has done. Evidence
suggests that the Archivist approved CDC’s use of GRS 6.1 which requires the preservation, for
set periods of time, of essentially all of the emails created or stored by the agency’s lower-level
employees. Now, however, CDC says that it does not retain lower-level employees’ emails
pursuant to GRS 6.1, and instead uses a system under which employees’ emails are scheduled for
disposal based on their content. There is no evidence in the record that the Archivist approved
this alternate practice. 9 Thus, any emails disposed of pursuant to this alternate practice are likely
being disposed of unlawfully.
A second reason Plaintiff is likely to succeed is that it is far from clear that the traditional
records management approach that CDC purports to employ adequately preserves employees’
emails for the durations required by GRS 6.1. Even assuming that CDC employees are, in fact,
storing emails which constitute federal records elsewhere—and the Court has no reason to doubt
that they are, see See Off. of Sci. & Tech. Pol’y, 241 F. Supp. 3d at 21 (explaining that
“government employees . . . are entitled to the presumption that they complied with agency
policies, absent evidence to the contrary”)—there is no evidence that suggests that those records
are being retained for the time periods required by GRS 6.1. Because the evidence suggests that
9 Defendants are correct that CDC is by no means “required to follow the [GRS 6.1]”; the agency is “free to adopt [GRS 6.1] in part, in full, or not at all.” See Defs.’ Opp’n at 12. But once an agency does decide to adopt GRS 6.1 in full—and obtains the Archivist’s approval to do the same—the agency may not unilaterally change its mind and revert to a different recordkeeping policy.
27 the Archivist approved CDC’s use of GRS 6.1, it seems likely that the agency is required to
preserve its lower-level employees’ emails for three or seven years. Yet CDC cites no evidence
to suggest that—even if federal records are adequately being stored elsewhere—the agency is
also preserving those records for the timeframes that GRS 6.1 imposes. For this additional
reason, Plaintiff is likely to succeed in showing that CDC’s recordkeeping system and policy is
inadequate and unlawful under the FRA. See 36 C.F.R. § 1220.32 (requiring that agencies
maintain “usable records” “for the length of their authorized retention period”).
For all of these reasons, Plaintiff appears likely to succeed on the merits of both of its
claims. At this stage of the litigation, that is enough to tip the first factor in Plaintiff’s favor.
B. Irreparable Harm
Having found that Plaintiff is likely to succeed on both of its claims, the Court next
considers whether Plaintiff is likely to suffer irreparable harm in the absence of preliminary
relief. See Winter, 555 U.S. at 20. A showing of irreparable injury is “is the sine qua non for
obtaining a preliminary injunction” because it is what “justifies the extraordinary remedy of
granting relief before the parties have had the opportunity fully to develop the evidence and fully
to present their respective cases.” Meta Platforms, Inc. v. Fed. Trade Comm’n, No. 23-cv-3562,
2024 WL 1121424, at *7 (D.D.C. Mar. 15, 2024) (internal quotation marks and citations
omitted). The D.C. Circuit “has set a high standard for irreparable injury.” Chaplaincy of Full
Gospel Churches v. England, 454 F.3d 290, 297 (D.C. Cir. 2006) (quoting Wisc. Gas Co. v. Fed.
Elec. Reg. Comm’n, 758 F.2d 669, 674 (D.C. Cir. 1985) (per curiam)). The movant must show
that the injury complained of is “both certain and great,” as well as “actual and not theoretical.”
Mexichem Specialty Resins, Inc. v. Env’t Prot. Agency, 787 F.3d 544, 555 (D.C. Cir. 2015)
(quoting Chaplaincy of Full Gospel Churches, 454 F.3d at 297). The injury must, in other
28 words, be “of such imminence that there is a clear and present need for equitable relief to prevent
irreparable harm.” Id. (quoting Chaplaincy of Full Gospel Churches, 454 F.3d at 297); see also
Winter, 555 U.S. at 22 (explaining that plaintiff must “demonstrate that irreparable injury is
likely in the absence of an injunction,” not just that injury is a “possibility”). The injury “must
also be truly irreparable in the sense that it is ‘beyond remediation.’” Shaw v. Austin, 539 F.
Supp. 3d 169, 183 (D.D.C. 2021) (quoting Elec. Priv. Info. Ctr. v. Dep’t of Just., 15 F. Supp. 3d
32, 44 (D.D.C. 2014)).
