UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLUMBIA ____________________________________ ) EMERSON BRADLEY, individually, and ) on behalf of all others similarly situated, ) ) Plaintiff, ) ) v. ) Civil Action No. 22-3442 (RBW) ) UNITED STATES DEPARTMENT OF ) EDUCATION, ) ) Defendant. ) )
MEMORANDUM OPINION
The plaintiff, Emerson Bradley, brings this civil action against the defendant, the United
States Department of Education, on behalf of himself, but also seeks to bring it on behalf of all
others similarly situated to him, pursuant to the Privacy Act, 5 U.S.C. § 552a. See Class Action
Complaint (“Compl.”) at 1, ECF No. 2. 1 As to himself, the plaintiff alleges that his father
submitted fraudulent student loan applications listing the plaintiff as an endorser and that the
defendant violated the Privacy Act in its processing and handling of the allegedly fraudulent
student loans. See id. ¶¶ 24–34. Currently pending before the Court is the defendant’s motion to
dismiss. See Defendant’s Motion to Dismiss (“Def.’s Mot”), ECF No. 15. Upon careful
consideration of the parties’ submissions, 2 the Court concludes for the following reasons that it
must grant the defendant’s motion.
1 Although the plaintiff brings this matter as a putative class action, he has not yet moved for class certification. On February 24, 2023, the Court stayed the plaintiff’s deadline to file his motion for class certification pending resolution of the defendant’s motion to dismiss. See Minute (“Min.”) Order (Feb. 24, 2023). 2 In addition to the filings already identified, the Court considered the following submissions in rendering its decision: (1) the defendant’s Memorandum of Law in Support of Defendant’s Motion to Dismiss (“Def.’s Mem), ECF No. 15-1; (2) the Plaintiff’s Memorandum in Opposition to Defendant’s Rule 12(b)(1) and 12(b)(6) Motion to (continued . . .) I. BACKGROUND
A. Factual Background
The plaintiff claims that he is a victim of identity theft allegedly committed by his father.
See Compl. ¶¶ 24–34. He alleges that, between April 2012 and June 2020, his father, Lars D.
Bradley, “forged and fraudulently submitted” twelve “Endorser Addendum[s] for [ ] Federal
Direct Plus Loan[s]” to the defendant. Id. The plaintiff claims that he was listed on these
addendums as an endorser on these loans, despite his claim that he “has never borrowed money
through a federal student loan program, nor cosigned on any federal student loans.” Id. ¶ 35.
According to the plaintiff, each of the allegedly fraudulent Endorser Addendums “bore
multiple hallmarks of identity theft.” Id. ¶ 25. Specifically, the plaintiff contends that although
the endorser addendums included the plaintiff’s social security number, date of birth, and
driver’s license number, they listed his permanent address as a P.O. Box in San Diego,
California; listed his email address as “LARSBRADLEY@ATT.NET,”
“portuguesetranslator@icloud.com,” or provided no email address at all; provided telephone
numbers that he never used or was associated with; and claimed that his employer was the “U.S.
Navy,” despite the fact that at all relevant times he was serving on active duty with the U.S.
Army. Id. ¶¶ 24–34. The plaintiff alleges that, despite these indicators of fraud, the defendant
processed the student loan applications, leaving the plaintiff with an “outstanding co-signed
balance” of $492,000. See id.
The plaintiff alleges that he “did not become aware of any of the [f]raudulent [l]oans until
after December 2020[,] when he was denied a credit card,” id. ¶ 38, because the defendant
(. . . continued) Dismiss Complaint (“Pl.’s Opp’n”), ECF No. 19; (3) the Defendant’s Reply Brief In Support of Its Motion to Dismiss (“Def.’s Reply”), ECF No. 21; (4) the Defendant’s Supplemental Brief on Sovereign Immunity, ECF No. 32; and (5) the Plaintiff’s Response to Defendant’s Supplemental Brief on Sovereign Immunity, ECF No. 33.
2 purportedly reported the fraudulent Endorser Addendum information to consumer reporting
agencies, which negatively impacted the plaintiff’s ability to obtain credit, see id. ¶ 39.
