MOORE, J., delivered the opinion of the court, in which WHITE, J., joined. KENNEDY, J. (pp. 560-64), delivered a separate dissenting opinion.

OPINION

In this Privacy Act and Federal Tort Claims Act ease, the Defendants-Appellants/Cross-Appellees appeal the district court’s judgment, after a twenty-three-day bench trial, in favor of the Plaintiffs-Appellees/Cross-Appellants on the Privacy Act claims. The Plaintiffs cross-appeal the district court’s judgment in favor of the Defendants on the Federal Tort Claims Act claim, as well as a variety of subsidiary issues. The Plaintiffs, a group of staff members at the Federal Bureau of Prisons (“BOP”) Lexington, Kentucky, Federal Medical Center (“FMC”) facility, alleged that the Defendants allowed an employee roster containing the Plaintiffs’ sensitive personal information to be disclosed to improper persons, namely prison inmates and other BOP staff. The Defendants include the United States Department of Justice, the BOP, the Attorney General, the head of the BOP, various FMC officials, and the United States of America. The district court found that the responsible employee’s actions resulted in a disclosure actionable under 5 U.S.C. § 552a(b) & (g)(1)(D) of the Privacy Act, and that the actions were “intentional or willful” within the meaning of 5 U.S.C. § 552a(g)(4) such that the Plaintiffs were entitled to damages, even though the employee’s final act of leaving the folder unsecured was “inadvertent.” For the following reasons, we AFFIRM in part and REVERSE in part, and we REMAND for proceedings consistent with this opinion.

I. FACTUAL AND PROCEDURAL BACKGROUND1

During an internal investigation of unauthorized inmate computer usage at the FMC’s UNICOR work facility (“UNI-COR”),2 Special Investigative Agent Walter Clint Jones (“SIA Jones”) left behind a green file folder on a civilian employee’s desk that included a roster of all FMC Lexington employees’ names, addresses, *545Social Security numbers, home telephone numbers, pay grades, and other personal information (the “folder”). Contrary to BOP Program Statements, the folder was not marked with “LOU-Sensitive”3 or other required markings to indicate its contents. SIA Jones left the folder on the desk in the Project Management area of UNICOR around 3:00 a.m. on Thursday, March 30, 2001. Staff began to admit inmates into this part of UNICOR beginning around 7:30 a.m., and inmate Charles Kinnard arrived sometime between 9:50 a.m. and 10:00 a.m. Susan Moore, on whose desk the folder lay, did not arrive until sometime after 9:50 a.m.; when she arrived she immediately discovered the folder and turned it over to her acting supervisor, Mark Barnes, and their acting manager, James Jones. At trial, three inmates testified that they saw inmate Charles Kinnard next to Moore’s desk pri- or to her arrival, and two inmates, Mark Geralds and Terrell Harris, saw Kinnard looking at something on Moore’s desk for at least two minutes. No civilian staff members noticed this behavior. Although inmates are never present without staff supervision, the Project Management employees do allow inmates with whom they work to approach the staff members’ desks and to deposit and remove work papers.

James Jones, after meeting with Moore and Barnes, reported the incident to Associate Warden Ann Mary Carter. Carter then met with Moore and Barnes, told them the folder had been properly secured, asked them to submit memoranda explaining the incident, and instructed them not to discuss the incident with anyone. Because the folder was found on a civilian staff member’s desk, Carter believed that no disclosure had occurred, and neither she nor anyone else ordered an investigation, lockdown, or shakedown. The inmates were subjected to the normal pat-down searches prior to their leaving Project Management at the lunch break and at the end of the workday. Warden Maryellen Thoms later decided to treat SIA Jones’s act as a performance violation, and, thus, the incident was not reported to the BOP Office of Internal Affairs (“OIA”).4

Soon after March 30, Moore contacted the Union Steward, but Thoms declined to discuss the incident with anyone other than the Union President, with whom she met in mid-April. On April 19, 2001, the Union filed an official grievance alleging that FMC management violated the Freedom of Information Act and the Privacy Act, and requesting that staff be advised of the incident and potential personal-security implications. Scott Murchie, FMC Lexington Human Resources Manager, responded and suggested that no action should be taken before evidence of disclosure was available. The BOP Regional Director denied the grievance on May 4, 2001, citing the absence of “specific proof that staff had their privacy compromised” as the reason not to notify staff. Beaven, 2007 WL 1032301, at *6. Thoms later denied two staff members’ requests for information under the Privacy Act related to any disclosure of their personal information based on lack of proof of disclosure under the Privacy Act. The Union referred the incident to the OIA on May 9, 2001, and then invoked arbitration on May 29, 2001. The Union requested an accounting of disclosures, but Thoms denied the request for lack of evidence that a disclosure occurred.

*546On September 17, 2001, Thoms issued the first memorandum to staff related to the incident, but the memorandum included several factual inaccuracies — including assertions that the folder was properly-marked “LOU-Sensitive” and that it was discovered at 9:00 a.m. after being left unattended since only 7:30 a.m. — and the memorandum failed to state the incident date, the information in the folder, and whom it affected. The memorandum closed by assuring staff of Thoms’s “commitment to investigate [disclosure] allegations.” Id. at *8. The memorandum also offered assistance from BOP attorneys in filing administrative tort claims if any allegations “prove founded” because “we have yet to receive any documentation that inmates accessed the file in question.” Id. After arbitration on October 30, 2001, Thoms issued a second staff memorandum on December 17, 2001, but failed to correct inaccuracies or omissions other than the incident date and information included in the folder. The December 17 memorandum again stressed Thoms’s “commitment to investigate allegations” of disclosure and provide assistance if “such allegations prove founded.” R. on Appeal (“ROA”) Vol. 1 (J.A.) at 707 (Pls.’ Exhibit 56). Sometime after the arbitration, but before the second memorandum, Thoms instructed Murchie to destroy the folder when he was moving to D.C. (Murchie had received the folder from SI A Jones in case it was necessary for arbitration).

On March 1, 2002, the Plaintiffs’ counsel filed administrative tort claims for seventy-eight staff members, but the BOP denied the claims on August 26, 2002, based on the claimants’ failure to produce evidence of actual disclosure to inmates. On February 19, 2003, the Plaintiffs filed the instant suit asserting nine separate counts on behalf of 106 staff members (adding six more staff and four additional counts in the January 8, 2004, amended complaint). Counts One through Eight alleged violations of the Privacy Act, Count Nine alleged a violation of the Social Security Act, and Counts Ten through Thirteen alleged claims under the Federal Tort Claims Act. On cross-motions for summary judgment, the district court on February 9, 2005, denied the Plaintiffs’ motion and granted the Defendants’ motion on all counts except the outrageous-conduct claim in Count Eleven, but on September 29, 2005, the district court reinstated the claims of Privacy Act disclosure and common law invasion of privacy, Counts One and Ten. The district court also granted the Plaintiffs’ motion to sanction the Defendants for destroying the folder, and the court excluded testimony about the Defendants’ inspection of the folder. A twenty-three day bench trial started on February 27, 2006. On March 30, 2007, the district court imposed the Plaintiffs’ requested adverse evidentiary inference for spoliation, found that the Defendants had violated the Privacy Act, and denied all other claims. On December 19, 2007, the district court denied the Plaintiffs’ motion for discovery sanctions related to misstatements about the folder’s labeling and destruction and entered judgment against the Defendants, awarding damages of $1,000 each to all of the plaintiffs except two who had proved greater actual damages.