Here, Plaintiff argues that CDC’s continued deletion of its former employees’ emails will
permanently deprive both Plaintiff and the public at large of access to federal records. See Pl.’s
Mot. at 16; see also Pl.’s Reply at 19–20 (arguing that “the primary irreparable harm here [is the]
harm [that] comes from the CDC’s ongoing denial of access to records that should be maintained
for public access”). They emphasize that the harm is accentuated by the fact that CDC’s
records—particularly the types of records that Plaintiff often requests under FOIA—are relevant
to “ongoing public debates.” Pl.’s Reply at 19.
The premise of Plaintiff’s argument—a premise which Defendants do not meaningfully
dispute—is that the loss or destruction of federal records is a significant harm to both Plaintiff
and the public, and that it is a harm that cannot be cured once the records are lost or destroyed.
Plaintiff’s premise is sound; records that have been destroyed or deleted are almost certain to
have been “lost forever to history.” Armstrong I, 924 F.2d at 288. Indeed, Defendants’ own
filings strongly suggest that it is exceedingly difficult, if not impossible, to recover records once
they have been deleted. See Defs.’ Opp’n at 18–19 (stating that if records “were deleted” it is
unlikely that “they could be recovered”). It is thus unsurprising that in circumstances analogous
to those presented here, courts have recognized the irreparable nature of the government’s failure
29 to properly preserve records while litigation is pending. See Citizens for Resp. & Ethics in Wash.
v. Off. of Admin., 565 F. Supp. 2d 23, 29–30 (D.D.C. 2008) (noting irreparable harm if records
are disposed of during litigation challenging the government’s treatment of those records); cf.
Citizens for Resp. & Ethics in Wash. v. Exec. Off. of President, 587 F. Supp. 2d 48, 59–61
(D.D.C. 2008) (finding “real and immediate” harm to plaintiff where plaintiff alleged that “e-
mails will be lost in the future” “unless adequate preservation guidelines are promulgated and a
recordkeeping system implemented” (citation omitted)).
A closer question—at least at this early stage of the litigation—is whether there exists a
significant likelihood that federal records are, in fact, being removed or deleted by CDC. If one
accepts Defendants’ contention that CDC adopted GRS 6.1 only in part, then there is a strong
argument that federal records are likely not being lost or destroyed. That is because CDC’s
stated record retention policy “requires employees to ensure” that any emails which constitute
federal records “are maintained only in official recordkeeping systems.” See Decl. of Mary
Wilson (“Wilson Decl.”) ¶ 4, ECF No. 13-1. “CDC does not consider [e]mail accounts to be
recordkeeping systems,” id., and thus the agency requires employees to determine which of their
emails “are or contain federal records” so that the employee may subsequently transfer those
emails that are or contain federal records to a separate, shared storage location, id. ¶ 13; see also
id. ¶ 4.
On this view, then, whatever federal records may be created in, pass through, or reside in
an employee’s email account are separately saved outside of the account and thus, when
Microsoft eventually deletes a former employee’s account, all of the records that resided in that
account have already been preserved elsewhere. This is apparently what NARA understood to
be happening when it closed its investigation into CDC’s recordkeeping policies and practices.
30 See Feb. 2024 Letter at 1 (“CDC does not require the preservation of all emails but rather
preserves all records from email accounts.”); see also First Brewer Decl. ¶ 17 (“My staff
evaluated CDC policies and found them in conformance with the FRA because they
appropriately exercise agency discretion to manage email records in proper recordkeeping
systems . . . .”); Second Brewer Decl. ¶ 13 (“CDC instructs non-Capstone employees to identify
and manage email records in appropriate recordkeeping systems based on their content, in
accordance with applicable, NARA-approved records schedules. Non-Capstone employees are
expected to manage their email on an ongoing basis by preserving and disposing of emails in
accordance with the applicable records schedule, based on agency policy and training.”).
The problem for Defendants is that, as explained above, the available evidence suggests
that CDC adopted GRS 6.1 wholesale, not just in part. 10 See supra Part IV.A.1.c. That is
significant because GRS 6.1 establishes that an email’s retention value—and the time period
over which an email needs to be preserved—is determined by reference to the “role of the
sender” as opposed to “the content of the email.” Second Brewer Decl. ¶ 12; see also Wilson
Decl. ¶ 6 (“Under [the Capstone] approach, final disposition of electronic records is based on the
role or position of the end user, not the content of each individual email records.”). The
traditional records management approach which CDC purports to follow, on the other hand,
bases an email’s retention value on the email’s contents, not the sender’s role. See Second
Brewer Decl. ¶ 12. It seems likely that this mismatch would lead to instances in which the
agency fails to preserve emails that it should be preserving under GRS 6.1, since GRS 6.1
10 At the very least, there is nothing in the record to suggest that NARA approved an alternate records retention and disposition program, meaning that CDC could only dispose of its lower-level employees’ emails pursuant to GRS 6.1. See Competitive Enter. Inst., 241 F. Supp. 3d at 18 (“Agencies may only dispose of records on terms approved by [NARA] . . . .”).