After learning of the fraudulent loans and outstanding balance, the plaintiff took several
remedial steps. See id. ¶¶ 41–56. He filed a police report with his local sheriff’s office, id. ¶ 42;
he disputed the loans on May 28, 2021 with Nelnet, the company that serviced the loans for the
defendant, id. ¶ 43; and he submitted to several entities various affidavits, complaints, and
identity theft reports, id. ¶¶ 44–46, 48. In August 2021, the plaintiff allegedly received an email
from the defendant informing him that it “had no record of student loans in his name and
directing him to ‘work directly with the lender[, Nelnet,] to resolve [his] concerns.’” Id. ¶ 47.
However, sometime around September 2021, the plaintiff allegedly received a letter from the
defendant asserting that he was liable for repaying the loans in the amount of $341,117.47. Id.
¶ 49. The plaintiff “submitted another dispute” to the defendant in October 2021, id. ¶ 53, and,
on October 20, 2021, the defendant allegedly notified the plaintiff that it had “rejected his claim
[regarding the loans] and that [it] was still holding him responsible as a co-signer for the
[f]raudulent [l]oans,” id. ¶ 54. On February 3, 2022, the defendant sent a letter to the plaintiff
informing him that it was “still refusing to remove him from the [f]raudulent [l]oans and instead
[was] requesting [that he provide it] additional paperwork.” Id. ¶ 55. On July 24, 2022, the
plaintiff allegedly sent the defendant a “Loan Discharge Application—Forgery regarding the
Fraudulent Loans,” id. ¶ 56, but he claims the defendant has “repeatedly deemed” that he is
liable for the fraudulent loans, id. ¶ 57. The defendant filed his Complaint in this case on
November 9, 2022, alleging that by “disseminating information about [him] concerning the
[f]raudulent [l]oans, [the d]efendant materially and willfully misrepresented records about [the
p]laintiff that are covered under the Privacy Act.” Id. ¶ 58.
3 The plaintiff claims that he is not the only one victimized by the defendant’s “fail[ure] to
maintain a system with accurate records and adequate identity verification protocols.” Id. ¶ 10.
He alleges that there have been “tens of thousands” of reports of identity theft related to student
loans, “resulting in financial stress and confusion and pecuniary harm for countless Americans.”
Id. According to the plaintiff, the defendant “enabled this fraud through its knowing failure to
ensure the integrity and accuracy of information collected, stored, maintained, and disseminated
about [the p]laintiff and the [putative] class members.” Id. ¶ 13. The Complaint defines these
putative class members as:
All natural persons who (a) submitted an identity theft report under penalty of perjury to [the d]efendant within the two years before the filing of this action; (b) where the identity theft report identified one or more direct student loans as resulting from identity theft; (c) where [the d]efendant did not update its information systems to discharge the person from any obligation on the contested loans within three months of receiving that person’s identity theft report.
Id. ¶ 60.
B. Procedural Background
The plaintiff filed his Complaint on November 9, 2022. See id. at 1. The Complaint
seeks “actual damages of not less than $1,000 for [the plaintiff] and each member of the
[putative] Class[]” and “equitable and injunctive relief[,]” but the Complaint does not specify
what injunctive relief the plaintiff seeks. Id. at 23. On February 3, 2023, the plaintiff filed an
unopposed motion to enlarge the deadline to move for class certification, arguing that “[the
p]laintiff and the putative class need discovery to adequately prosecute the motion for class
certification.” Unopposed Motion to Enlarge Deadline to File Motion for Class Certification
at 2, ECF No. 13. The Court granted that motion on February 24, 2023, and stayed the deadline
for the plaintiff to move for class certification until further order of the Court. See Min. Order
(Feb. 24, 2023). On March 8, 2023, the defendant filed its motion to dismiss. See Def.’s Mot.
4 at 1. The plaintiff responded in opposition to the defendant’s motion to dismiss on April 12,
2023, see Pl.’s Opp’n at 1, and the defendant replied to the opposition on May 3, 2023, see
Def.’s Reply at 1. On August 2, 2024, the Court held a hearing on the motion to dismiss. See
Min. Entry (Aug. 2, 2024).