II. ANALYSIS

The Defendants raise three issues on appeal: (1) Whether the district court erred as a matter of law in holding that the alleged disclosure of the folder was “intentional and willful” while also finding that the responsible employee’s act of leaving it in an unsecured location was “inadvertent”; (2) Whether the district court abused its discretion in adopting, as an evidentiary sanction for spoliation, a nonrebuttable inference that “disclosure” occurred; and (3) Whether the district court abused its discretion in its alternative ruling that the Plaintiffs proved “disclosure” *547by a preponderance of the evidence. On cross-appeal, the Plaintiffs raise only one issue that we must resolve, contending that the district court erred in limiting “actual damages” recoverable under the Privacy Act to preclude their claims for lost time and future expenses. Because the Plaintiffs raise the three remaining cross-appeal issues only as alternative grounds for relief, should this court overturn the district court’s Privacy Act decisions, we need not reach these issues.5

We will address each pertinent issue in turn, mindful that “[o]n an appeal from a judgment entered after a bench trial, we review the district court’s findings of fact for clear error and its conclusions of law de novo.” Lindstrom v. A-C Prod. Liab. Trust, 424 F.3d 488, 492 (6th Cir. 2005). We “afford great deference to the district court’s factual findings” if the findings “involve credibility determinations.” Id.

A. “Intentional or Willful” Finding

The district court found that SIA Jones’s course of conduct resulted in a disclosure under the Privacy Act, specifically 5 U.S.C. § 552a(b) & (g)(1)(D), and that his actions were “intentional or willful” within the meaning of § 552a(g)(4), although his final act of leaving the folder unsecured was “inadvertent.” Before deciding whether the district court erred in finding that SIA Jones’s actions satisfied the “intentional or willful” standard of conduct, we must determine whether the district court erred in looking to the entire course of conduct for its determination of whether “the agency acted in a manner which was intentional or willful,” rather than looking to SIA Jones’s final act of inadvertently leaving the folder on the desk.

Under § 552a(g)(1)(D), the Privacy Act provides a civil remedy to an individual for an agency’s “failure] to comply with any other provision of this section, or any rule promulgated thereunder, in such a way as to have an adverse effect on an individual.” 5 U.S.C. § 552a(g)(1)(D). Thus, an individual may bring a civil action under § 552a(g)(1)(D) if he or she is adversely affected by an agency’s failure to comply with § 552a(b)’s requirement that “[n]o agency shall disclose any record which is contained in a system of records by any means of communication to any person, or to another agency, except pursuant to a written request by, or with the prior written consent of, the individual to whom the record pertains.” 5 U.S.C. § 552a(b). Under § 552a(g)(4), a Privacy Act plaintiff who can prove actual damages is entitled to recover the greater of actual damages or $1,000 “[i]n any suit brought under the provisions of subsection (g)(1)(C) or (D) of this section in which the court determines that the agency acted in a manner which was intentional or willful.” 5 U.S.C. § 552a(g)(4).

The main issue before us is whether the requirement under § 552a(g)(4) that the district court find that “the agency acted in a manner which was intentional or willful” requires the court to find that the final act that resulted in the disclosure was “intentional or willful” or whether the court may find that the entire course of conduct that resulted in the disclosure was “intentional or will*548ful.” No court has specifically interpreted § 552a(g)(4) in the light this panel must address; therefore we must engage de novo in the analysis of what a court may consider in determining whether “the agency acted in a manner which was intentional or willful.” As recently stated, we

employ[] a three-step legislative-interpretation framework established by the Supreme Court: “ ‘first, a natural reading of the full text; second, the common-law meaning of the statutory terms; and finally, consideration of the statutory and legislative history for guidance,’ ” Lockhart v. Napolitano, 573 F.3d 251, 255 (6th Cir. 2009) (quoting United States ex rel. A+ Homecare, Inc. v. Medshares Mgmt. Group, Inc., 400 F.3d 428, 442 (6th Cir. 2005) (citing United States v. Wells, 519 U.S. 482, 490-92 [117 S.Ct. 921, 137 L.Ed.2d 107] (1997))). The “natural reading of the full text” requires that we examine the statute for its plain meaning, including “ ‘the language and design of the statute as a whole.’ ” Id. (quoting [United States v.] Parrett, 530 F.3d [422,] 429 [(6th Cir. 2008) ]). “If the statutory language is not clear, we may examine the relevant legislative history.” Parrett, 530 F.3d at 429.

Elgharib v. Napolitano, 600 F.3d 597, 601 (6th Cir. 2010). We begin with the recognition that the language of § 552a(g)(4) at issue is ambiguous. And although we have not found any cases in which the court stated explicitly which actions a district court may consider in determining whether “the agency acted in a manner which was intentional or willful,” several Privacy Act cases are instructive.

In Doe v. Chao, the Supreme Court interpreted the interplay between § 552a(g)(1)(D) and § 552a(g)(4) to decide whether a plaintiff suing under § 552a(g)(1)(D) must prove “actual damages” under § 552a(g)(4) before he or she is entitled to the statutory minimum under § 552a(g)(4). Doe v. Chao, 540 U.S. 614, 124 S.Ct. 1204, 157 L.Ed.2d 1122 (2004). Although the Court did not address the specific issue before this panel (because the government did not challenge the finding that the agency acted in an intentional or willful manner), the Court found that subsection (g)(1)(D) is intended to “deal with derelictions having consequences beyond the statutory violations per se ” and “speaks of a violation when someone suffers an ‘adverse effect’ from any other failure [not covered under subsections (g)(1)(A)-(C)] to hew to the terms of the Act.” Id. at 619, 124 S.Ct. 1204. The Court’s opinion can thus be read to endorse a broader interpretation of what actions a court may consider in determining whether “the agency acted in a manner which was intentional or willful.” Indeed throughout the opinion the Court referred to subsection (g)(4) as covering damages for “an intentional or willful violation,” see, e.g., id. at 620—22, 627, 124 S.Ct. 1204 (emphasis added), and Justice Ginsburg in dissent interpreted the language of (g)(4) relevant for our purposes to cover “an agency’s intentional or willful commission of a Privacy Act violation of the kind described in § 552a(g)(1)(C) or (D).”6 Id. *549at 628, 124 S.Ct. 1204 (Ginsburg, J., dissenting) (emphasis added).

