UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLUMBIA
____________________________________
)
EMERSON BRADLEY, individually, and ) on behalf of all others similarly situated, )
)
Plaintiff, )
)
v. ) Civil Action No. 22-3442 (RBW)
)
UNITED STATES DEPARTMENT OF ) EDUCATION, )
)
Defendant. )
)
MEMORANDUM OPINION
The plaintiff, Emerson Bradley, brings this civil action against the defendant, the United States Department of Education, on behalf of himself, but also seeks to bring it on behalf of all others similarly situated to him, pursuant to the Privacy Act, 5 U.S.C. § 552a. See Class Action Complaint (“Compl.”) at 1, ECF No. 2. 1 As to himself, the plaintiff alleges that his father submitted fraudulent student loan applications listing the plaintiff as an endorser and that the defendant violated the Privacy Act in its processing and handling of the allegedly fraudulent student loans. See id. ¶¶ 24–34. Currently pending before the Court is the defendant’s motion to dismiss. See Defendant’s Motion to Dismiss (“Def.’s Mot”), ECF No. 15. Upon careful consideration of the parties’ submissions, 2 the Court concludes for the following reasons that it must grant the defendant’s motion.
1 Although the plaintiff brings this matter as a putative class action, he has not yet moved for class certification. On February 24, 2023, the Court stayed the plaintiff’s deadline to file his motion for class certification pending resolution of the defendant’s motion to dismiss. See Minute (“Min.”) Order (Feb. 24, 2023). 2 In addition to the filings already identified, the Court considered the following submissions in rendering its decision: (1) the defendant’s Memorandum of Law in Support of Defendant’s Motion to Dismiss (“Def.’s Mem), ECF No. 15-1; (2) the Plaintiff’s Memorandum in Opposition to Defendant’s Rule 12(b)(1) and 12(b)(6) Motion to (continued . . .)
I. BACKGROUND
A. Factual Background The plaintiff claims that he is a victim of identity theft allegedly committed by his father.
See Compl. ¶¶ 24–34. He alleges that, between April 2012 and June 2020, his father, Lars D. Bradley, “forged and fraudulently submitted” twelve “Endorser Addendum[s] for [ ] Federal Direct Plus Loan[s]” to the defendant. Id. The plaintiff claims that he was listed on these addendums as an endorser on these loans, despite his claim that he “has never borrowed money through a federal student loan program, nor cosigned on any federal student loans.” Id. ¶ 35.
According to the plaintiff, each of the allegedly fraudulent Endorser Addendums “bore multiple hallmarks of identity theft.” Id. ¶ 25. Specifically, the plaintiff contends that although the endorser addendums included the plaintiff’s social security number, date of birth, and driver’s license number, they listed his permanent address as a P.O. Box in San Diego, California; listed his email address as “LARSBRADLEY@ATT.NET,” “portuguesetranslator@icloud.com,” or provided no email address at all; provided telephone numbers that he never used or was associated with; and claimed that his employer was the “U.S. Navy,” despite the fact that at all relevant times he was serving on active duty with the U.S. Army. Id. ¶¶ 24–34. The plaintiff alleges that, despite these indicators of fraud, the defendant processed the student loan applications, leaving the plaintiff with an “outstanding co-signed balance” of $492,000. See id.
The plaintiff alleges that he “did not become aware of any of the [f]raudulent [l]oans until after December 2020[,] when he was denied a credit card,” id. ¶ 38, because the defendant
(. . . continued) Dismiss Complaint (“Pl.’s Opp’n”), ECF No. 19; (3) the Defendant’s Reply Brief In Support of Its Motion to Dismiss (“Def.’s Reply”), ECF No. 21; (4) the Defendant’s Supplemental Brief on Sovereign Immunity, ECF No. 32; and (5) the Plaintiff’s Response to Defendant’s Supplemental Brief on Sovereign Immunity, ECF No. 33.
3
purportedly reported the fraudulent Endorser Addendum information to consumer reporting agencies, which negatively impacted the plaintiff’s ability to obtain credit, see id. ¶ 39.