At the hearing, the defendant informed the Court that it had “authorized the removal of
[the plaintiff] from his father’s student loans as of December 13[,] 2021.” Transcript of Motion
Hearing (“Hr’g Tr.”) at 17:22–24, ECF No. 28. Counsel for the plaintiff then stated, “given our
understanding that the reporting [has] ceased, we are not seeking injunctive relief on behalf of
[the plaintiff].” Id. at 32:10–12. The Court ultimately denied the defendant’s motion to dismiss
without prejudice and ordered the parties to file a joint status report “indicating their proposed
scope of class-certification discovery.” Order at 1–2 (Aug. 5, 2024), ECF No. 27. On January
30, 2026, before entering an order on the scope of class-certification discovery, the Court granted
the defendant’s request to reinstate its motion to dismiss and to resolve the motion to dismiss
prior to making any class discovery determination. See Order at 1(Jan. 30, 2026), ECF No. 34.
II. STANDARD OF REVIEW
A Rule 12(b)(6) motion tests whether a complaint “state[s] a claim upon which relief can
be granted.” Fed. R. Civ. P. 12(b)(6). “To survive a motion to dismiss [under Rule 12(b)(6)], a
complaint must contain sufficient factual matter, accepted as true, to ‘state a claim to relief that is
plausible on its face.’” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v.
Twombly, 550 U.S. 544, 570 (2007)). A claim is facially plausible “when the plaintiff pleads
factual content that allows the court to draw [a] reasonable inference that the defendant is liable
for the misconduct alleged.” Id. (citing Twombly, 550 U.S. at 556).
5 In evaluating a motion to dismiss under Rule 12(b)(6), “the Court must construe the
complaint in favor of the plaintiff, who must be granted the benefit of all inferences that can be
derived from the facts alleged.” Hettinga v. United States, 677 F.3d 471, 476 (D.C. Cir. 2012)
(internal quotation marks omitted). While the Court must “assume [the] veracity” of any “well-
pleaded factual allegations” in a complaint, conclusory allegations “are not entitled to the
assumption of truth.” Iqbal, 556 U.S. at 679. Thus, “[t]hreadbare recitals of the elements of a
cause of action, supported by mere conclusory statements, do not suffice.” Id. at 678 (citing
Twombly, 550 U.S. at 555). Also, the Court need not accept “legal conclusions cast as factual
allegations,” or “inferences drawn by [the] plaintiff if those inferences are not supported by the
facts set out in the complaint.” Hettinga, 677 F.3d at 476. The Court “may consider only the
facts alleged in the complaint, any documents either attached to or incorporated in the
complaint[,] and matters of which [the Court] may take judicial notice.” 3 Equal Emp.
Opportunity Comm’n v. St. Francis Xavier Parochial Sch., 117 F.3d 621, 624 (D.C. Cir. 1997).
The Court may also consider documents incorporated by reference, which can occur “where the
document is not attached by the plaintiff, but is ‘referred to in the complaint and [ ] integral to
[the plaintiff’s] claim.” Banneker Ventures, LLC v. Graham, 798 F.3d 1119, 1133 (D.C. Cir.
2015) (quoting Kaempe v. Myers, 367 F.3d 958, 965 (D.C. Cir. 2004)) (alterations in original). 4
III. ANALYSIS
The defendant moves to dismiss the Complaint under both Federal Rule of Civil
Procedure 12(b)(1) and Federal Rule of Civil Procedure 12(b)(6). The defendant’s argument for
3 The plaintiff argues that, in its motion to dismiss, the defendant improperly introduced “alternate facts” that the Court cannot consider. Pl.’s Opp’n at 2. The Court, however, may take judicial notice of and consider public records, such as those posted on the Department of Education’s website. See Knapp Med. Ctr. v. Burwell, 192 F. Supp. 3d 129, 131 n.1 (D.D.C. 2016). The Court will do so here. 4 Accordingly, the Court will consider the Endorser Addendums themselves, which are repeatedly referenced throughout the Complaint and integral to the plaintiff’s claims.