Even though many courts have interpreted what “intentional or willful” means under § 552a(g)(4),7 none have set forth an interpretation of what a court may consider in determining whether “the agency acted in a manner” that meets this standard. Under our precedent, Privacy Act damages are recoverable only if the Plaintiffs prove that the Defendants acted “intentionally” or “willfully” — “a standard ‘somewhat greater than gross negligence’ ” — “ ‘either by committing the act without grounds for believing it to be lawful, or flagrantly disregarding others’ rights under the [Privacy] Act.’ ” Mount v. U.S. Postal Serv., 79 F.3d 531, 533 (6th Cir. 1996) (quoting White v. Office of Pers. Mgmt., 840 F.2d 85, 87 (D.C.Cir. 1988); Wilborn v. Dep’t of Health & Human Servs., 49 F.3d 597, 602 (9th Cir. 1995)). We have noted that the Privacy Act is an attempt “ ‘to strike a balance between the government’s need to collect and maintain information and the privacy interests of the persons to whom such information pertains.’ ” Cardamone v. Cohen, 241 F.3d 520, 524 (6th Cir. 2001) (quoting Hudson, 130 F.3d at 1204).

From our review of the cases in this area, we conclude that courts determining whether a Privacy Act violation occurred have not differentiated between the final act and the course of action that results in the final act, but rather courts generally look to the entire course of conduct in context. In an early case interpreting § 552a(g)(4) in a suit under § 552a(g)(1)(D) for a disclosure violation, the Tenth Circuit looked to the entire course of conduct engaged in by IRS agents to find that the plaintiffs would be able to allege “intentional or willful” agency actions on remand. Parks v. Internal Revenue Serv., 618 F.2d 677, 683 (10th Cir. 1980) (considering allegations that the agency published lists containing the plaintiffs’ personal information, furnished the lists to IRS employees, and condoned the use of the information in the lists to contact the plaintiffs for solicitations). Other circuit courts since have applied this reasoning, and the D.C. Circuit has explicitly stated that “[t]he agency’s actions must be viewed in their context to determine whether the agency’s staff acted in a will*550ful or intentional manner.” Waters v. Thornburgh, 888 F.2d 870, 876 (D.C.Cir. 1989) (citing Albright v. United States, 732 F.2d 181, 189 (D.C.Cir. 1984)), abrogated on other grounds by Doe, 540 U.S. 614, 124 S.Ct. 1204; id. at 876—77 (looking to, among other things, “the events that led up to sending the letter” in finding genuine issue of material fact regarding intent); Albright, 732 F.2d at 189—90 (considering agency’s actions prior to and after decision to videotape meeting, including subsequent offer to destroy videotape at issue, in finding actions not intentional or willful); see also Dong v. Smithsonian Inst., 943 F.Supp. 69, 73 (D.D.C. 1996) (applying Waters and looking at agency’s notice of its obligations under the Act and lack of effort to abide by Act prior to violation to find intentional or willful action because reckless disregard for rights); Romero-Vargas v. Shalala, 907 F.Supp. 1128, 1131, 1133—34 (N.D.Ohio 1995) (finding intentional or willful disclosure based on flagrant disregard where no effort made to comply with Act and each step that agency employee took was in violation of internal guidelines and led to Act violation).

Without the aid of prior interpretations directly on point for what a court may consider in determining whether “the agency acted in a manner which was intentional or willful” and faced with admittedly ambiguous language, we will look to Congress’s intent regarding § 552a(g)(4) as shown in the legislative history. As the preface to the public law stated, “The purpose of this Act is to provide certain safeguards for an individual against an invasion of personal privacy by requiring federal agencies, except as otherwise provided by law, to ... be subject to civil suit for any damages which occur as a result of willful or intentional , action which violates any individual’s rights' under this Act.” Privacy Act of 1974, Pub.L. No. 93-579, § 2(b)(6), 88 Stat. 1896 (codified as amended at 5 U.S.C. § 552a). The Senate Report accompanying the original Senate version of the Act states that one of the purposes of the Act is “to prevent the kind of illegal, unwise, overbroad, investigation and record surveillance of law-abiding citizens produced in recent years from actions of some over-zealous investigators, and the curiosity of some government administrators, or the wrongful disclosure and use, in some cases, of personal files held by Federal agencies.” S.Rep. No. 93-1183, at 1 (1974), reprinted in Joint Comm. on Gov’t Operations, Legislative History of the Privacy Act of 1974, S. 3418 (Public Law 93-579): Source Book on Privacy 154 (1976) (hereinafter Source Book). The Privacy Act was passed in the relatively short period between the Thanksgiving recess and the end of the 93rd congressional session and “reflects the merger of seemingly disparate bills from the Senate and the House.” ABA Section of Admin. Law & Regulatory Practice, Federal Administrative Procedure Sourcebook 1083 (William F. Funk et al. eds., 4th ed. 2008). This short time-frame led the two houses of Congress to forgo the usual conference committee and, instead, to reach an agreement to pass identical bills through informal meetings between the respective staffs of the two houses’ committees, with the amendments to each version included in their respective records. Id. A staff memorandum entitled “Analysis of House and Senate Compromise Amendments to the Federal Privacy Act” is “[t]he only record of the final negotiations leading to the bill actually adopted.” ABA Section of Admin. Law & Regulatory Practice, supra, at 1083; 120 Cong. Rec. 40,405—08, 40,881-83 (1974), reprinted in Source Book, supra, at 858, 985. The analysis explains the compromise reached for including the “intentional or willful” standard of conduct rather than a greater standard of “willful, arbitrary, or capricious” action or a lesser *551standard of “negligent” action (or no standard at all, as some members of Congress had advocated),8 but does not address what actions a court could examine in making its finding. 120 Cong. Rec. 40,-406—07; Source Book, supra, at 861—62 (explaining that “[o]n a continuum between negligence and the very high standard of willful, arbitrary, or capricious conduct, this standard is viewed as only somewhat greater than gross negligence”). Not once did the Congress address the scope of a court’s analysis under § 552a(g)(4).

Consistent with the language of the Act, other courts’ interpretations, and the legislative history, we conclude that a court may consider the entire course of conduct that resulted in the disclosure in making its required finding under § 552a(g)(4). Such an interpretation will allow recovery under circumstances similar to those here, where an agency’s actions, although inadvertent at the last step, were in flagrant disregard of the plaintiffs rights under the Privacy Act at other steps along the way and afterward, but would deny recovery where an agency’s actions were conscientious of Privacy Act rights throughout and contravened the Act inadvertently only at the last step — as where an employee with full rights to access personal information took every precaution to safeguard that information, but had it stolen and disclosed through no fault of his or her own while working away from the office.9 Only a context-based analysis will allow a court to distinguish between such situations and fulfill the Privacy Act’s intended purpose — “ ‘to strike a balance between the government’s need to collect and maintain information and the privacy interests of the persons to whom such information pertains.’ ” Cardamone, 241 F.3d at 524 (quoting Hudson, 130 F.3d at 1204); see Pilon v. U.S. Dep’t of Justice, 73 F.3d 1111, 1118 (D.C.Cir. 1996) (“Recognizing the [Privacy] Act’s varied ambiguities, we *552have consistently turned back ‘neat legal maneuvers],’ attempted by the government that, while literally consistent with the Act’s terms, were not in keeping with the privacy-protection responsibilities that Congress intended to assign to agencies under the Act.” (quoting Benavides v. U.S. Bureau of Prisons, 995 F.2d 269, 272 (D.C.Cir. 1993))); see also United Savings Ass’n v. Timbers of Inwood Forest Assocs., 484 U.S. 365, 371, 108 S.Ct. 626, 98 L.Ed.2d 740 (1988) (“Statutory construction ... is a holistic endeavor. A provision that may seem ambiguous in isolation is often clarified by the remainder of the statutory scheme — ... because only one of the permissible meanings produces a substantive effect that is compatible with the rest of the law....” (citations omitted)); Kostyu v. United States, 742 F.Supp. 413, 417 (E.D.Mich. 1990) (“By requiring a showing that any violation of the Act be willful and [sic] intentional, it is clear that Congress intended to reserve civil liability only for those lapses which constituted an extraordinary departure from standards of reasonable conduct.”).

