UNITED STA TES DISTRICT COURT FOR THE DISTRICT OF COLUMBIA

DAVID STEWART,

Plaintiff,

v. Case No. 1:21-cv-1387-RCL

FRANK KENDALL, Secretary ofthe Air Force, in his official capacity, et al., 1

Defendants.

MEMORANDUM OPINION

Plaintiff Major David Stewart sued defendants Frank Kendall, in his official capacity as

Secretary of the Air Force, and Daniel Hokanson, in his official capacity as Chief of the National

Guard Bureau, for alleged violations of the Privacy Act involving a leak of his private medical

information to a member of Congress. Defendants moved to dismiss for lack of subject matter

jurisdiction and failure to state a claim. Defs.' s Mot., ECF No. 3. Plaintiff responded, Pl.' s Resp.,

ECF No. 6, and defendants replied, Defs. 's Rep., ECF No. 9. For the reasons explained below, this

Court will GRANT defendants' motion to dismiss for lack of subject inatter jurisdiction and will

DISMISS plaintiffs claim by separate Order.

I. BACKGROUND

Plaintiff was a physician assistant with the 129th Medical Group in the California Air

National Guard ("CA ANG"). Compl. ,r,r 1 & 7, ECF No. 1. Lieutenant Colonel Sean Haugh, the

Chief of Clinical Services, was one of plaintiffs supervisors. Id. ,r 7. Plaintiff alleges that Lt. Col. Haugh "never particularly cared for" him. Id. ,r 10. During his service with the CA ANG, plaintiff

1 Pursuant to Fed. R. Civ. P. 25(d), a public officer's successor is automatically substituted as a party. Frank Kendall is accordingly substituted as Defendant in place of former Acting Secretary John Roth.

1 was in a motor vehicle accident where "he sustained substantial medical injuries and developed a

resultant psychiatric condition." Id. ,r 8. Following this accident, plaintiff was placed on temporary

disability status. Id.

Air Force Instruction, a set of directives for the United States Air Force, required that

plaintiff obtain a medical waiver to continue serving with the CA ANG. Id. ,r 9. To obtain this medical waiver, plaintiff authorized the release of his medical records to the 129th Medical Group

for the sole purpose of this assessment. Id. Lt. Col. Haugh sought to have plaintiff involuntarily

medically separated because of his·psychiatric condition. Id. ,r 10. Lt. Col. Haugh eventually began to "circumvent[] proper channels" in his quest to process plaintiff for separation, including

disclosing all of.plaintiffs treatment providers and diagnoses to each of his treating physicians.

Id. ,r 10. Plaintiff accordingly filed a complaint with the California National Guard Inspector

General's office. Id. ,r 10-11. After an investigation, plaintiff was transferred to another medical group away from Lt. Col. Haugh. Id. ,r 11. The now "infuriated" Lt. Col. Haugh's vendetta continued. Id. ,r 12. Convinced plaintiff had fraudulently enlisted in the CA ANG, Lt. Col. Haugh raised concerns with unit leadership, but

leadership did not act on his allegations. Id. Unsatisfied, Lt. Col. Haugh accessed plaintiffs

medical records in the Aeromedical Information Management Waiver Tracking System

("AIMWTS") 2 and downloaded thirteen pages of psychiatric counselling sessions and plaintiffs

medical waiver narrative. Id. ,r 13. Armed with these records, Lt. Col. Haugh hand-delivered them to Congresswoman Anna Eshoo's office on October 15, 2018. Id. ,r 14. After Eshoo',s staff immediately contacted the CA ANG, Brigadier General Jeffrey

Magram ordered a Command Directed Investigation ("CDI"). Id. ,r 15-18. It was during a CDI

2 AIMWTS is a database controlled by the Air Force. Compl. ,i 13.

2 interview on May 14, 2019, that plaintiff first learned of the breach of his private medical records.

Id. The CD I's Report of Investigation ("ROI") concluded by a preponderance of the evidence that

Lt. Col. Haugh violated the Privacy Act. Id. ,r 19. Plaintiff was distraught by the unlawful distribution of his private medical records and

"sought mental health treatment to cope." Id. ,r 20. Because he "no longer felt comfortable seeking

any treatment that was remotely connected to the military," plaintiff paid for mental health

treatment with his own personal finances as opposed to receiving treatment from the military. Id.