6 dismissal under Rule 12(b)(1) is limited to the plaintiff’s claim for equitable and injunctive
relief, see Def.’s Mem. at 11–13, and, because the plaintiff indicated at oral argument that he is
no longer seeking injunctive relief, see Hr’g Tr. at 32, the Court need address only the
defendant’s arguments that it should dismiss the plaintiff’s damages claim under Rule 12(b)(6). 5
A. The Privacy Act
The Privacy Act “safeguards the public from unwarranted collection, maintenance, use
and dissemination of personal information contained in agency records.” Doe v. U.S. Dep’t of
Treasury, 706 F. Supp. 2d 1, 6 (quoting Bartel v. Fed. Aviation Admin., 725 F. 2d 1043, 1407
(D.C. Cir. 1984). To that end, the Privacy Act “allow[s] an individual to participate in ensuring
that his records are accurate and properly used” and “impos[es] responsibilities on federal
agencies to maintain their records accurately.” Id.
The plaintiff seeks monetary damages for six alleged violations of the Privacy Act related
to the defendant’s handling of the allegedly fraudulent student loans. See Compl. ¶ 86.
Specifically, he alleges that the defendant (1) did not maintain only relevant and necessary
information, as required by 5 U.S.C. § 552(a)(e)(1); (2) did not collect information, to the
greatest extent practicable, directly from the plaintiff and putative class members, as required by
5 U.S.C. § 552a(e)(2); (3) did not maintain accurate, relevant, timely, and complete records, as
required by 5 U.S.C. § 552a(e)(5); (4) did not make reasonable efforts to assure records are
accurate, relevant, timely, and complete before disseminating them, as required by 5 U.S.C.
§ 552a(e)(6); (5) did not establish appropriate administrative, technical, and physical safeguards
5 On August 5, 2024, the Court issued an Order directing the parties to submit briefing “addressing whether sovereign immunity bars the plaintiff’s Privacy Act claims for damages.” Order at 1 (Aug. 5, 2024), ECF No. 27. Because the Court has determined that the plaintiff has not adequately stated claims under the Privacy Act, the Court concludes that it need not address the issue of sovereign immunity.
7 to ensure the security and confidentiality of records and to protect against any anticipated threats
or hazards to their security or integrity which could result in substantial harm, embarrassment,
inconvenience, or unfairness, as required by 5 U.S.C. § 552a(e)(10), and (6) that the defendant
disclosed records to third parties without written consent and without a permissible purpose in
violation of 5 U.S.C. § 552a(b). Id.
For each claim, to obtain damages, the plaintiff “must establish: (1) a violation of a
Privacy Act provision, ‘(2) that the [agency’s] decision . . . was ‘intentional or willful,’ (3) that
the [violation] caused ‘adverse effects,’ and (4) that the plaintiff[ ] suffered actual damages.’”
Thompson v. Dep’t of State, 400 F. Supp. 2d 1, 8 (D.D.C. 2005), aff’d, 210 F. App’x 5 (D.C.
Cir. 2006) (quoting Albright v. United States, 732 F.2d 181, 184 (D.C. Cir. 1984)) (alterations in
original). However, for the claims under subsection 552a(e)(2) and 552a(e)(6), the plaintiff must
establish not an “adverse effect,” but an “adverse determination.” Id.
“The [Privacy] Act does not make the Government strictly liable for every affirmative or
negligent action that might be said technically to violate the Privacy Act’s provisions.” Albright,
732 F.2d at 189. The Privacy Act’s intentional or willful requirement “refers only to the
intentional or willful failure of the agency to abide by the Act, and not to all voluntary actions
which might otherwise inadvertently contravene the Act’s strictures.” Id. Thus, although the
Privacy Act’s intentional and willful requirement “does not require the [defendant] to set out
purposely to violate the [Privacy] Act,” Tijerina v. Walters, 821 F.2d 789, 799 (D.C. Cir. 1987),
it does require that the defendant’s actions were (1) “so patently egregious and unlawful that
anyone undertaking the conduct should have known it unlawful;” (2) “somewhat greater than
gross negligence,” (3) “committed without grounds for believing them to be lawful,” or (4) “in
8 flagrant disregard of others’ rights under the [Privacy] Act.” Maydak v. United States, 630 F.3d
166, 180 (D.C. Cir. 2010).