With this framework in mind, we may now decide whether the district court erred in finding that SIA Jones’s actions satisfied the “intentional or willful” standard of conduct. Here, the district court applied the correct legal standard, and its credibility-based findings of fact are supported by the record and not clearly erroneous. The Defendants are correct that the district court’s finding that SIA Jones’s final act of leaving the folder was “inadvertent” appears to be inconsistent with a finding that the agency’s course of conduct was “intentional or willful.” An action that is inadvertent likely is not intentional, but could still be sufficiently willful to violate the Act. Albright, 732 F.2d at 189. A review of the facts in the instant case supports the district court’s conclusion.

Although neither party here could point to a case factually similar to the instant case, we conclude that the district court did not commit clear error in finding that SIA Jones’s course of conduct was “willful.” SIA Jones carried the folder, which he knew to contain confidential and sensitive information, into an inmate-accessible work area for the purpose of carrying out his own investigative work should he need to call a UNICOR computer administrator at home. Yet the roster not only listed the home telephone numbers of UNICOR computer administrators but also included detailed private and personal information related to all FMC employees. SIA Jones’s asserted need for some of the information while inside the UNICOR facility did not provide a legitimate basis for him to have the entire contents of the folder with him at the time to mitigate his Privacy Act violation. Moreover, the roster was contained in a folder not properly marked LOU-Sensitive,10 and this and other instances of SIA Jones’s conduct violated several BOP Program Statements. See White v. Office of Pers. Mgmt., 840 F.2d 85, 87 (D.C.Cir. 1988) (“A plain failure to comply with established [agency] policy might constitute ‘willful’ or ‘intentional’ conduct actionable under § 552a(g)(4).”). Thus the district court’s finding that SIA Jones willfully violated the Privacy Act by flagrantly disregarding the FMC employees’ rights under the Act was not clearly erroneous — SIA Jones’s course of conduct that resulted in his leaving the unmarked *553folder in an inmate-accessible area did not just “inadvertently contravene one of the Act’s strictures” and could properly be viewed as “the intentional or willful failure of the agency to abide by the Act.” Albright, 732 F.2d at 189; cf. Wiley v. Dep’t of Veterans Affairs, 176 F.Supp.2d 747, 756-57 (E.D.Mich. 2001) (finding agency’s mere inattention to detail in disclosing entire file, seemingly without any effort to identify those items within scope of request, rose at most to level of gross negligence). Therefore, we affirm the district court’s judgment that “the agency acted in a manner which was ... willful” under § 552a(g)(4), triggering liability under the Act.

B. Imposition of Non-Rebuttable Adverse Evidentiary Inference for Spoliation Sanction

We review for abuse of discretion the district court’s decision to impose sanctions for evidence spoliation. See Adkins v. Wolever, 554 F.3d 650, 652 (6th Cir. 2009) (en banc) (holding federal courts have broad discretion in such decisions). The district court imposed a non-rebuttable adverse inference of disclosure as an evidentiary sanction against the Defendants because the court found that the Defendants intentionally destroyed the folder. Beaven, 2007 WL 1032301, at *17 (“The court will therefore infer that the appearance of the file folder would have been unfavorable to the defendants, in that its inspection would have provided proof that disclosure to an inmate actually occurred.”). The Defendants argue that the district court abused its discretion because they assert that the Plaintiffs failed to establish the culpable mental state and relevance of the folder as evidence required to impose an adverse inference, and that, even if such an adverse inference was warranted, it was legal error to impose such a severe sanction.

After the district court’s decision, this court clarified that a federal court in this circuit should apply federal law in determining whether spoliation sanctions are appropriate. Adkins, 554 F.3d at 652. Because earlier precedents in this circuit applied state law on spoliation, we look to other circuits for guidance in this inquiry.

[A] a party seeking an adverse inference instruction based on the destruction of evidence must establish (1) that the party having control over the evidence had an obligation to preserve it at the time it was destroyed; (2) that the records were destroyed “with a culpable state of mind”; and (3) that the destroyed evidence was “relevant” to the party’s claim or defense such that a reasonable trier of fact could find that it would support that claim or defense.

Residential Funding Corp. v. DeGeorge Fin. Corp., 306 F.3d 99, 107 (2d Cir. 2002) (quoting Byrnie v. Town of Cromwell, Bd. of Educ., 243 F.3d 93, 107—12 (2d Cir. 2001)). Thus, an adverse inference for evidence spoliation is appropriate if the Defendants “ ‘knew the evidence was relevant to some issue at trial and ... [their culpable] conduct resulted in its loss or destruction.’ ” Hodge v. Wal-Mart Stores, Inc., 360 F.3d 446, 450 (4th Cir. 2004) (quoting Vodusek v. Bayliner Marine Corp., 71 F.3d 148, 156 (4th Cir. 1995)). This depends on the alleged spoliator’s mental state regarding any obligation to preserve evidence and the subsequent destruction. An obligation to preserve may arise “when a party should have known that the evidence may be relevant to future litigation,” Kronisch v. United States, 150 F.3d 112, 126 (2d Cir. 1998), but, if there was “no notice of pending litigation, the destruction of evidence does not point to consciousness of a weak case” and intentional destruction, Joostberns v. United Parcel Servs., Inc., 166 F. App’x 783, 797 *554(6th Cir. 2006) (unpublished opinion) (applying federal law). “[T]he ‘culpable state of mind’ factor is satisfied by a showing that the evidence was destroyed ‘knowingly, even if without intent to [breach a duty to preserve it], or negligently.’ ” Residential Funding Corp., 306 F.3d at 108 (quoting Byrnie, 243 F.3d at 109). When appropriate, “a proper spoliation sanction should serve both fairness and punitive functions,” but its severity should correspond to the district court’s finding after a “fact-intensive inquiry into a party’s degree of fault” under the circumstances, including the recognition that a party’s degree of fault may “ ‘rang[e] from innocence through the degrees of negligence to intentionality.’ ” Adkins, 554 F.3d at 652—53 (quoting Welsh v. United States, 844 F.2d 1239, 1246, (6th Cir. 1988), overruled on other grounds by Adkins, 554 F.3d 650). “Thus, a district court could impose many different kinds of sanctions for spoliated evidence, including dismissing a case, granting summary judgment, or instructing a jury that it may infer a fact based on lost or destroyed evidence.” Id. at 653 (citing Vodusek, 71 F.3d at 156).