Plaintiff also "stopped pursuing his goal of becoming a flight surgeon and assumed an ANG staff

officer position outside of medicine" because of his disillusionment with the military medical

profession." Id. ,r 21. Plaintiff initially attempted to file his complaint with this Court on May 14, 2021, attached

to a motion for leave to file under seal. Stewart v. Roth, No. 21-mc-54 (UNA) (D.D.C. May 17,

2021), ECF Nos. 1-1 & 1-3. On May-17, 2021, Chief Judge Beryl Howell denied plaintiffs motion

to for leave to file under seal. Order, Stewart v. Roth, No, 21-mc-54 (UNA) (D.D.C. May 17,

2021), ECF No. 1. Plaintiff filed an unsealed complaint on May 20, 2021. Compl., ECF No. 1.

Plaintiffs complaint brings claims against the Air Force, which maintained the AIMWTS

database where his medical records were kept, and the National Guard Bureau ("NGB"), of which

Lt. Col. Haugh was an officer. Compl. ,r 3, 22-26. He seeks reimbursement for the thousands of dollars he spent on "out-of-pocket" mental health treatment, as well as lost wages from attending

his doctor's appointments. Id. ,r 26. Defendants moved to dismiss pursuant to both·Federal Rules of Civil Procedure 12(b)(l)

and (b)(6). Defs.'s Mot., ECF No. 3. De\endants' argument hinges on one point: that plaintiff

failed to plead actual damages as required by the Privacy Act. They contend that plaintiffs mental

3 distress is not cognizable under the Privacy Act. Defs. 's Mot. 6. They further contend that plaintiff

lacks standing to recover for his out-of-pocket medical costs because he did not plausibly allege a

substantial risk that his medical records would be again accessed without authorization. Id.

Defendants' motion is now ripe.

II. LEGAL STAND ARDS

.A. Motion To Dismiss For Lack Of Subject Matter_Jurisdiction

A federal court is a court oflimited jurisdiction, possessing "only that power authorized by

Constitution and statute." Kokkonen v. Guardian Life Ins. Co. of Am.,

(1994).

Before a court may "proceed at all in any cause" it must ensure that it possesses subject matter

jurisdiction. Steel -Co. v. Citizens for a Better Env't,

(1998) (quoting Ex parte

McCardle,

(1868)). The party invoking federal jurisdiction-in this

case, plaintiff-bears the burden of establishing jurisdiction. Lujan v. Defs. of Wildlife,

(1992). A court considering jurisdiction accepts the factual allegations in the

complaint as true. Info. Handling Servs., Inc. v. Def Automated Printing Servs.,

(D.C. Cir. 2003). But because a Rule 12(b)(l) motion concerns a court's power to hear a

claim, courts must more closely scrutinize plaintiffs factual claims when resolving a 12(b)(1)

motion than when resolving a 12(b)(6) motion for failure to state a claim. Grand Lodge of

Fraternal Ord. ofPolice v. Ashcroft,

(D.D.C. 2001).

B. Motion To Dismiss For Failure To State A Claim

To survive a motion to dismiss under Rule 12(b)(6), a "complaint must contain sufficient

factual matter, accepted as true, to 'state a claim to relief that is plausible on its face."' Ashcroft v.

Iqbal,

(2009) (quoting Bell At/. Corp. v. Twombly,

(2007)).

The factual content included in the complaint must allow "the court to draw the reasonable

4 inference that the defendant is.liable for the misconduct alleged." Iqbal,

. Courts

resolving a Rule 12(b)(6) motion assume "the truth of all well-pleaded factual allegations in the

complaint and construe[] reasonable inferences from those allegations in the plaintiffs favor," but

courts are "not required to accept the plaintiffs legal conclusion as correct." Sissel v. Dep 't Health

& Human Servs.,

(D.C. Cir. 2014).

C. Claims Under The Privacy ·Act

The Privacy Act "contains a comprehensive and detailed set of requirements for the

management of confidential records held by Executive Branch agencies." FAA v. Cooper,

(2012). To maintain a claim under the Privacy Act, a: plaintiff must allege that (1) an agency violated a provision of the act, (2) the agency's violation was intentional or willful,

and (3) the violation had an "adverse effect" on the plaintiff "in the form of actual damages."