The defendant argues that the Complaint can be read as a “broad programmatic attack on
the [defendant’s] fraud prevention and relief mechanisms” or, given how the plaintiff defined the
putative class, as a narrower challenge to the defendant’s “processing speed of discharge
applications based on forgery.” Def.’s Mem. at 14–15. And, the defendant argues that, under
either interpretation, the plaintiff has not plausibly pleaded a cause of action. See id. As support
of its position, the defendant makes specific challenges to each claim, but also generally argues
that “[the p]laintiff’s theory on its face defies a finding of willfulness because [the defendant] did
not know, prior to receiving and reviewing [the p]laintiff’s notice to [the defendant] of the
forgery, that his father allegedly forged [the p]laintiff’s signature.” Def.’s Mem. at 1. The
plaintiff responds that “this claim only makes sense if the Court ignores the extensive and
detailed allegations” in the Complaint, including that the defendant
(1) knew of extensive and ongoing identity theft in its student loan programs, (2) took essentially no action to prevent the continuation of this identity theft, (3) approved virtually any loan application so long as the submission contained limited personal identifiable information easily obtainable by an identity thief, (4) ignored facial evidence of identity theft in numerous Endorser Addenda fraudulently submitted in Plaintiff’s name, and (5) continued to disclose false information about the Fraudulent Student Loans even after Plaintiff repeatedly disputed any obligation to Defendant.
Pl.’s Opp’n at 15–16.
With those overarching arguments in mind, the Court will address each of the defendant’s
specific challenges. But first, as a threshold matter, the Court notes that it interprets the
Complaint as an allegation that the defendant violated the Privacy Act by accepting, maintaining,
and disclosing fraudulent student loan information, rather than as a more limited allegation that
9 the defendant only violates the Privacy Act by maintaining fraudulent student loan information
in its records after it receives a claim that the loan is fraudulent.
1. Whether the Plaintiff Has Stated a Violation of 5 U.S.C. § 552a(e)(1)
Subsection (e)(1) of the Privacy Act requires an agency to “maintain in its records only
such information about an individual as is relevant and necessary to accomplish a purpose of the
agency required to be accomplished by statute or by executive order of the President.” 5 U.S.C.
§ 552a(e)(1). The plaintiff’s allegation that the defendant violated subsection (e)(1) is, as the
defendant argues, “threadbare.” See Compl. ¶ 86(B); Def.’s Mem. at 21. The Complaint does
not identify what information the defendant maintained that is not relevant and necessary, but his
theory for liability under subsection (e)(1) appears to be that the fraudulent information
contained in the Endorser Addendums is not relevant and necessary to any of the defendant’s
purposes because it is not accurate. But the Endorser Addendums themselves are plainly
relevant and necessary for the defendant to administer federal student loan programs and, as the
defendant correctly argues, subsection (e)(1), unlike other subsections, does not contain an
accuracy standard. See Def.’s Mem. at 21.
Moreover, the plaintiff has not established how the defendant’s maintenance of this
information had an “adverse effect” on him. Thompson, 400 F. Supp. 2d at 8. Although he
claims that he “would have had no need to expend time and money to dispute the [f]raudulent
[s]tudent [l]oans absent maintenance of information about those loans by [the d]efendant,” Pl.’s
Opp’n at 17, it is the purported disclosure of the inaccurate information to credit reporting
agencies, not its maintenance, that caused this allegedly adverse effect. Because subsection
(e)(1) does not require an agency to maintain only accurate records, and because the plaintiff has
not shown how the mere maintenance of the inaccurate records caused him an adverse effect, the
Court must dismiss the plaintiff’s claim based on 5 U.S.C. § 552a(e)(1).
10 2. Whether the Plaintiff Has Stated a Violation of 5 U.S.C. § 552a(e)(2)
Subsection (e)(2) of the Privacy Act requires an agency to “collect information to the
greatest extent practicable directly from the subject individual when the information may result
in adverse determinations about an individual’s rights, benefits, and privileges under Federal
programs.” 5 U.S.C. § 552a(e)(2). As the defendant points out, most cases alleging violations of
subsection (e)(2) involve investigations in which the government collected information from
someone other than the subject of the investigation. See Def.’s Mem. at 23–24. As with his
claim under subsection (e)(1), the plaintiff’s claim under subsection (e)(2) is a threadbare recital
of the statute claiming that the defendant “fail[ed] to collect information to the greatest extent
practicable directly from the [p]laintiff and class members when the information may result in
adverse determinations about their rights, benefits, and privileges under Federal programs.”