The district court here did not abuse its broad discretion in finding that an adverse inference was appropriate here as a spoliation sanction. As the Second Circuit has noted, the “veracity of [defendant’s] stated reasons for destroying the [evidence] ‘is an issue of credibility.’ ” Kronisch, 150 F.3d at 127. Giving great deference to the district court’s credibility determinations and findings of fact, we accept the district court’s findings that the Defendants were sufficiently on notice of potential claims to have an obligation to preserve the evidence as a result of the Defendants’ repeated statements that concerned persons could file tort claims, and that the later destruction prior to the issuance of the second memorandum was intentional. Cf. Silvestri v. Gen. Motors Corp., 271 F.3d 583, 591—92 (4th Cir. 2001) (upholding dismissal as spoliation sanction for plaintiff who anticipated filing suit, knew evidence was relevant to potential claims, and preserved evidence for only three months, but did not file suit until three years later). Although in Joostbems, an unpublished opinion, we held that a completed union grievance proceeding does not suffice to prove an obligation to preserve based on notice of potential litigation arising from the same facts, especially if the allegedly spoliated evidence would have been available at the time of the grievance proceeding and was not destroyed until afterwards in the course of regular business practice, Joostberns, 166 Fed.Appx. at 796—97, the facts of the instant ease support the district court’s decision. Unlike the facts the court found influential in Joostbems, the Defendants’ actions in destroying the folder were not part of a regular business practice. In Joostbems, the court found that the defendants had no notice of potential litigation or the need for the evidence in their possession at the time that they destroyed the evidence. Id. But here, the Defendants preserved the folder as direct evidence of the alleged disclosure at the same time that they made repeated statements that actual evidence would be necessary to pursue claims, demonstrating their awareness that claims could be filed and that direct evidence — the folder — would be necessary. The Defendants also had not completed their official response to the incident at the time that they destroyed the folder-arbitration was complete, but Thoms had not yet issued the second memorandum on behalf of FMC.

The district court also did not abuse its discretion in holding that the folder was relevant — that the Plaintiffs had made “some showing indicating that the destroyed evidence would have been relevant to the contested issue” of who may have accessed the folder, Kronisch, 150 F.3d at 127, such that “a reasonable *555trier of fact could find that it would support that claim,” Residential Funding Corp., 306 F.3d at 107. “[A] party seeking an adverse inference may rely on circumstantial evidence to suggest the contents of destroyed evidence.” Byrnie, 243 F.3d at 110. The Defendants’ argument that the folder was not “relevant” because of uncertainty regarding whether it would provide “credible evidence” is unconvincing, especially given their attempts to prove nondisclosure at trial by introducing testimony about the results of their own inspection of the folder. The Plaintiffs’ proof at trial included testimony from inmates present at the time who stated that another inmate had accessed the folder. The physical appearance and condition of the folder was clearly relevant to this offer of proof because it would make the existence of a favorable material fact — disclosure of the folder to unauthorized persons — more probable. See Residential Funding Corp., 306 F.3d at 109 (holding evidence of bad faith or gross negligence that satisfies the culpable-state-of-mind requirement is also usually sufficient to satisfy the relevance requirement).

The district court did not abuse its discretion in imposing a non-rebuttable adverse inference after finding that the Defendants’ destruction of the folder “severely compromised” the Plaintiffs’ case by depriving the Plaintiffs of the most relevant piece of evidence to prove their claims. Beaven, 2007 WL 1032301, at *16. The Plaintiffs’ case hinged on whether or not the folder was compromised, constituting disclosure to unauthorized persons. The district court’s spoliation sanction was “necessary to further the remedial purpose of the inference.” See Residential Funding Corp., 306 F.3d at 108 (“[The] sanction [of an adverse inference] should be available even for the negligent destruction of documents if that is necessary to further the remedial purpose of the inference.” (citation omitted)); Silvestri, 271 F.3d at 593—95 (upholding dismissal as sanction for plaintiffs negligent spoliation where highly prejudicial to other party because the plaintiff “denied ... [the defendant] access to the only evidence from which it could develop its defenses adequately”). The district court’s use of a spoliation inference for a critical element of the case is not unprecedented. See Rogers v. T.J. Samson Cmty. Hosp., 276 F.3d 228, 232 (6th Cir. 2002) (“ ‘When ... a plaintiff is unable to prove an essential element of her case due to the negligent loss or destruction of evidence by an opposing party, ... it is proper for the trial court to create a rebuttable presumption that establishes the missing elements of the plaintiffs case that could only have been proved by the availability of the missing evidence.’ ” (quoting Welsh, 844 F.2d at 1248)). And although an adverse inference is usually only permissive for the factfinder, not mandatory, see Blinzler v. Marriott Int’l, Inc., 81 F.3d 1148, 1158-59 (1st Cir. 1996), here the district court judge was the fact-finder and therefore was free to accept the inference and discredit the Defendants’ proffered testimony to the contrary.11

*556Even if the Defendants were correct, however, that the district court erred in imposing the evidentiary sanction, we conclude that it would be harmless error because the district court’s alternative finding that the Plaintiffs proved disclosure by a preponderance of the evidence, without considering the adverse inference, was not clearly erroneous.

C. Finding “Disclosure” Proved by Preponderance of the Evidence

We review the sufficiency of the district court’s findings of fact for clear error, and we may not reverse a “district court’s account of the evidence [that] is plausible in light of the entire record ... even if convinced that, had [we] been sitting as trier of fact, [we] would have weighed the evidence differently.” Harlamert v. World Finer Foods, Inc., 489 F.3d 767, 771 (6th Cir. 2007) (citing Anderson v. City of Bessemer City, N.C., 470 U.S. 564, 574—75, 105 S.Ct. 1504, 84 L.Ed.2d 518 (1985)). We cannot deem “the factfinder’s choice” between two permissible views of the evidence clearly erroneous. Id. “[W]hen a trial judge’s finding is based on his decision to credit the testimony of one of two or more witnesses, each of whom has told a coherent and facially plausible story that is not contradicted by extrinsic evidence, that finding, if not internally inconsistent, can virtually never be clear error.” Anderson, 470 U.S. at 575, 105 S.Ct. 1504. We must “liberally construe[ ]” findings in support of the district court’s judgment, “even if the findings are not as explicit or detailed as we might desire.” Truform, Inc. v. Gen. Motors Corp., 80 Fed.Appx. 968, 973 (6th Cir. 2003) (unpublished opinion) (citing Grover Hill Grain Co. v. Baughman-Oster, Inc., 728 F.2d 784, 793 (6th Cir. 1984)). “[T]he failure to even make an express finding of a particular fact does not require reversal if a complete understanding of the issues may be had without the aid of separate findings.” Grover Hill, 728 F.2d at 793; Truform, 80 Fed.Appx. at 973.