After learning of the fraudulent loans and outstanding balance, the plaintiff took several remedial steps. See id. ¶¶ 41–56. He filed a police report with his local sheriff’s office, id. ¶ 42; he disputed the loans on May 28, 2021 with Nelnet, the company that serviced the loans for the defendant, id. ¶ 43; and he submitted to several entities various affidavits, complaints, and identity theft reports, id. ¶¶ 44–46, 48. In August 2021, the plaintiff allegedly received an email from the defendant informing him that it “had no record of student loans in his name and directing him to ‘work directly with the lender[, Nelnet,] to resolve [his] concerns.’” Id. ¶ 47. However, sometime around September 2021, the plaintiff allegedly received a letter from the defendant asserting that he was liable for repaying the loans in the amount of $341,117.47. Id. ¶ 49. The plaintiff “submitted another dispute” to the defendant in October 2021, id. ¶ 53, and, on October 20, 2021, the defendant allegedly notified the plaintiff that it had “rejected his claim [regarding the loans] and that [it] was still holding him responsible as a co-signer for the [f]raudulent [l]oans,” id. ¶ 54. On February 3, 2022, the defendant sent a letter to the plaintiff informing him that it was “still refusing to remove him from the [f]raudulent [l]oans and instead [was] requesting [that he provide it] additional paperwork.” Id. ¶ 55. On July 24, 2022, the plaintiff allegedly sent the defendant a “Loan Discharge Application—Forgery regarding the Fraudulent Loans,” id. ¶ 56, but he claims the defendant has “repeatedly deemed” that he is liable for the fraudulent loans, id. ¶ 57. The defendant filed his Complaint in this case on November 9, 2022, alleging that by “disseminating information about [him] concerning the [f]raudulent [l]oans, [the d]efendant materially and willfully misrepresented records about [the p]laintiff that are covered under the Privacy Act.” Id. ¶ 58.
4
The plaintiff claims that he is not the only one victimized by the defendant’s “fail[ure] to maintain a system with accurate records and adequate identity verification protocols.” Id. ¶ 10. He alleges that there have been “tens of thousands” of reports of identity theft related to student loans, “resulting in financial stress and confusion and pecuniary harm for countless Americans.” Id. According to the plaintiff, the defendant “enabled this fraud through its knowing failure to ensure the integrity and accuracy of information collected, stored, maintained, and disseminated about [the p]laintiff and the [putative] class members.” Id. ¶ 13. The Complaint defines these putative class members as:
All natural persons who (a) submitted an identity theft report under penalty of perjury to [the d]efendant within the two years before the filing of this action; (b)
where the identity theft report identified one or more direct student loans as resulting from identity theft; (c) where [the d]efendant did not update its information systems to discharge the person from any obligation on the contested loans within three months of receiving that person’s identity theft report.
Id. ¶ 60. B. Procedural Background The plaintiff filed his Complaint on November 9, 2022. See id. at 1. The Complaint seeks “actual damages of not less than $1,000 for [the plaintiff] and each member of the [putative] Class[]” and “equitable and injunctive relief[,]” but the Complaint does not specify what injunctive relief the plaintiff seeks. Id. at 23. On February 3, 2023, the plaintiff filed an unopposed motion to enlarge the deadline to move for class certification, arguing that “[the p]laintiff and the putative class need discovery to adequately prosecute the motion for class certification.” Unopposed Motion to Enlarge Deadline to File Motion for Class Certification at 2, ECF No. 13. The Court granted that motion on February 24, 2023, and stayed the deadline for the plaintiff to move for class certification until further order of the Court. See Min. Order (Feb. 24, 2023). On March 8, 2023, the defendant filed its motion to dismiss. See Def.’s Mot.
5
at 1. The plaintiff responded in opposition to the defendant’s motion to dismiss on April 12, 2023, see Pl.’s Opp’n at 1, and the defendant replied to the opposition on May 3, 2023, see Def.’s Reply at 1. On August 2, 2024, the Court held a hearing on the motion to dismiss. See Min. Entry (Aug. 2, 2024).