31 classifies all lower-level employees’ emails as having retention value, whereas the traditional
approach would seem to encompass at least a slightly smaller set of emails which, based on their
content, constitute federal records. See NARA, White Paper on the Capstone Approach and
Capstone GRS at 4 (April 2015) (available at https://bit.ly/3Jm5Nfm) (explaining that email
“often meets the definition of a federal record as provided in the Federal Records Act”).
Defendants’ arguments to the contrary miss the mark. They first argue that Plaintiff has
not shown irreparable injury because the past harm of which Plaintiff complains—CDC’s
allegedly inadequate response to the organization’s FOIA request and the unavailability of
documents responsive to that request—cannot be remedied given that the documents have been
destroyed. See Defs.’ Opp’n at 18–19. But Defendants fundamentally misunderstand the nature
of the harm claimed by Plaintiff. The harm Plaintiff seeks to avoid is the destruction of federal
records now and in the future; Plaintiff’s lawsuit is not a FOIA suit, and it does not aim to
recover documents that would have been responsive to Plaintiff’s years-old FOIA request. See
Pl.’s Reply at 20.
Defendants next argue that Plaintiff has not demonstrated a likelihood of ongoing or
future harm because it has not alleged that any of its pending FOIA requests to CDC—or any
FOIA requests it will file in the future—will “involve former non-Capstone CDC employees” or
their emails. See Defs.’ Opp’n at 19. But as Defendants themselves acknowledge, Plaintiff
alleges that it has “six pending FOIA lawsuits ‘seeking email records from HHS, the CDC, and
other HHS components.’” Id. (quoting Compl. ¶ 11). The list of officials who qualify as
Capstone officials is small; it is confined to only the most senior officials at CDC. See
Verification Form at 3–7. Most CDC employees are non-Capstone officials. See General
32 Records Schedule 6.1 at 5. It is simply not plausible that none of Plaintiff’s FOIA requests will
implicate the emails of the much larger group of individuals who are not Capstone officials.
Finally, Defendants argue that “Plaintiff’s lack of irreparable harm is . . . demonstrated by
Plaintiff’s delay in seeking this emergency relief.” See Defs.’ Opp’n at 20. There was, however,
no significant delay. NARA did not conclude its investigation into CDC’s recordkeeping
practices until February 23, 2024. See Feb. 2024 Letter at 1. While the investigation was
pending, Plaintiff could have assumed that NARA’s investigation would lead to a referral to the
Attorney General, thereby eliminating any need for Plaintiff to file a lawsuit aiming to compel
the same. When that turned out not to be the case, Plaintiff did not waste time, but rather filed
suit less than two months later. To be sure, there are instances in which courts have suggested
that delays of similar lengths “militate[d] against a finding of irreparable harm.” Mylan Pharms.,
Inc. v. Shalala, 81 F. Supp. 2d 30, 44 (D.D.C. 2000). But here, the Court agrees with Plaintiff
that, given the circumstances, the fact that Plaintiff did not immediately rush to federal court
does not diminish the likelihood of irreparable harm. See Pl.’s Reply at 21–22.
For these reasons, the Court concludes that Plaintiff has demonstrated that it “is likely to
suffer irreparable harm in the absence of preliminary relief.” See Winter, 555 U.S. at 20. The
second factor tilts in its favor.
C. Balance of the Equities and the Public Interest
Finally, Plaintiff must show “that the balance of equities tips in [its] favor, and that an
injunction is in the public interest.” Winter, 555 U.S. at 20. Under these factors, the Court must
“weigh[] the harm to [Plaintiff] if there is no injunction against the harm to the [government] if
there is.” Pursuing Am.’s Greatness v. Fed. Election Comm’n, 831 F.3d 500, 511 (D.C. Cir.
33 2016). The two factors “merge when the Government is the opposing party.” Guedes, 920 F.3d
at 10 (quoting Nken, 556 U.S. at 435).
The Court finds that, on balance, the third and fourth factors tip in Plaintiff’s favor. For
one thing, “[t]here is generally no public interest in the perpetuation of unlawful agency action.”
League of Women Voters, 838 F.3d at 12. On the contrary, “there is a substantial public interest
‘in having governmental agencies abide by the federal laws that govern their . . . operations.” Id.
