Richard A. Chichakli, proceeding pro se , brought this lawsuit against the Office of Foreign Assets Control and the Department of State, alleging disclosures of his personal identifying information in violation of the Privacy Act. The District Court granted the motion to dismiss filed by the defendants, holding that Chichakli failed to state a claim under the Privacy Act because the government agencies had made the purported disclosures as a proper "routine use" of the information. On appeal, Chichakli filed his own briefs and adopted the arguments made in the briefs of court-appointed amicus . 1 For the reasons discussed below, we affirm.

I.

The International Emergency Economic Powers Act ("IEEPA") authorizes the President to regulate foreign commerce after identifying an "unusual and extraordinary threat" from abroad. See 50 U.S.C. § 1701 . President George W. Bush issued an Executive Order pursuant to IEEPA on July 22, 2004, declaring a national emergency, blocking property of certain persons, and preventing importation of goods from Liberia. Exec. Order No. 13,348, 69 Fed. Reg. 44,885 (July 22, 2004). The Order specified that "all property and interests in property" of persons subject to sanctions would be "blocked and [were] not [to] be transferred, paid, exported, withdrawn, or otherwise dealt in." Id. OFAC later determined that Chichakli was acting on behalf of an arms-trafficker named Viktor Bout, who had been named in the Order. In April 2005, OFAC issued a Blocking Notice listing Chichakli as a Specially Designated National ("SDN"), subject to the provisions of Executive Order 13,348. See Chichakli v. Szubin , 546 F.3d 315 , 316 (5th Cir. 2008).

U.S. agencies released Chichakli's personal, identifying information pursuant to the Order. OFAC published Chichakli's name on its SDN list, which is "designed ... to assist the public in complying with the various sanctions programs administered by OFAC." 70 Fed. Reg. 38,255 ; 38,334 (July 1, 2005); OFAC, SPECIALLY DESIGNATED NATIONALS AND BLOCKED PERSONS LIST , https://www.treasury.gov/ofac/downloads/sdnlist.pdf. This list included Chichakli's name, Social Security Number, date of birth, aliases, residential and business addresses, and country of origin. OFAC transmitted Chichakli's information to the Department of State, and the Department of State then transmitted the information to the United Nations to consider implementing similar sanctions. The United Nations identified Chichakli as subject to its sanctions regime, and it published his personal information, including his Social Security Number and his Australian Driver's License number, online. See J.A. 16; see also United Nations, Consolidated United Nations Security Council Sanctions List, https://www.un.org/sc/suborg/en/sanctions/un-sc-consolidated-list.

Chichakli left the United States on May 2, 2005. J.A. 45, 74-75. He was extradited to the United States from Australia after being indicted by a Grand Jury in the United States in 2009. See United States v. Chichakli , No. S3:09-cr-1002, 2014 WL 5369424 , at *1 (S.D.N.Y. Oct. 16, 2014). He was sentenced to five years in prison and remained incarcerated until June 9, 2017. United States v. Bout , 651 Fed.Appx. 62 , 63 (2d Cir. 2016) ; Judgment, United States v. Chichakli , No. S3:09-cr-1002-02, at 3 (S.D.N.Y. Dec. 9, 2014).

Chichakli challenged OFAC's Blocking Notice listing him as an SDN and lost in the Fifth Circuit. Szubin , 546 F.3d at 316 . He tried to bring a similar claim in the District of Columbia, but the claim was precluded on the basis of res judicata . Chichakli v. Obama , 617 Fed.Appx. 3 , *3-4 (D.C. Cir. 2015). President Obama signed Executive Order No. 13,710 on November 12, 2015, which terminated the Liberian crisis' emergency status and, with it, Chichakli from the Specially Designated Nationals and Blocked Persons lists. See Exec. Order No. 13,710, 80 Fed. Reg. 71,679 (Nov. 12, 2015). Shortly thereafter, the United Nations Security Council ended the bulk of its sanctions against Liberia.

Chichakli, proceeding pro se , filed the complaint below on July 20, 2015, seeking damages and injunctive relief. J.A. 6, 22-24. 2 He alleged that OFAC violated the Privacy Act when it published his personal information online and when it transmitted the information to the State Department. J.A. 6-7. Chichakli also alleged that the State Department violated the Act by transmitting his personal information to the United Nations. J.A. 7. He claimed that, as a result of the publication of his personal information, he was a victim of identity theft. J.A. 8. He alleged that multiple bank accounts were opened in his name, and the opening of new accounts harmed his credit score, leaving him unable "to buy a home, rent, obtain credit, work, buy insurance, or perform any of the basic and everyday[ ] functions that require 'credit check.' " J.A. 13; Compl. ¶ 23. 3

The defendants moved to dismiss Chichakli's Complaint on multiple grounds: (1) Chichakli's claims were barred by the statute of limitations; (2) the defendant agencies had engaged in a valid "routine use" of the information, consistent with the Privacy Act; (3) Chichakli failed to allege a disclosure by the State Department; and (4) Chichakli failed to properly allege any pecuniary damages. Appellees' Br. 7-8.

The District Court granted the defendants' motion to dismiss on August 19, 2016. Chichakli v. Kerry , 203 F.Supp.3d 48 (D.D.C. 2016). The court first construed all of the claims to fall under the Privacy Act and the claims against individual defendants as "if [Chichakli] had brought them against the United States itself" because the Privacy Act does not provide a cause of action against individuals. Id. at 53 . Bypassing the statute-of-limitations issue, the District Court held that Chichakli failed to state a claim because OFAC's use of his personal information fell into the "routine use" exception. Id. at 53 & n.5. The District Court concluded that disclosing Chichakli's information, including his Social Security Number, was "entirely consistent with OFAC's mission to implement and enforce economic sanctions." Id. at 55 .