At the hearing, the defendant informed the Court that it had “authorized the removal of [the plaintiff] from his father’s student loans as of December 13[,] 2021.” Transcript of Motion Hearing (“Hr’g Tr.”) at 17:22–24, ECF No. 28. Counsel for the plaintiff then stated, “given our understanding that the reporting [has] ceased, we are not seeking injunctive relief on behalf of [the plaintiff].” Id. at 32:10–12. The Court ultimately denied the defendant’s motion to dismiss without prejudice and ordered the parties to file a joint status report “indicating their proposed scope of class-certification discovery.” Order at 1–2 (Aug. 5, 2024), ECF No. 27. On January 30, 2026, before entering an order on the scope of class-certification discovery, the Court granted the defendant’s request to reinstate its motion to dismiss and to resolve the motion to dismiss prior to making any class discovery determination. See Order at 1(Jan. 30, 2026), ECF No. 34.
II. STANDARD OF REVIEW A Rule 12(b)(6) motion tests whether a complaint “state[s] a claim upon which relief can be granted.” Fed. R. Civ. P. 12(b)(6). “To survive a motion to dismiss [under Rule 12(b)(6)], a complaint must contain sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.’” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)). A claim is facially plausible “when the plaintiff pleads factual content that allows the court to draw [a] reasonable inference that the defendant is liable for the misconduct alleged.” Id. (citing Twombly, 550 U.S. at 556).
6
In evaluating a motion to dismiss under Rule 12(b)(6), “the Court must construe the complaint in favor of the plaintiff, who must be granted the benefit of all inferences that can be derived from the facts alleged.” Hettinga v. United States, 677 F.3d 471, 476 (D.C. Cir. 2012) (internal quotation marks omitted). While the Court must “assume [the] veracity” of any “well- pleaded factual allegations” in a complaint, conclusory allegations “are not entitled to the assumption of truth.” Iqbal, 556 U.S. at 679. Thus, “[t]hreadbare recitals of the elements of a cause of action, supported by mere conclusory statements, do not suffice.” Id. at 678 (citing Twombly, 550 U.S. at 555). Also, the Court need not accept “legal conclusions cast as factual allegations,” or “inferences drawn by [the] plaintiff if those inferences are not supported by the facts set out in the complaint.” Hettinga, 677 F.3d at 476. The Court “may consider only the facts alleged in the complaint, any documents either attached to or incorporated in the complaint[,] and matters of which [the Court] may take judicial notice.” 3 Equal Emp. Opportunity Comm’n v. St. Francis Xavier Parochial Sch., 117 F.3d 621, 624 (D.C. Cir. 1997). The Court may also consider documents incorporated by reference, which can occur “where the document is not attached by the plaintiff, but is ‘referred to in the complaint and [ ] integral to [the plaintiff’s] claim.” Banneker Ventures, LLC v. Graham, 798 F.3d 1119, 1133 (D.C. Cir. 2015) (quoting Kaempe v. Myers, 367 F.3d 958, 965 (D.C. Cir. 2004)) (alterations in original). 4 III. ANALYSIS
The defendant moves to dismiss the Complaint under both Federal Rule of Civil Procedure 12(b)(1) and Federal Rule of Civil Procedure 12(b)(6). The defendant’s argument for
3 The plaintiff argues that, in its motion to dismiss, the defendant improperly introduced “alternate facts” that the Court cannot consider. Pl.’s Opp’n at 2. The Court, however, may take judicial notice of and consider public records, such as those posted on the Department of Education’s website. See Knapp Med. Ctr. v. Burwell, 192 F. Supp. 3d 129, 131 n.1 (D.D.C. 2016). The Court will do so here. 4 Accordingly, the Court will consider the Endorser Addendums themselves, which are repeatedly referenced throughout the Complaint and integral to the plaintiff’s claims.