Compl. ¶ 86(C). The alleged violation appears to be that the defendant did not collect
information in the Endorser Addendums from the plaintiff but rather from his father, who was
posing as the plaintiff.
The defendant argues that it “does not intentionally and willfully violate subsection (e)(2)
when it is defrauded because someone other than the endorser completed the Endorser
Addendum.” Def.’s Mem. at 23. The plaintiff responds that “[the] neglect of [the d]efendant’s
statutory obligations [under subsection (e)(2)] occurred (and continues to occur) while
[the d]efendant received tens of thousands of identity theft disputes per year and enabled the
theft of billions of dollars of student loan funds by identity thieves.” Pl.’s Opp’n at 18. The
plaintiff’s argument, therefore, is that the mere receipt of fraudulent information from “identity
thieves” is an intentional and willful violation of subsection (e)(2). See id. The plaintiff
provides no caselaw to support this theory, and the Court is aware of none. The Court therefore
concludes that unwittingly receiving information from an impostor or identity thief is not a
11 willful and intentional violation of subsection (e)(2) and must therefore dismiss the plaintiff’s
claims based on that subsection.
3. Whether the Plaintiff Has Stated a Violation of 5 U.S.C. § 552a(e)(5)
Subsection (e)(5) of the Privacy Act requires an agency to “maintain all records which
are used by the agency in making any determination about any individual with such accuracy,
relevance, timeliness, and completeness as is reasonably necessary to assure fairness to the
individual in the determination.” 5 U.S.C. § 552a(e)(5). “Subsection g(1)(C) provides a civil
remedy if an agency fails to satisfy the standard in subsection (e)(5) ‘and consequently a
determination is made which is adverse to the individual.’” Deters v. U.S. Parole Comm’n, 85 F.
3d 655, 657 (D.C. Cir. 1996) (quoting 5 U.S.C. § 552a(g)(1)(C)).
The plaintiff alleges that the defendant “fail[ed] to maintain Student Loan Information [ ]
with such accuracy, relevance, timeliness, and completeness as is reasonably necessary to assure
fairness to [the p]laintiff and the [putative] class when making Department determinations about
[the p]laintiff and the [putative] class members.” Compl. ¶ 86(d). The defendant argues in
response, as indicated above, that the plaintiff “has not plausibly alleged that any alleged
violation of this subsection was intentional or willful.” Def.’s Mem. at 16.
According to the defendant, “there is no allegation in the Complaint that the Department
knew the Endorser Addendums were fraudulent when it reported information from them to
consumer reporting agencies.” Def.’s Mem. at 16–17. Because the defendant contends that it
did not know the information was false, it argues that it could not have intentionally or willfully
failed to maintain accurate records. See id. Going a step further, the defendant argues that “[i]f
the mere receipt by an agency of an application for a government benefit which might later be
shown to contain information that is false were enough to intentionally and willfully maintain
inaccurate records” then “every agency that administers a government benefit program would be
12 liable for damages under the Privacy Act every time it ingests an application for the benefit into
its record systems.” Id. at 17.
The plaintiff responds that the Complaint states a claim because he alleged that the
defendant acted willfully and intentionally when it “accepted and approved virtually all student
loan applications without conducting even rudimentary identity verification [and] ignored facial
evidence of identity theft in numerous fraudulent Endorser Addend[ums] submitted in
[the p]laintiff’s name. Pl.s’ Opp’n at 20–21. The plaintiff further argues that the defendant
“willfully failed to prevent identity theft and then spent eighteen months outright rejecting [the
p]laintiff’s claims of identity theft.” Id. at 21.
