How much must the government pay an individual when it reveals his HIV status without his knowledge or permission? According to the Supreme Court, the answer is – nothing. That is, on March 28, 2012, the Supreme Court ruled that victims of Privacy Act violations are not entitled to damages for the emotional and mental distress they are likely to suffer as a result of the violation. The case is Federal Aviation Administration v. Cooper.
The victim, Mr. Cooper, was a recreational pilot who was HIV-positive. He had not revealed this information when he applied for a pilot’s license, but he did tell the Social Security Administration (SSA) when he applied for disability payments. Without Mr. Cooper’s knowledge, the SSA disclosed Mr. Cooper’s HIV-positive status to the Department of Transportation, which was investigating whether medically unfit candidates were getting pilot’s licenses. Mr. Cooper contended in court that the SSA violated the Privacy Act, and that he suffered mental and emotional distress at learning of the disclosure of his health status, which he had kept private and considered deeply personal.
The issue before the Court was the meaning of provision in the Privacy Act entitling victims to recover “actual damages” that result from disclosures of their private information. The majority of the Court held that the definition of the phrase “actual damages” was limited to such things as lost wages or out-of-pocket loss, not compensation for the mental and emotional distress they suffer. Because there was no such express provision, the Court concluded that the government had not waived sovereign immunity for claims for mental and emotional distress. In dissent, Justice Sonia Sotomayor decried the decision as being contrary to precedent and common sense, and stated that it “cripples the act’s core purpose of redressing and deterring violations of privacy interests.”
We agree with Justice Sotomayor. Congress intended the Privacy Act to provide robust protections for individual privacy. These protections are only effective if the Privacy Act is enforced. Furthermore, mental and emotional damages are likely the most common harm suffered by those who have had their closely held, private information revealed without their consent. In fact, it is unlikely that a victim of a Privacy Act violation will suffer out-of-pocket monetary damages. Mental distress is precisely the kind of harm that results from a Privacy Act violation. By limiting the damages that can recovered to pecuniary, or out of pocket, losses, the Court’s decision has all but eliminated the already inadequate incentives for victims to bring this kind of unlawful conduct by the government to light. The fewer individuals who are willing and/or able to bring such claims, the more diluted the deterrent effect of the law will be.
To the extent the decision has a silver lining it is that the damage can be undone. The basis for the Court’s opinion is that, in order for victims of Privacy Act violations to recover damages for emotional and mental distress “Congress must speak unequivocally,” and “[h]ere … it did not.” Accordingly, Congress can remedy the situation and should do so by amending the law to expressly provide that emotional and mental harms are compensable under the Act.
Thank you to associate Tracy Gonos for writing this blog entry.