7
dismissal under Rule 12(b)(1) is limited to the plaintiff’s claim for equitable and injunctive relief, see Def.’s Mem. at 11–13, and, because the plaintiff indicated at oral argument that he is no longer seeking injunctive relief, see Hr’g Tr. at 32, the Court need address only the defendant’s arguments that it should dismiss the plaintiff’s damages claim under Rule 12(b)(6). 5 A. The Privacy Act The Privacy Act “safeguards the public from unwarranted collection, maintenance, use and dissemination of personal information contained in agency records.” Doe v. U.S. Dep’t of Treasury, 706 F. Supp. 2d 1, 6 (quoting Bartel v. Fed. Aviation Admin., 725 F. 2d 1043, 1407 (D.C. Cir. 1984). To that end, the Privacy Act “allow[s] an individual to participate in ensuring that his records are accurate and properly used” and “impos[es] responsibilities on federal agencies to maintain their records accurately.” Id.
The plaintiff seeks monetary damages for six alleged violations of the Privacy Act related to the defendant’s handling of the allegedly fraudulent student loans. See Compl. ¶ 86. Specifically, he alleges that the defendant (1) did not maintain only relevant and necessary information, as required by 5 U.S.C. § 552(a)(e)(1); (2) did not collect information, to the greatest extent practicable, directly from the plaintiff and putative class members, as required by 5 U.S.C. § 552a(e)(2); (3) did not maintain accurate, relevant, timely, and complete records, as required by 5 U.S.C. § 552a(e)(5); (4) did not make reasonable efforts to assure records are accurate, relevant, timely, and complete before disseminating them, as required by 5 U.S.C. § 552a(e)(6); (5) did not establish appropriate administrative, technical, and physical safeguards
5 On August 5, 2024, the Court issued an Order directing the parties to submit briefing “addressing whether sovereign immunity bars the plaintiff’s Privacy Act claims for damages.” Order at 1 (Aug. 5, 2024), ECF No. 27. Because the Court has determined that the plaintiff has not adequately stated claims under the Privacy Act, the Court concludes that it need not address the issue of sovereign immunity.
8
to ensure the security and confidentiality of records and to protect against any anticipated threats or hazards to their security or integrity which could result in substantial harm, embarrassment, inconvenience, or unfairness, as required by 5 U.S.C. § 552a(e)(10), and (6) that the defendant disclosed records to third parties without written consent and without a permissible purpose in violation of 5 U.S.C. § 552a(b). Id.
For each claim, to obtain damages, the plaintiff “must establish: (1) a violation of a Privacy Act provision, ‘(2) that the [agency’s] decision . . . was ‘intentional or willful,’ (3) that the [violation] caused ‘adverse effects,’ and (4) that the plaintiff[ ] suffered actual damages.’” Thompson v. Dep’t of State, 400 F. Supp. 2d 1, 8 (D.D.C. 2005), aff’d, 210 F. App’x 5 (D.C. Cir. 2006) (quoting Albright v. United States, 732 F.2d 181, 184 (D.C. Cir. 1984)) (alterations in original). However, for the claims under subsection 552a(e)(2) and 552a(e)(6), the plaintiff must establish not an “adverse effect,” but an “adverse determination.” Id.
“The [Privacy] Act does not make the Government strictly liable for every affirmative or negligent action that might be said technically to violate the Privacy Act’s provisions.” Albright, 732 F.2d at 189. The Privacy Act’s intentional or willful requirement “refers only to the intentional or willful failure of the agency to abide by the Act, and not to all voluntary actions which might otherwise inadvertently contravene the Act’s strictures.” Id. Thus, although the Privacy Act’s intentional and willful requirement “does not require the [defendant] to set out purposely to violate the [Privacy] Act,” Tijerina v. Walters, 821 F.2d 789, 799 (D.C. Cir. 1987), it does require that the defendant’s actions were (1) “so patently egregious and unlawful that anyone undertaking the conduct should have known it unlawful;” (2) “somewhat greater than gross negligence,” (3) “committed without grounds for believing them to be lawful,” or (4) “in
9
flagrant disregard of others’ rights under the [Privacy] Act.” Maydak v. United States, 630 F.3d 166, 180 (D.C. Cir. 2010).