Chichakli v. Tillerson,

(D.C. Cir. 2018); 5 U.S.C. § 552a(g). "Actual damages,"

as used in the Privacy Act, only encompasses "damages for proven pecuniary loss." Cooper,

. "[D]amages for mental or emotional distress" are not sufficient to maintain a Privacy

Act claim.

.

III. DISCUSSION

A. This Court Lacks Subject Matter Jurisdiction Because Plaintiff Has Failed To Plausibly Allege "Actual Damages"

This Court lacks subject matter jurisdiction, because plaintiffs emotional damages are

insufficient to waive sovereign immunity and plaintiff lacks standing for his proffered pecuniary

damages, which would waive sovereign immunity. Plaintiff alleges that this Court has jurisdiction

over his action pursuant the Privacy Act. Compl. ,r 4. In claims against the federal government,

"sovereign immunity shields the federal government and its agencies from suit" and a court must

dismiss a claim for lack of subject matter jurisdiction "[a]bsent a waiver". FDIC v. Meyer, 566

, 304 (2012). The Privacy Act provides a waiver of sovereign immunity, but the waiver

is limited in scope: the Act only waives sovereign immunity for "actual damages." Cooper,

;

(g)(l)(D), (g)(4)(A). These· "actual damages," in tum, must be

pecuniary or economic in nature. Cooper,

. Put simply, for this Court to have

subject matter jurisdiction, the United States must have consente? to being sued, and the United

States· only consented ,.to being sued under the Privacy Act for pecuniary damages. Because

plaintiff lacks standing for his pecuniary damages, the Privacy Act cannot serve as a waiver of

sovereign immunity and this Court lacks subject matter jurisdiction.

· Plaintiff raises two types of damages in his complaint. First, he alleges that he was

"severely distraught" by the Privacy Act violation in question. Comp!. ,r 20. But the Privacy Act does not permit damages for "mental or emotional distress." Cooper,

.

"Accordingly, the Act does not waive the Federal Government's sovereign immunity from liability

for such harms."

This Court lacks subject matter jurisdiction over plaintiffs claims of

emotional injury.

Second, plaintiff does proffer pecuniary damages that would waive the government's

, sovereign immunity, but lacks standing for these claims. Plaintiff claims he suffered pecuniary

losses from out-of-pocket payments for medical expenses he incurred after foregoing military

medical assistance and from "lost wages to attend these doctor's appointments."3 While these

pecuniary damages, if plausibly alleged, would serve to waive the government's sovereign

immunity under the Privacy Act, plaintiff runs into a different subject matter jurisdiction issue.

3 For the first time in his response, .Plaintiff also alleges pecuniary harm in the form of diminished employment opportunities-e.g. that the breach "forced him to take alternative paths" to avoid another breach. PL 's Resp. 6. But his complaint only specifically alleges as damages out-of-pocket mental health treatment and lost wages. Compl. ,i 26. As defendants note, a complaint "may not be amended by the briefs in opposition to a motion to dismiss." Defs. 's Resp. 3 (quoting Coleman v. Pension Benefit Guar. Corp.,

, 24 n.8 (D.D.C. 2000). The Court therefore will not address these damages but notes they would likely suffer from similar standing issues.

6 These damages fail to fulfill the injury-in-fact requirement of Article III standing, and so this Court

lacks subject matter jurisdiction over these claims as well.

To maintain any claim in federal court, a plaintiff must make three showings: (1) that he

has suffered an injury-in-fact that is "actual or imminent, not 'conjectural' or 'hypothetical'"; (2)

that the injury was "fairly traceable to the challenged action of the defendant"; and (3) that it is

likely that the injury will be redressed by a favorable decision. Lujan,

. An injury-

in-fact must be "concrete, particularized, and, most importantly for our purposes, 'actual or

imminent' rather than speculative." Attias v. Carefirst, Inc.,

(D.C. Cir. 2017)

(quoting Spokeo, Inc. v. Robins, 578 ffS. 330,229 (2016)).