Contrary to the Defendants’ contentions, the district court here did not rely on legally insufficient circumstantial evidence and credibility determinations in finding proof of disclosure by a preponderance. Although the district court did not explicitly state that it was crediting the Plaintiffs’ proffer of inmate testimony respecting other inmates’ access to the folder and use of the information over the Defendants’ proffered testimony regarding the appearance of the folder, the court did explicitly state it was discrediting all of the Defendants’ testimony. See Beaven, 2007 WL 1032301, at *17. We conclude that, when viewed in context, the findings in the remainder of the opinion confirm that the district court accepted the inmates’ testimony of disclosure. See id. at *2-3. These findings support the district court’s judgment and permit us to have a clear understanding of the reasoning behind the district court’s decision. Grover Hill, 728 F.2d at 793 (“If, from the facts found, other facts may be inferred which will support the judgment, such inferences should be deemed to have been drawn by the District Court.”).

We therefore affirm the district court’s judgment that a disclosure occurred. Because we have affirmed the district court’s judgment that a Privacy Act disclosure occurred in violation of § 552a(g)(1)(D) and that “the agency acted in a manner that was intentional or willful,” we conclude that the district court properly de*557termined that the Plaintiffs were entitled to damages under § 552a(g)(4) of the Privacy Act. The Defendants do not challenge the district court’s damages award on appeal, but our conclusion does require us to address one of the Plaintiffs’ cross-appeal contentions.

D. “Actual Damages” Requirement

On cross-appeal, the Plaintiffs argue that the district court’s damages award does not make them “whole” because, although the court awarded mitigation damages, it disallowed recovery for “lost time” and “future protective measures” that the Plaintiffs assert should qualify as “actual damages” under common-law tort principles. The Plaintiffs asserted that they should be compensated at their regular hourly rate as BOP employees for the time they had already spent dealing with the disclosure so that damages would exceed the $1,000 statutory minimum for actual damages. The district court disagreed, but found that all of the Plaintiffs were entitled to recover the $1,000 statutory minimum because the costs of the prophylactic measures each took to prevent harm from the disclosure constituted actual damages. The court concluded that compensation for lost time was unavailable under the Privacy Act because it must narrowly construe the waiver of sovereign immunity in the damages provision. The court found that only two of the Plaintiffs had incurred costs above $1,000, and the court awarded the respective amount of actual damages to each. The court rejected the claim for damages for any future protective measures, finding that such damages would be unreasonable given the court’s earlier finding that none of the Plaintiffs had suffered adverse effects from the disclosure. Beaven, 2007 WL 1032301, at *28; Doc. 353 (Damages Op. at 3-5).

The Supreme Court in Doe v. Chao held that a Privacy Act plaintiff must prove some actual damages before she is entitled to the minimum statutory damages under § 552a(g)(4), specifically rejecting “general” or “presumed” damages available in other common-law privacy torts. Doe, 540 U.S. at 621—23, 124 S.Ct. 1204. The Court also noted that, from a review of the legislative history, “it is implausible that Congress intended tacitly to recognize a nominal damages remedy after eliminating the explicit reference to general damages.” Id. at 623 n. 6, 124 S.Ct. 1204. In Hudson v. Reno, we noted that although “actual damages” as required under § 552a(g)(4) “has no plain meaning or consistent legal interpretation, ... when it is being applied against the government [as a waiver of sovereign immunity] it must be narrowly interpreted — here that requires finding that actual damages only mean out-of-pocket losses, not emotional distress.” Hudson, 130 F.3d 1193, 1207 n. 11 (6th Cir. 1997) (declining to follow Johnson v. Dep’t of Treasury, 700 F.2d 971 (5th Cir. 1983), abrogated by Doe, 540 U.S. at 618, 124 S.Ct. 1204), cert. denied, 525 U.S. 822, 119 S.Ct. 64, 142 L.Ed.2d 50 (1998), abrogated on other grounds by Pollard v. E.I. du Pont de Nemours & Co., 532 U.S. 843, 848, 121 S.Ct. 1946, 150 L.Ed.2d 62 (2001); see Fanin v. U.S. Dep’t of Veterans Affairs, 572 F.3d 868, 874 (11th Cir. 2009) (acknowledging Hudson and reiterating that the Sixth and Eleventh Circuits follow the same rule requiring proof of actual pecuniary loss), cert. denied, — U.S. -, 130 S.Ct. 1755, 176 L.Ed.2d 212 (2010). In Hudson, this court specifically rejected an attempt to broaden actual damages to include compensatory damages such as “ ‘mental injuries, loss of reputation, embarrassment or other non-quantifiable injuries,’ ” but did not actually decide whether § 552a(g)(4) foreclosed such damages. Hudson, 130 F.3d at 1207 (quoting Fitzpatrick v. I.R.S., 665 F.2d 327, 331 (11th Cir. 1982), overruled on other grounds by Doe, 540 U.S. at 618, 124 S.Ct. *5581204). The Hudson court’s finding that the plaintiff could not prove actual damages was not necessary to its decision; indeed, the court introduced its actual damages discussion as “[a] final basis for affirming the District Court’s decision” that the plaintiff had presented no viable Privacy Act claims. Hudson, 130 F.3d at 1207. We need not now decide whether this circuit should adopt the Hudson court’s rationale expressed in dicta because it is not necessary to do so to reach a decision in this case.12

First, even if we determined that the Plaintiffs’ alleged “future protective measures” damages are cognizable “out-of-pocket losses,” the Plaintiffs are unable to prove causation. See Doe, 540 U.S. at 621-22, 124 S.Ct. 1204 (holding a plaintiff must prove causation in order to obtain damages); Hudson, 130 F.3d at 1207 (same). The Plaintiffs do not challenge the district court’s factual finding that it was unreasonable to believe that the disclosure would cause any adverse effects in the future based on the lack of adverse effects to date, Doc. 353 (Damages Op. at 3—4), and, by extension, it is only logical that the Plaintiffs also cannot prove that the disclosure would cause any future “out-of-pocket losses.” See Hudson, 130 F.3d at 1207 n. 11; Brown v. U.S. Dep’t of Justice, 169 Fed.Appx. 537, 541 (11th Cir. 2006) (unpublished opinion) (§ 552a(g)(4) actual damages claims cannot be merely speculative). We therefore affirm the district court’s decision to deny the “future protective measures” damages.

The additional “lost time” damages sought by the Plaintiffs may qualify as “out-of-pocket losses” under the rationale in Hudson.13 The Plaintiffs do not challenge the district court’s finding that the out-of-pocket costs that the Plaintiffs incurred for taking prophylactic measures did not exceed $1,000, and they have not included a calculation of any “lost time” damages as an out-of-pocket cost incurred at their hourly rate in their briefing on appeal.14 However, we conclude *559that the district court erred in denying the Plaintiffs’ “lost time” damages on the ground that their failure to assert valid FTCA claims precluded them from recovering damages for their valid Privacy Act claims. We agree with the Hudson court’s determination that the sovereign immunity waiver in § 552a(g)(4) requires a narrowing construction, and that this narrowing construction when applied here justifies requiring the Plaintiffs to prove “out-of-pocket losses” for their “lost time” damages. Hudson, 130 F.3d at 1207 n. 11. We therefore reverse the district court’s damages decision to the extent that it denies the Plaintiffs’ recovery for “lost time” damages on the theory of sovereign immunity, and we remand to the district court for a finding on the amount of “lost time” damages for each Plaintiff. Such damages are neither “general damages” nor “presumed damages” within the meaning accorded to those terms in Doe. Doe, 540 U.S. at 620-27, 124 S.Ct. 1204. If the district court finds that a Plaintiff is able to prove that his or her “lost time” coupled with the costs of his or her prophylactic measures taken exceeds $1,000, then that Plaintiff should be entitled to recover the total amount of his or her actual damages rather than the statutory minimum of $1,000.