The defendant argues that the Complaint can be read as a “broad programmatic attack on the [defendant’s] fraud prevention and relief mechanisms” or, given how the plaintiff defined the putative class, as a narrower challenge to the defendant’s “processing speed of discharge applications based on forgery.” Def.’s Mem. at 14–15. And, the defendant argues that, under either interpretation, the plaintiff has not plausibly pleaded a cause of action. See id. As support of its position, the defendant makes specific challenges to each claim, but also generally argues that “[the p]laintiff’s theory on its face defies a finding of willfulness because [the defendant] did not know, prior to receiving and reviewing [the p]laintiff’s notice to [the defendant] of the forgery, that his father allegedly forged [the p]laintiff’s signature.” Def.’s Mem. at 1. The plaintiff responds that “this claim only makes sense if the Court ignores the extensive and detailed allegations” in the Complaint, including that the defendant
(1) knew of extensive and ongoing identity theft in its student loan programs, (2)
took essentially no action to prevent the continuation of this identity theft, (3)
approved virtually any loan application so long as the submission contained limited personal identifiable information easily obtainable by an identity thief, (4)
ignored facial evidence of identity theft in numerous Endorser Addenda fraudulently submitted in Plaintiff’s name, and (5) continued to disclose false information about the Fraudulent Student Loans even after Plaintiff repeatedly disputed any obligation to Defendant.
Pl.’s Opp’n at 15–16.
With those overarching arguments in mind, the Court will address each of the defendant’s specific challenges. But first, as a threshold matter, the Court notes that it interprets the Complaint as an allegation that the defendant violated the Privacy Act by accepting, maintaining, and disclosing fraudulent student loan information, rather than as a more limited allegation that
10
the defendant only violates the Privacy Act by maintaining fraudulent student loan information in its records after it receives a claim that the loan is fraudulent.
1. Whether the Plaintiff Has Stated a Violation of 5 U.S.C. § 552a(e)(1)
Subsection (e)(1) of the Privacy Act requires an agency to “maintain in its records only such information about an individual as is relevant and necessary to accomplish a purpose of the agency required to be accomplished by statute or by executive order of the President.” 5 U.S.C. § 552a(e)(1). The plaintiff’s allegation that the defendant violated subsection (e)(1) is, as the defendant argues, “threadbare.” See Compl. ¶ 86(B); Def.’s Mem. at 21. The Complaint does not identify what information the defendant maintained that is not relevant and necessary, but his theory for liability under subsection (e)(1) appears to be that the fraudulent information contained in the Endorser Addendums is not relevant and necessary to any of the defendant’s purposes because it is not accurate. But the Endorser Addendums themselves are plainly relevant and necessary for the defendant to administer federal student loan programs and, as the defendant correctly argues, subsection (e)(1), unlike other subsections, does not contain an accuracy standard. See Def.’s Mem. at 21.
Moreover, the plaintiff has not established how the defendant’s maintenance of this information had an “adverse effect” on him. Thompson, 400 F. Supp. 2d at 8. Although he claims that he “would have had no need to expend time and money to dispute the [f]raudulent [s]tudent [l]oans absent maintenance of information about those loans by [the d]efendant,” Pl.’s Opp’n at 17, it is the purported disclosure of the inaccurate information to credit reporting agencies, not its maintenance, that caused this allegedly adverse effect. Because subsection (e)(1) does not require an agency to maintain only accurate records, and because the plaintiff has not shown how the mere maintenance of the inaccurate records caused him an adverse effect, the Court must dismiss the plaintiff’s claim based on 5 U.S.C. § 552a(e)(1).
11
2. Whether the Plaintiff Has Stated a Violation of 5 U.S.C. § 552a(e)(2)
Subsection (e)(2) of the Privacy Act requires an agency to “collect information to the greatest extent practicable directly from the subject individual when the information may result in adverse determinations about an individual’s rights, benefits, and privileges under Federal programs.” 5 U.S.C. § 552a(e)(2). As the defendant points out, most cases alleging violations of subsection (e)(2) involve investigations in which the government collected information from someone other than the subject of the investigation. See Def.’s Mem. at 23–24. As with his claim under subsection (e)(1), the plaintiff’s claim under subsection (e)(2) is a threadbare recital of the statute claiming that the defendant “fail[ed] to collect information to the greatest extent practicable directly from the [p]laintiff and class members when the information may result in adverse determinations about their rights, benefits, and privileges under Federal programs.” Compl. ¶ 86(C). The alleged violation appears to be that the defendant did not collect information in the Endorser Addendums from the plaintiff but rather from his father, who was posing as the plaintiff.