As plaintiff appears to concede, military-associated mental he.alth treatment would have

been paid for by the military itself. Compl. ,r 20. But plaintiff explains that he "no longer felt

comfortable seeking any treatment that was remotely connected . to the military" and . accordingly

began to pay for treatment on his own. Compl. ,r 20. Defendants characterize this as a "voluntarily

assumed harm" insufficient to confer standing. Defs.' s Mot. 7.

Mitigation costs incurred to prevent future injury can qualify as actual damages and satisfy

the injury-in-fact standing requirement only if there is at least a substantial risk of future harm.

Clapper v. Amnesty Int'! USA,

, 414 n.5 (2013). Because plaintiff alleges that he

sought outside treatment to avoid a "repeat privacy breach," Pl. 's Resp. 9, plaintiffs pecuniary

mitigation costs can satisfy the injury-in-fact requirement if th~re was a substantial risk of a future

privacy breach. But plaintiff fails to plausibly allege that Lt. Col. Haugh's breach of his personal

information was anything other than an isolated incident unlikely to reoccur.

Plaintiff brings no allegations about the potential threat of a repeat breach beyond.noting

that the "actual breach demonstrates the ease of accessing the Air Force database and greatly

7 increases the likelihood of a repeat privacy breach." Pl.'s Resp. 9. The mere fact that a breach

happened in the past does not mean it is likely to happen again in the future. The notion that another

bad actor with access to AIMWTS and a personal vendetta against plaintiff will again download

his medical records without authorization and attempt to leak them is a paradigmatic speculative

harm ~ased on a "highly attenu~ted chain of possibilities." Clapper, 568 U.S. at ~10. Plaintiff

"cannot manufacture standing by choosing. to make expenditures based on hypothetical future ...

harm that is not certainly impending."

.

The case law he cites to support his theory of standing is similarly inapposite. Plaintiff

relies heavily on two cases that found a substantial risk of future harm based on a data breach. See

Pl.' s Resp. 6-9. In Attias, a health insurance provider "suffered a cyberattack" in which customers'

personal information was stolen.

. The Circuit found that the plaintiffs plausibly

alleged that they "face a substantial risk of identity theft as a result of [the provider's] alleged

negligence" because the breach "exposed [their] social security and credit card numbers" to an

intruder.

. Because the breach had already happened, "an unauthorized party had

already accessed" personal data and it was "plausible ... to infer that this party has both the intent

and the ability to use that data for ill."

. Similarly, in In re United States Office of .

Personnel Management Data Security Breach Litigation ("In re OPM'), plaintiffs bringing a

Privacy Act suit made a nearly identical claim to Attias: that a widespread data breach which

exposed their'personal information (including Social Security numbers, birth dates, residency

details, and fingerprints) made them susceptible to the risk of future fraud and identity theft. 928

•F.3d 42, 58-59 (D.C. Cir. 2019). The Circuit agreed and found that the costs incurred by

purchasing credit-monitoring services, along with.other mitigation costs, qualified as an injury-in-

fact. Id. at 60.

8 But plaintiff here does not allege that because of the Privacy Act violation his personal

information is currently in the hands of a malicious actor seeking to steal his identity. He does not

allege that he is at a substantial" risk of future identity theft or other damages because of the breach.

Instead, he alleges that he is at risk of a "repeat privacy breach." Pl.' s Resp. 9. This alleged threat

of future harm differs greatly from the harm in Attias and In _re OPM. Neither court .found

substantial risk of a future repeat breach.

Because plaintiff has failed to allege an injury~in-fact sufficient to confer Article III

standing or the "actual damages" required by the Privacy Act to waive the government's sovereign

immunity, this Court does not have subject matter jurisdiction. Accordingly, the motion to dismiss

under Rule 12(b)(l) will be granted. 4

IV. CONCLUSION

For the above-mentioned reasons, this Co}lrt will GRANT defendants' motion to dismiss

for lack of subject matter jurisdiction by separate order.

~ ~1 .,.,.-z..-z- Date: .Bdtm1b~r _ _ , 7021 Hon. Royce C. Lamberth United States District Judge

4 Defendants also argue that plaintiffs claims should be dismissed for failure to state a claim and as untimely. Defs.' s Repl. 1, 7. The Court need not reach these issues because it dismisses for other reasons.

9