E. Remaining Issues

The Plaintiffs raised the three remaining issues in their cross-appeal only as alternative grounds for relief “[i]f for any reason this Court does not affirm the trial court’s determination that an actual disclosure occurred, ‘intentionally or willfully,’ within the meaning of the Privacy Act.” Pls-Appellees/Cross-Appellants Br. at 55, 62, 63. Because we have affirmed the district court’s judgment in this respect, we con-elude that we do not need to address the remaining issues on cross-appeal.

III. CONCLUSION

The district court did not clearly err in finding that the agency’s “inadvertent” final act was “willful” within the meaning of 5 U.S.C. § 552a(g)(4) because a court may consider the entire course of conduct that resulted in the Privacy Act violation in making its required finding under § 552a(g)(4). Further, the district court did not abuse its discretion in imposing a non-rebuttable adverse evidentiary inference of disclosure as a sanction for the Defendants’ destruction of relevant evidence with the knowledge that the evidence would be necessary for known potential claims, as this was a proper sanction in light of the remedial purpose of evidentiary sanctions. Finally, from a review of the district court’s opinion, we conclude that the court did not commit clear error in its alternative finding that the Plaintiffs did prove disclosure by a preponderance of the evidence. We cannot agree, however, with the Plaintiffs’ contention that “actual damages” recoverable under the Act includes recovery for future protective measures, but we conclude that the Plaintiffs may be entitled to recovery for lost time if they can prove out-of-pocket losses. The district court correctly declined to extend the meaning of “actual damages” beyond the scope of our precedents, but it erred in extending sovereign immunity to preclude potential out-of-pocket losses. Therefore, we AFFIRM the district court’s judgment finding the Defendants liable on the Plaintiffs’ Privacy Act claims and finding that “future protective measures” damages are un*560available, but we REVERSE the district court’s judgment as it relates to the Plaintiffs’ “lost time” damages and we REMAND for proceedings consistent with this opinion.

dissenting.

Because I do not agree that bringing an unlabelled folder containing Plaintiffs’ Privacy Act-protected information into an unsecured workspace rose to the level of “intentional or willful” agency action under 5 U.S.C. § 552a(g)(4), I must respectfully dissent.

The majority affirms the district court’s award of Privacy Act damages to Plaintiffs, upholding the district court’s conclusion that Defendants “acted in a manner which was intentional or willful” as required by § 552a(g)(4), despite that court’s finding that the final act resulting in disclosure — Jones’s leaving the folder unsecured on Moore’s desk — was inadvertent. In order to support its ruling, the majority reads the Privacy Act-to allow a court to consider “the entire course of conduct that resulted in [a violation]” when determining whether an agency acted intentionally or willfully under § 552a(g)(4). Maj. Op. at 551. While I agree with the substance of this interpretation, I would limit the “intentional or willful” inquiry to those agency actions that have a direct causal connection to the Privacy Act violation. As I read § 552a(g)(4), its application to suits brought under § 552a(g)(1)(D) implies that the agency’s relevant actions are only those that constitute a failure to comply with a provision of the Privacy Act. Otherwise I fear that too wide a range of agency conduct could be swept within the “intentional or willful” analysis. Basing a finding of “intentional or willful” conduct on agency actions that are not causally connected to a Privacy Act violation would subvert Congress’s efforts to strike a balance between providing an appropriate damage remedy to victims of Privacy Act violations and safeguarding the government from crippling liability under the Privacy Act. See Privacy Act of 1974, Pub.L. No. 93-579, § 2(b)(5), 88 Stat. 1896, 1896 (1974) (“The purpose of this Act is to provide certain safeguards for an individual against an invasion of personal privacy by requiring Federal agencies ... to ... be subject to civil suit for any damages which occur as a result of willful or intentional action which violates any individual’s rights under this Act.” (emphasis added)). This balance is evident in Congress’s decision to select “intentional or willful” conduct as the standard of recovery for Privacy Act damages, instead of the stricter “willful, arbitrary or capricious” standard originally favored by the House of Representatives or the more lenient negligence standard proposed by the Senate. See Analysis of House and Senate Compromise Amendments to the Federal Privacy Act, reprinted in 120 Cong. Rec. 40,405, 40,406 (1974). It has also served as a guiding principle for several courts construing § 552a(g)(4). See, e.g., Albright v. United States, 732 F.2d 181, 189 (D.C.Cir. 1984) (“[T]he ‘intentional or willful’ action requirement of Section 552a(g)(4) refers only to the intentional or willful failure of the agency to abide by the Act, and not to all voluntary actions which might otherwise inadvertently contravene one of the Act’s strictures.” (emphasis added)), abrogated on other grounds by Doe v. Chao, 540 U.S. 614, 124 S.Ct. 1204, 157 L.Ed.2d 1122 (2004).

Applying this principle to Plaintiffs’ claim, when determining whether Defendants acted intentionally or willfully we should consider only those acts of Defendants that played a part in causing the unauthorized disclosure of Plaintiffs’ protected information. “An agency acts intentionally or willfully ‘either by committing the act without grounds for believing it to be lawful, or flagrantly disregarding *561others’ rights under the [Privacy] Act.’ ” Mount v. U.S. Postal Serv., 79 F.3d 531, 533 (6th Cir. 1996) (alteration in original) (quoting Wilborn v. Dep’t of Health & Human Servs., 49 F.3d 597, 602 (9th Cir. 1995)). As the majority notes, Defendants’ actions were not “intentional” since the district court concluded that “leaving the folder unsecured on Moore’s desk was inadvertent.” Beaven v. U.S. Dep’t of Justice, No. 03-84-JBC, 2007 WL 1032301, at *17 (E.D.Ky. 2007). Therefore, Plaintiffs must prove that Defendants acted willfully by showing that Defendants flagrantly disregarded their rights under the Privacy Act through actions that made a prohibited disclosure unreasonably likely to occur. Based on the district court’s factual findings in this case, I do not believe Plaintiffs satisfied their burden.

The district court determined that “Jones’s conscious decision to ignore the risks associated with bringing unmarked confidential information into an area to which inmates have access” qualified as “willful” conduct under § 552a(g)(4). Id.1 The district court’s opinion did not explain what acts prior to leaving the documents on Moore’s desk were relevant to its determination; it relied only on the eonclusory testimony of Plaintiffs’ expert that “the information was handled in reckless disregard of the Privacy Act and relevant guidelines.” Id. However, I do not see how Jones’s actions evidenced a “reckless disregard” of the danger that unauthorized persons would access the file. Jones carried the folder into an area where no one was present except himself and two experts from Washington, D.C. sent by the BOP to audit staff and prisoners’ computer use. Inmates and other prison personnel did not have access to this workspace during the night-time hours Jones would be working; they were to return to the area the next day,2 a time when, except for Jones’ inadvertence, the folder would have been returned to his secure office.