The defendant argues that it “does not intentionally and willfully violate subsection (e)(2)
when it is defrauded because someone other than the endorser completed the Endorser Addendum.” Def.’s Mem. at 23. The plaintiff responds that “[the] neglect of [the d]efendant’s statutory obligations [under subsection (e)(2)] occurred (and continues to occur) while [the d]efendant received tens of thousands of identity theft disputes per year and enabled the theft of billions of dollars of student loan funds by identity thieves.” Pl.’s Opp’n at 18. The plaintiff’s argument, therefore, is that the mere receipt of fraudulent information from “identity thieves” is an intentional and willful violation of subsection (e)(2). See id. The plaintiff provides no caselaw to support this theory, and the Court is aware of none. The Court therefore concludes that unwittingly receiving information from an impostor or identity thief is not a
12
willful and intentional violation of subsection (e)(2) and must therefore dismiss the plaintiff’s claims based on that subsection.
3. Whether the Plaintiff Has Stated a Violation of 5 U.S.C. § 552a(e)(5)
Subsection (e)(5) of the Privacy Act requires an agency to “maintain all records which are used by the agency in making any determination about any individual with such accuracy, relevance, timeliness, and completeness as is reasonably necessary to assure fairness to the individual in the determination.” 5 U.S.C. § 552a(e)(5). “Subsection g(1)(C) provides a civil remedy if an agency fails to satisfy the standard in subsection (e)(5) ‘and consequently a determination is made which is adverse to the individual.’” Deters v. U.S. Parole Comm’n, 85 F. 3d 655, 657 (D.C. Cir. 1996) (quoting 5 U.S.C. § 552a(g)(1)(C)).
The plaintiff alleges that the defendant “fail[ed] to maintain Student Loan Information [ ]
with such accuracy, relevance, timeliness, and completeness as is reasonably necessary to assure fairness to [the p]laintiff and the [putative] class when making Department determinations about [the p]laintiff and the [putative] class members.” Compl. ¶ 86(d). The defendant argues in response, as indicated above, that the plaintiff “has not plausibly alleged that any alleged violation of this subsection was intentional or willful.” Def.’s Mem. at 16.
According to the defendant, “there is no allegation in the Complaint that the Department knew the Endorser Addendums were fraudulent when it reported information from them to consumer reporting agencies.” Def.’s Mem. at 16–17. Because the defendant contends that it did not know the information was false, it argues that it could not have intentionally or willfully failed to maintain accurate records. See id. Going a step further, the defendant argues that “[i]f the mere receipt by an agency of an application for a government benefit which might later be shown to contain information that is false were enough to intentionally and willfully maintain inaccurate records” then “every agency that administers a government benefit program would be
13
liable for damages under the Privacy Act every time it ingests an application for the benefit into its record systems.” Id. at 17.
The plaintiff responds that the Complaint states a claim because he alleged that the defendant acted willfully and intentionally when it “accepted and approved virtually all student loan applications without conducting even rudimentary identity verification [and] ignored facial evidence of identity theft in numerous fraudulent Endorser Addend[ums] submitted in [the p]laintiff’s name. Pl.s’ Opp’n at 20–21. The plaintiff further argues that the defendant “willfully failed to prevent identity theft and then spent eighteen months outright rejecting [the p]laintiff’s claims of identity theft.” Id. at 21.