But, as the defendant correctly argues, the hallmarks of identity theft in the Endorser
Addendums alleged by the plaintiff do not amount to some level of indifference by the defendant
because “none of those pieces of information would have indicated on their face that Lars
Bradley fraudulently filled out and signed the endorser addendum for his son.” Def.’s Mem. at
17–18. Although arguably the defendant should have further investigated the information in the
Endorser Addendums, the Privacy Act’s intentional and willful standard requires more than mere
negligence. The Court must therefore dismiss the plaintiff’s claims based on subsection (e)(5).
4. Whether the Plaintiff Has Stated a Violation of 5 U.S.C. § 552a(e)(6)
Subsection (e)(6) of the Privacy Act requires that an agency “prior to disseminating any
record about an individual to any person other than an agency . . . make reasonable efforts to
assure that such records are accurate, complete, timely, and relevant for agency purposes.” 5
U.S.C. § 552a(e)(6). The plaintiff’s theory of liability under this subsection is that the defendant
did not make reasonable efforts to ensure the accuracy of the Endorser Addendums before
disseminating them to credit reporting agencies. See Compl. ¶ 72. The defendant argues that it
did not intentionally and willfully violate subsection (e)(6) because “any alleged disclosure of
13 the fraudulent Endorser Addendums occurred before [the defendant] was put on notice that they
were fraudulent.” Def.’s Mem. at 24. The defendant claims that “it was reasonable for [it] to
assume the Endorser Addendums associated with Lars Bradley’s student loans were valid and
accurate before it received and investigated Plaintiff’s claim suggesting otherwise.” Id. The
plaintiff responds that he “provided multiple indicia of why [the d]efendant was on notice that
the Fraudulent Loan information was inaccurate and yet [the d]efendant failed to take any
meaningful steps to verify this information.” Pl.’s Opp’n at 25.
The plaintiff’s argument is merely that the defendant should have known the information
in the Endorser Addendums was inaccurate or should have done more to ensure its accuracy
before disseminating them to credit reporting agencies. But the statute requires only that the
defendant make “reasonable efforts” to ensure accuracy and completeness. 5 U.S.C.
§ 552a(e)(6). The Court agrees with the defendant that requiring the co-signer’s address,
personal telephone number, and employment information on the Endorser Addendums, see
Compl. ¶¶ 25–34, is a reasonable effort to ensure accuracy. And here, the defendant is only
alleged to have disseminated this information before the plaintiff notified it that the information
was potentially fraudulent. See id. ¶¶ 36–39.
Even if these procedures do not amount to “reasonable efforts” to assure accuracy, the
plaintiff still has not provided facts from which the Court can draw an inference that the
defendant acted willfully or intentionally. The cases the plaintiff relies upon alleged
substantially more that amounted to “willful” or “intentional” conduct than what is alleged here.
See Peter B. v. Cent. Intel. Agency., 620 F. Supp. 2d 58, 65 (D.D.C. 2009) (alleging that the
defendant agency disseminated false information “for the purpose of causing [the plaintiff’s]
potential employer to either never provide [him] with an offer of employment or withdraw any
14 such offer that had been provided”); Fleck v. Dep’t of Veterans Affs. Off. of Inspector Gen., 596
F. Supp. 3d 24, 48, 53 (D.D.C. 2022) (alleging that the defendant agency undertook an
investigation into the plaintiff “only with an eye toward substantiating the allegations against
him rather than providing a complete account of his [potential] culpability” and disseminated a
report which “contain[ed] numerous inaccurate statements . . . and omit[ted] exculpatory and
mitigating evidence”). 6 Here, by contrast, there is no indication that the defendant disseminated
the information for the purpose of causing harm to the plaintiff. See id. Because there is no
allegation that the defendant knew the information in the Endorser Addendums was inaccurate at
the time it disseminated that information to the credit reporting agencies, the plaintiff has not
adequately pleaded willfulness or intentionality. Therefore, the Court must dismiss the
plaintiff’s claims based on subsection (e)(6).
5. Whether the Plaintiff Has Stated a Violation of 5 U.S.C. § 552a(e)(10)
Subsection (e)(10) of the Privacy Act requires that an agency “establish appropriate
administrative, technical, and physical safeguards to ensure the security and confidentiality of
records and to protect against any anticipated threats or hazards to their security or integrity
which could result in substantial harm, embarrassment, inconvenience, or unfairness to any
individual on whom information is maintained.” 5 U.S.C. § 552a(e)(10). In claims brought
under this subsection, the plaintiff must “identify a rule or safeguard . . . that [the Department]
should have established but did not.” Dick v. Holder, 67 F. Supp. 3d 167, 186 (D.D.C. 2014).