Similarly, the District Court held that Chichakli had failed to state a claim against the State Department because the agency's alleged disclosure was also pursuant to a valid routine use of the information. The District Court rejected Chichakli's argument that the State Department's disclosure of an additional piece of identifying information-his Australian driver's license number-somehow changed the calculus because " 'identification media (such as passports, residence, or driver's license information),' ... are among the types of information about an individual maintained in [the State Department's] Security Records." Id. at 57 (quoting 78 Fed. Reg. 27,277 ). As an alternative ground for dismissal, the District Court held that Chichakli had also failed to plead "concrete and quantifiable damages." Id. at 58 . Chichakli timely filed a notice of appeal, and this Court appointed amicus to represent him. In addition to the arguments made in his brief, Chichakli has adopted the arguments made in the amicus brief filed on his behalf.

II.

To state a claim under the Privacy Act, a plaintiff must establish that (1) the agency violated a provision of the Act; (2) the violation was intentional or willful; and (3) the violation had an "adverse effect" on the plaintiff in the form of actual damages. Maydak v. United States , 630 F.3d 166 , 178 (D.C. Cir. 2010) (citing 5 U.S.C. § 552a(g) ). An agency violates the Act when it "discloses" information in the form of a "record" from a "system of records" and the disclosure is not pursuant to a valid exception under the Act. 5 U.S.C. § 552a(b).

Whether the purported disclosure was made pursuant to a valid "routine use" is the only issue here. 4 "To fit within the confines of the routine use exception to the Privacy Act, an agency's disclosure of a record must be both (i) 'for a purpose which is compatible with the purpose for which it was collected' and (ii) within the scope of a routine use notice published by the agency." Ames v. Dep't of Homeland Sec. , 861 F.3d 238 , 240 (D.C. Cir. 2017) (quoting 5 U.S.C. § 552a(a)(7) and citing § 552a(e)(4)(D) ). The District Court's opinion focused on whether the purported disclosures were "for a purpose ... compatible with the purpose for which [the record] was collected," ultimately holding that they were. See 203 F.Supp.3d at 53-57 . The District Court also held that the purported disclosures were within the scope of routine-use notices published by the agencies. Id.

Amicus for Chichakli argues, in the main, that the purpose of OFAC's and the State Department's disclosures of Chichakli's personal identifying information was incompatible with the reasons the information was collected. Without deciding the precise definition of "compatibility," we agree with the District Court that under any reasonable interpretation, the purposes of OFAC's and the State Department's disclosures were compatible with the purposes for which each agency collected the information. The purpose for collecting Chichakli's identifying information-to investigate whether to designate him for economic sanctions and to implement the sanctions-is precisely aligned with the purpose of disclosure-to implement the sanctions by publishing the information to the public. This is true for OFAC, as well as the Department of State. Amicus relies on Sussman v. U.S. Marshals Service , 494 F.3d 1106 (D.C. Cir. 2007), but that case is inapposite. In Sussman , this Court held that when a U.S. Marshal disclosed personal information by "yelling and screaming" at a group of individuals being questioned in an investigation, the disclosure was not compatible with the purpose of disclosing information "to the extent necessary to obtain information or cooperation" in an investigation. Sussman , 494 F.3d at 1122-23 . That is a far cry from the situation here. The purpose of the purported disclosures was in no way incidental-the information was published by OFAC and transmitted by the State Department to implement the sanctions regime. As in Ames , the disclosure here was compatible with the purpose of collection "under any reasonable formulation of the compatibility test...." See Ames , 861 F.3d at 240 n.1.

For the routine-use exception to apply, the disclosure must also be covered by a routine-use notice published by the agency. The State Department published a routine-use notice in 2005, which covers the publication of personal identifying information to foreign entities and "other public authorit[ies]" for law-enforcement purposes. 70 Fed. Reg. 3,430 , 3,432 (Jan. 24, 2005). To the extent the problematic disclosures occurred after 2010, OFAC has had a routine-use notice published in the Federal Register, which also covers disclosure of personal identifying information "to the general public ... regarding individuals and entities whose property and interests in property are ... affected by ... OFAC economic sanctions programs[.]" See 75 Fed. Reg. 61,853 , 61,856 (Oct. 6, 2010). Both of these routine-use notices cover the alleged disclosures of Chichakli's personal identifying information.

OFAC's routine-use notice that was on the books from 2005 until 2010 did not clearly cover publication of personal information to the public. See 67 Fed. Reg. 7,460 , 7,483 -85 (Feb. 19, 2002). But Chichakli failed to raise this argument below, and therefore it is forfeited. See, e.g. , Keepseagle v. Vilsack , 815 F.3d 28 , 36 (D.C. Cir. 2016) (argument not raised below was forfeited). In any event, an argument about OFAC disclosures in violation of the 2005 OFAC regulations would be barred by the two-year statute of limitations. See 5 U.S.C. § 552a(g)(5). Chichakli has not plausibly alleged that any damages incurred after 2013 are traceable to the 2005 notice as opposed to the 2010 notice.

* * *

The core question at issue in this case is whether Chichakli's personal identifying information was released pursuant to a valid routine-use notice. The answer turns not on the tension between the Privacy Act and the IEEPA, but on whether the release of the information is compatible with the purpose for which the information was collected. Because we hold that it was, the decision of the District Court is affirmed.