But, as the defendant correctly argues, the hallmarks of identity theft in the Endorser Addendums alleged by the plaintiff do not amount to some level of indifference by the defendant because “none of those pieces of information would have indicated on their face that Lars Bradley fraudulently filled out and signed the endorser addendum for his son.” Def.’s Mem. at 17–18. Although arguably the defendant should have further investigated the information in the Endorser Addendums, the Privacy Act’s intentional and willful standard requires more than mere negligence. The Court must therefore dismiss the plaintiff’s claims based on subsection (e)(5).
4. Whether the Plaintiff Has Stated a Violation of 5 U.S.C. § 552a(e)(6)
Subsection (e)(6) of the Privacy Act requires that an agency “prior to disseminating any record about an individual to any person other than an agency . . . make reasonable efforts to assure that such records are accurate, complete, timely, and relevant for agency purposes.” 5 U.S.C. § 552a(e)(6). The plaintiff’s theory of liability under this subsection is that the defendant did not make reasonable efforts to ensure the accuracy of the Endorser Addendums before disseminating them to credit reporting agencies. See Compl. ¶ 72. The defendant argues that it did not intentionally and willfully violate subsection (e)(6) because “any alleged disclosure of
14
the fraudulent Endorser Addendums occurred before [the defendant] was put on notice that they were fraudulent.” Def.’s Mem. at 24. The defendant claims that “it was reasonable for [it] to assume the Endorser Addendums associated with Lars Bradley’s student loans were valid and accurate before it received and investigated Plaintiff’s claim suggesting otherwise.” Id. The plaintiff responds that he “provided multiple indicia of why [the d]efendant was on notice that the Fraudulent Loan information was inaccurate and yet [the d]efendant failed to take any meaningful steps to verify this information.” Pl.’s Opp’n at 25.
The plaintiff’s argument is merely that the defendant should have known the information in the Endorser Addendums was inaccurate or should have done more to ensure its accuracy before disseminating them to credit reporting agencies. But the statute requires only that the defendant make “reasonable efforts” to ensure accuracy and completeness. 5 U.S.C. § 552a(e)(6). The Court agrees with the defendant that requiring the co-signer’s address, personal telephone number, and employment information on the Endorser Addendums, see Compl. ¶¶ 25–34, is a reasonable effort to ensure accuracy. And here, the defendant is only alleged to have disseminated this information before the plaintiff notified it that the information was potentially fraudulent. See id. ¶¶ 36–39.
Even if these procedures do not amount to “reasonable efforts” to assure accuracy, the plaintiff still has not provided facts from which the Court can draw an inference that the defendant acted willfully or intentionally. The cases the plaintiff relies upon alleged substantially more that amounted to “willful” or “intentional” conduct than what is alleged here. See Peter B. v. Cent. Intel. Agency., 620 F. Supp. 2d 58, 65 (D.D.C. 2009) (alleging that the defendant agency disseminated false information “for the purpose of causing [the plaintiff’s] potential employer to either never provide [him] with an offer of employment or withdraw any
15
such offer that had been provided”); Fleck v. Dep’t of Veterans Affs. Off. of Inspector Gen., 596 F. Supp. 3d 24, 48, 53 (D.D.C. 2022) (alleging that the defendant agency undertook an investigation into the plaintiff “only with an eye toward substantiating the allegations against him rather than providing a complete account of his [potential] culpability” and disseminated a report which “contain[ed] numerous inaccurate statements . . . and omit[ted] exculpatory and mitigating evidence”). 6 Here, by contrast, there is no indication that the defendant disseminated the information for the purpose of causing harm to the plaintiff. See id. Because there is no allegation that the defendant knew the information in the Endorser Addendums was inaccurate at the time it disseminated that information to the credit reporting agencies, the plaintiff has not adequately pleaded willfulness or intentionality. Therefore, the Court must dismiss the plaintiff’s claims based on subsection (e)(6).
5. Whether the Plaintiff Has Stated a Violation of 5 U.S.C. § 552a(e)(10)
Subsection (e)(10) of the Privacy Act requires that an agency “establish appropriate administrative, technical, and physical safeguards to ensure the security and confidentiality of records and to protect against any anticipated threats or hazards to their security or integrity which could result in substantial harm, embarrassment, inconvenience, or unfairness to any individual on whom information is maintained.” 5 U.S.C. § 552a(e)(10). In claims brought under this subsection, the plaintiff must “identify a rule or safeguard . . . that [the Department] should have established but did not.” Dick v. Holder, 67 F. Supp. 3d 167, 186 (D.D.C. 2014).