(quoting Washington v. Reno, 35 F.3d 1093, 1103 (6th Cir. 1994)). Here, Plaintiff’s strong
likelihood of success on the merits of its claim that CDC is unlawfully and prematurely deleting
its former employees’ emails indicates that a preliminary injunction would serve the public
interest. See Shawnee Tribe v. Mnuchin, 984 F.3d 94, 102 (D.C. Cir. 2021) (explaining that “[a]
party’s likelihood of success on the merits is a strong indicator that a preliminary injunction
would serve the public interest because there is generally no public interest in the perpetuation of
unlawful agency action” (cleaned up)).
For another thing, Defendants do not meaningfully dispute Plaintiff’s contention that the
Government will not suffer any significant harm if required to preserve emails pursuant to GRS
6.1 or if ordered to request the Attorney General’s assistance in recovering previously deleted or
removed emails. See Pl.’s Mot. at 18. Despite Plaintiff’s assertions to the contrary, see id., it
seems likely that establishing a system by which to ensure that all employee emails are preserved
for the durations required by GRS 6.1 will impose at least some burden on HHS and CDC. It is
difficult to assess the extent of that burden, however, given Defendants’ lack of response to
Plaintiff’s briefing on the point. Accordingly, the Court agrees with Plaintiff that—whatever the
extent of the burden may be—it likely does not outweigh the harm that would inure to Plaintiff
34 (and the public at large) were CDC permitted to continue its practice of deleting former
employees’ emails while this litigation is pending.
***
All four factors weigh in favor of granting preliminary relief. Accordingly, the Court will
enjoin CDC from deleting or destroying the emails of its former lower-level employees before
the periods prescribed by GRS 6.1, unless and until the Archivist approves an alternate schedule
by which CDC shall manage the retention and disposal of such emails. See Armstrong II, 1 F.3d
at 1288 n.12 (affirming district court’s order enjoining “agencies from destroying any electronic
records . . . until the agencies came up with new, adequate records management guidelines to
replace the ones voided by the district court’s declaratory order”). Moreover, the Court will
order that the Archivist seek the assistance of the Attorney General (and provide notice to
Congress) so that, together, they may take all necessary steps to recover or seek other redress for
CDC’s past deletion of its former non-Capstone employees’ emails. See id. (affirming district
“court’s order requiring the Archivist immediately to seek the assistance of the Attorney General
and notify Congress of that action”). 11
11 Federal Rule of Civil Procedure 65(c) instructs that a court may issue a preliminary injunction “only if the movant gives security in an amount that the court considers proper to pay the costs and damages sustained by any party found to have been wrongfully enjoined.” Fed. R. Civ. P. 65(c). Notwithstanding the mandatory language of the rule, courts in this Circuit have held that the Rule “vest[s] broad discretion in the district court to determine the appropriate amount of an injunction bond,” DSE, Inc. v. United States, 169 F.3d 21, 33 (D.C. Cir. 1999), including the discretion to require no bond at all, Council on American–Islamic Rels. v. Gaubatz, 667 F. Supp. 2d 67, 81 (D.D.C. 2009); see also Fed. Prescription Serv., Inc. v. Am. Pharm. Ass’n, 636 F.2d 755, 759 (D.C. Cir. 1980) (“[T]he district court has power not only to set the amount of security but to dispense with any security requirement whatsoever where the restraint will do the defendant no material damage, where there has been no proof of likelihood of harm, and where the applicant for equitable relief has considerable assets and is . . . able to respond in damages if defendant does suffer damages by reason of a wrongful injunction.”) (cleaned up); Nat. Res. Def. Council, Inc. v. Morton, 337 F. Supp. 167, 168 (D.D.C. 1971) (“It is well settled that Rule 65(c) gives the Court wide discretion in the matter of requiring security.”). Plaintiff
35 V. CONCLUSION
For the foregoing reasons, Plaintiff’s Motion for a Preliminary Injunction (ECF No. 6) is
GRANTED. It is hereby ORDERED that CDC is enjoined from deleting or destroying former
non-Capstone employees’ emails until the time periods established by GRS 6.1 have passed or
pending further order of the Court upon the Archivist’s approval of an alternate disposal
schedule. It is FURTHER ORDERED that the Archivist shall seek the assistance of the
Attorney General (1) to recover—to the extent reasonably possible—the emails of former CDC
employees that have been prematurely destroyed or deleted and (2) to ensure the proper
preservation of emails when lower-level CDC employees leave the agency. An order consistent
with this Memorandum Opinion is separately and contemporaneously issued.
Dated: August 9, 2024 RUDOLPH CONTRERAS United States District Judge
asks that the Court exercise that discretion here, see Pl.’s Mot. at 19, and Defendants voice no opposition. The Court will therefore not require Plaintiff to post an injunction bond.