The defendant argues that the plaintiff has not stated a plausible claim under subsection
(e)(10), a subsection it contends is “normally invoked in the context of data breaches[,]” because
6 The plaintiff also relies on Tripp v. Dep’t of Def., 219 F. Supp. 2d 85 (D.D.C. 2006), a case decided before Twombly and Iqbal, in which the Court denied a motion to dismiss numerous Privacy Act claims. That case, however, did not independently assess the substance of the subsection (e)(6) claim beyond concluding that it was “sufficient for purposes of Rule 8” as it was construed under the prior pleading standard. Id. at 91.
15 “he does not allege any harm suffered as a result of a data breach, allege that any such breach
occurred, or identify any rule or safeguard that the [defendant] should have implemented but did
not.” Def.’s Mem. at 27.
The plaintiff responds that “[p]ermitting widespread submission of false and fraudulent
Student Loan Information via identity theft necessarily damages the integrity of records
maintained by the [d]efendant,” in violation of subsection (e)(10). Pl.’s Opp’n at 27. But
subsection (e)(10) is not concerned with the “submission” of records, rather it is concerned with
the safety and security of records already in an agency’s possession. See 5 U.S.C. § 552a(e)(10).
The plaintiff’s reliance on data breach cases finding willful or intentional failures to safeguard
information is therefore misplaced. See Pl.’s Opp’n at 27–28. Indeed, the plaintiff does not
allege that his personal information was stolen as a result of the defendant’s failure to “protect
against any anticipated threats or hazards,” 5 U.S.C. § 552a(e)(10), but rather was committed by
his father before he allegedly submitted the fraudulent student loan applications, see Compl.
¶¶ 25–34. Therefore, the Court must dismiss the plaintiff’s claims based on subsection (e)(10).
6. Whether the Plaintiff Has Stated a Violation of 5 U.S.C. § 552a(b)
Subsection (b) of the Privacy Act provides that “[n]o agency shall disclose any record
which is contained in a system of records by any means of communication to any person, or to
another agency, except pursuant to a written request by, or with the prior written consent of, the
individual to whom the record pertains” unless certain exceptions are satisfied. 5 U.S.C.
§ 552a(b). The defendant does not argue that any of those exceptions apply here, but rather
contends that “[i]nformation about the endorser is disclosed to consumer reporting agencies
pursuant to written consent provided by the endorser in signing the Endorser Addendum,” Def.’s
Mem. at 25, and, therefore, it “had consent to disclose the Endorser Addendum information at
issue here,” id. at 26.
16 The plaintiff does not dispute that the Endorser Addendums indicate that the endorser
authorizes the defendant to report information about the loan to credit reporting agencies, but
rather argues that “a forged disclosure authorization [does not] equate[] to Plaintiff’s written
consent to disclosure.” Pl.’s Opp’n at 15. But, the plaintiff provides no authority to support his
expansive theory that a federal agency willfully or intentionally violated the Privacy Act by
relying on a signed form authorizing disclosure of the records, and the Court is aware of none.
To the contrary, “this Circuit has said that when an agency discloses records pursuant to its
unchallenged regulations, or in response to a request that it justifiably believed to be
authorized—as was the case here—the disclosing agency can’t have willfully violated the
Privacy Act.” Alexander v. Fed. Bureau of Investigation, 691 F. Supp. 2d 182, 191 (D.D.C.
2010), aff’d, 456 F. App’x 1 (D.C. Cir. 2011). Accordingly, the Court must dismiss the
plaintiff’s claim based on 5 U.S.C. § 552a(b).
IV. CONCLUSION
For the foregoing reasons, the Court grants the defendant’s motion to dismiss.
SO ORDERED this 23rd day of March, 2026. 7
REGGIE B. WALTON United States District Judge
7 The Court will contemporaneously issue an Order consistent with this Memorandum Opinion.