The defendant argues that the plaintiff has not stated a plausible claim under subsection (e)(10), a subsection it contends is “normally invoked in the context of data breaches[,]” because
6 The plaintiff also relies on Tripp v. Dep’t of Def., 219 F. Supp. 2d 85 (D.D.C. 2006), a case decided before Twombly and Iqbal, in which the Court denied a motion to dismiss numerous Privacy Act claims. That case, however, did not independently assess the substance of the subsection (e)(6) claim beyond concluding that it was “sufficient for purposes of Rule 8” as it was construed under the prior pleading standard. Id. at 91.
16
“he does not allege any harm suffered as a result of a data breach, allege that any such breach occurred, or identify any rule or safeguard that the [defendant] should have implemented but did not.” Def.’s Mem. at 27.
The plaintiff responds that “[p]ermitting widespread submission of false and fraudulent Student Loan Information via identity theft necessarily damages the integrity of records maintained by the [d]efendant,” in violation of subsection (e)(10). Pl.’s Opp’n at 27. But subsection (e)(10) is not concerned with the “submission” of records, rather it is concerned with the safety and security of records already in an agency’s possession. See 5 U.S.C. § 552a(e)(10). The plaintiff’s reliance on data breach cases finding willful or intentional failures to safeguard information is therefore misplaced. See Pl.’s Opp’n at 27–28. Indeed, the plaintiff does not allege that his personal information was stolen as a result of the defendant’s failure to “protect against any anticipated threats or hazards,” 5 U.S.C. § 552a(e)(10), but rather was committed by his father before he allegedly submitted the fraudulent student loan applications, see Compl. ¶¶ 25–34. Therefore, the Court must dismiss the plaintiff’s claims based on subsection (e)(10).
6. Whether the Plaintiff Has Stated a Violation of 5 U.S.C. § 552a(b)
Subsection (b) of the Privacy Act provides that “[n]o agency shall disclose any record which is contained in a system of records by any means of communication to any person, or to another agency, except pursuant to a written request by, or with the prior written consent of, the individual to whom the record pertains” unless certain exceptions are satisfied. 5 U.S.C. § 552a(b). The defendant does not argue that any of those exceptions apply here, but rather contends that “[i]nformation about the endorser is disclosed to consumer reporting agencies pursuant to written consent provided by the endorser in signing the Endorser Addendum,” Def.’s Mem. at 25, and, therefore, it “had consent to disclose the Endorser Addendum information at issue here,” id. at 26.
17
The plaintiff does not dispute that the Endorser Addendums indicate that the endorser authorizes the defendant to report information about the loan to credit reporting agencies, but rather argues that “a forged disclosure authorization [does not] equate[] to Plaintiff’s written consent to disclosure.” Pl.’s Opp’n at 15. But, the plaintiff provides no authority to support his expansive theory that a federal agency willfully or intentionally violated the Privacy Act by relying on a signed form authorizing disclosure of the records, and the Court is aware of none. To the contrary, “this Circuit has said that when an agency discloses records pursuant to its unchallenged regulations, or in response to a request that it justifiably believed to be authorized—as was the case here—the disclosing agency can’t have willfully violated the Privacy Act.” Alexander v. Fed. Bureau of Investigation, 691 F. Supp. 2d 182, 191 (D.D.C. 2010), aff’d, 456 F. App’x 1 (D.C. Cir. 2011). Accordingly, the Court must dismiss the plaintiff’s claim based on 5 U.S.C. § 552a(b).
IV. CONCLUSION
For the foregoing reasons, the Court grants the defendant’s motion to dismiss.
SO ORDERED this 23rd day of March, 2026. 7
REGGIE B. WALTON
United States District Judge
7 The Court will contemporaneously issue an Order consistent with this Memorandum Opinion.