Jones’s decision to bring into an unsecured workspace more information than necessary to complete the investigation and his failure to properly label the information as “LOU-Sensitive” are clearly negligent. Nevertheless, since Jones fully intended to return the folder to the security of his office once he had completed his work and his failure to do so was merely inadvertent, I cannot view this as an “extraordinary departure from standards of reasonable conduct.” Kostyu v. United States, 742 F.Supp. 413, 417 (E.D.Mich. 1990).3 Though I believe that Jones’s ac*562tions might rise to the level of “willful” if his or other FMC employees’ conduct established a pattern of mishandling sensitive information, the evidence does not support such a finding; instead, it indicates that Jones did not ordinarily take the file out of his secure office, and prior exchanges of this information between employees were made by hand without mishap. For these reasons, I would reverse the district court’s award of Privacy Act damages to the Plaintiffs based on a violation of § 552a(b). This ruling requires me to consider Plaintiffs’ cross-appeals for alternative grounds of relief.

Plaintiffs first contest the district court’s summary judgment ruling denying its claim for Privacy Act damages based on Defendants’ failure to follow BOP rules governing security procedures for sensitive information. Section 552a(g)(1)(D) provides a damage remedy for an agency’s “fail[ure] to comply with any other provision of this section, or any rule promulgated-thereunder, in such a way as to have an adverse effect on an individual.” § 552a(g)(1)(D). Plaintiffs claim that the BOP Program Statements Jones disobeyed by failing to mark the folder and its contents as “LOU-Sensitive” before transporting it to an unsecured area constitute “rule[s] promulgated” under the Privacy Act, making Jones’s violation actionable under § 552a(g)(1)(D).

The plain meaning and construction of § 552a suggests that “rule promulgated” as used in § 552a(g)(1)(D) refers only to an agency rule promulgated under the notice- and-comment procedures of the Administrative Procedure Act, 5 U.S.C. § 553. “Promulgate” appears in three other subsections of § 552a, all of which explicitly reference § 553; for example, § 552a(f), entitled “Agency rules,” requires that “[i]n order to carry out the provisions of this section, each agency that maintains a system of records shall promulgate rules, in accordance with the requirements (including general notice) of section 553 of this title.” § 552a(f); see also § 552a(j) (“The head of any agency may promulgate rules, in accordance with the requirements (including general notice) of sections 553(b)(1), (2), and (3), (c), and (e) of this title .... ”); § 552a(k) (same). In contrast, the BOP Program Statement that forms the basis of Plaintiffs’ claim was created under § 552a(e), which requires an agency to “establish rules of conduct for persons involved in ... maintaining any record,” § 552a(e)(9) (emphasis added), and to “establish appropriate administrative, technical, and physical safeguards to insure the security and confidentiality of records,” § 552a(e)(10) (emphasis added). The difference in language between § 552a(f) and (g)(4) on the one hand, and § 552a(e)(9) and (10) on the other, suggests that “rules of conduct” or “safeguards” “established” under § 552a(e)(9) and (10) are not within the damage remedy provided in § 552a(g)(4) for an agency’s failure to comply with “rules promulgated.” See also Office of Mgmt. & Budget, Privacy Act Guidelines — July 1, 1975, 40 Fed.Reg. 28,949, 28,969 (July 9, 1975) (“In addition to the grounds specified in subsections (g)(1)(A) through (C) above, an individual may bring an action for any other alleged failure by an agency to comply with the requirements of the Act or failure to comply with any rule published by the agency to implement the Act (subsection (f)).... ”). Because a BOP Program Statement is not a rule promulgated through the notice-and-eomment process, see Reno v. Koray, 515 U.S. 50, 61, 115 S.Ct. 2021, 132 L.Ed.2d 46 (1995) (describing a BOP Program Statement as an “internal agency guideline” that is “akin to an ‘interpretive rule’ that ‘do[es] not require *563notice and comment’ ” (alteration in original) (quoting Shalala v. Guernsey Mem’l Hosp., 514 U.S. 87, 99, 115 S.Ct. 1232, 131 L.Ed.2d 106 (1995))), the district court correctly concluded that its violation is not actionable under the Privacy Act, and I would affirm the grant of summary judgment to Defendants on this claim.

Plaintiffs have two remaining cross-appeals4 based on the district court’s dismissal of their Federal Tort Claims Act (“FTCA”) claim for outrageous conduct and its denial of their motion for sanctions against Defendants. Plaintiffs’ FTCA claim alleges that Defendants committed the tort of outrage through “Jones’s improper access to the information in the folder, the failure to properly mark the documents or folder, the transportation of the folder without taking appropriate security precautions, leaving the folder unsecured in UNICOR, and FMC’s fail[ure] to timely report to OIA the result of FMC’s inquiry into Jones’s handing of the Marion Johnson incident.” Beaven, 2007 WL 1032301, at *26.5 The district court dismissed this claim as moot, finding that “plaintiffs’ damages are adequately compensated by the award under the Privacy Act.” Id. at *27. Because I would make Plaintiffs’ FTCA claim no longer moot by overturning their damage award, I would remand this claim to the district court.

Plaintiffs’ motion for sanctions against Defendant for its destruction of the folder and for misrepresentations related to the folder made during discovery was denied by the district court on similar grounds. Because it had already imposed the non-monetary sanction of the adverse inference of disclosure, which was dispositive of Plaintiffs’ Privacy Act claim, and because Plaintiffs were entitled to move for attorneys’ fees as a prevailing party under the Privacy Act, the district court concluded that further sanctions would be unjust under the circumstances and were not necessary to deter similar future abuses. Reversing the district court’s ruling for Plaintiff on their Privacy Act claim takes the substance out of the district court’s adverse inference and forecloses Plaintiffs from receiving attorneys’ fees under the Privacy Act, so I would therefore remand Plaintiffs’ motion for sanctions to the district court.

In summary, the record in this case does not support a determination that Defendants acted intentionally or willfully as required by the Privacy Act in order for Plaintiffs to recover damages from Defendants’ inadvertent disclosure of protected information; I find unavailing the majority’s attempt to use Defendants’ negligent acts — namely, the failure to label the folder containing the prison employees’ protected information. as “LOU-Sensitive,” and Jones’s transferring of the entire folder, rather than only the information needed to perform the investigation of the computers, to an area that, though unsecured, was closed to prison employees and inmates during the night — to transform Jones’s inadvertent failure to take the folder back to his secure office into an “intentional or willful” disclosure. For this reason, I respectfully dissent. I would reverse the district court’s judgment holding Defendants liable for Plaintiffs’ Privacy Act claim premised on unauthorized disclosure. On Plaintiffs’ cross appeals, I would affirm the district court’s grant of sum*564mary judgment to Defendants on Plaintiffs’ Privacy Act claim premised on Defendants’ violation of internal BOP policies. I would reverse the district court’s dismissal of Plaintiffs’ FTCA claim and its denial of Plaintiffs’ motion for sanctions and remand both issues to the district court for reconsideration.