Leighton v. Central Intelligence Agency

MEMORANDUM OBERDORFER, Senior District Judge. Currently pending in the above-captioned case is Defendant CIA’s Motion to Dismiss Plaintiff Leighton’s three-count complaint. This Motion has been transferred to the undersigned by consent. See Dec. 5, 2005 Order. For reasons explained below, Leighton’s claim for injunctive relief in Count I is dismissed for failure to exhaust administrative remedies. Moreover, the facts alleged in Leighton’s claims for damages in all three counts are insufficient to state a claim. Accordingly, these claims are dismissed without prejudice. I. Background and Procedural History Leighton’s complaint alleges the following facts. In April 2002 plaintiff signed a one-year contract with the CIA to provide national security-related services. The contract required that Leighton obtain and maintain a security clearance. On June 3, 2002, during the term of the contract, the CIA revoked her security clearance “on the alleged ground that Dr. Leighton had communicated with a ‘member of the media’ in violation of defendant’s security regulations, thereby causing the termination of the contract on the same date and during its term.” Compl. ¶ 11. (The “member of the media” is later identified as Vincent Cannistraro.) On that same day Leighton requested an administrative review of this decision. See Compl. Ex. Y. On June 27, 2003 (a year later), the CIA informed her that a “senior security official *32 concluded that the information relied upon by the adjudicator to make the original security determination was sufficient to support the decision to revoke and deny her access to classified information.” Id. It also advised her that she had the right to a second-level appeal. On July 30, 2003, she initiated the second-level appeal, which was considered by a panel of “senior U.S. government officers.” See Compl. Ex. X. On November 13, 2003, the CIA told Dr. Leighton that it intended to restore her security clearance and that “on future security applications and forms she may, insofar as [the decision to revoke her security clearance] is concerned, affirm that she never had her security clearance revoked.” Compl. ¶ 16. On March 15, 2004, Leighton was rehired as a contract worker by the CIA to perform substantially the same work as provided in the previous contract. Leighton also alleges that the CIA improperly disclosed her identity and her termination. This alleged disclosure consisted of the following: on June 7, 2002, the CIA Executive Director issued a memorandum to personnel warning against leaking classified information and stating that “two contract employees had their security clearances revoked for having unauthorized discussions with media representatives.” Id. ¶ 12. In addition, Leigh-ton alleges that a person working for or on behalf of the CIA told the U.S. News and World Report that the CIA had discharged two contract employees. On July 29, 2002, U.S. News reported that the CIA had discharged two contract employees “for talking to the press.” On April 7, 2004 Leighton filed a complaint with the CIA, requesting that it remove any records that indicate Leighton had provided Cannistraro with sensitive or classified information. She also sought monetary damages. On May 18, 2004, before the CIA decided on the merits of her administrative complaint, Leighton filed this lawsuit. She alleges three violations of the Privacy Act. In Count I, under 5 U.S.C. § 552a(d)(2) she requests that the CIA expunge from her records “in whatever form of any statement by any person that either directly or indirectly indicates that Dr. Leighton provided Vincent Cannistraro classified or sensitive information, or otherwise violated defendant’s regulations pertaining to security in her association with Mr. Cannistraro.” Compl. ¶ 18. In addition, she contends that the CIA intentionally or willfully failed to amend her record or explain why it refused to amend, in violation of § 552a(d)(2). For the willful violations she also requests monetary damages. In Count II, in violation of 5 U.S.C. § 552a(e)(5) Leighton alleges the CIA intentionally or willfully failed to maintain records related to Leighton “with such accuracy, relevance, timeliness and completeness as is necessary to assure fairness in a determination relating to the qualifications, character, rights, or opportunities of, or benefits to Dr. Leighton that may be made on the basis of such record.” Compl. ¶ 2. Leighton further alleges that, on this basis, “a determination was made ... to terminate Dr. Leighton’s contract with the Agency.” Id. As a consequence, she allegedly lost substantial income (by virtue of being fired), and she was forced to liquidate investments at a low period in the market to pay her living expenses. She also incurred “substantial” legal expenses in seeking to restore her security clearance. Id. ¶ 25. In Count III, based on allegations presented above, Leighton contends that the CIA violated 5 U.S.C. § 552a(b) by “willfully or intentionally disclosing] Dr. Leighton’s record” to U.S. News. Leighton *33 argues that this disclosure, “together with the fact of Dr. Leighton’s termination on June 3, 2002, and the memorandum of June 7, 2002 from the defendant’s Executive Director ... revealed to persons in the intelligence community, both governmentalf] and private, that Dr. Leighton had been terminated for wrongful disclosure of classified information.” Compl. ¶ 27 (emphasis added). This wrongful disclosure “humiliated and embarrassed Dr. Leighton, caused her great emotional distress, sleeplessness, tension and depression and damaged her professional reputation, which prior to the wrongful disclosure had been excellent.” Id. ¶ 28. Leighton claims, without further elaboration, that she has exhausted her administrative remedies. Id. ¶ 6. She seeks injunctive relief ordering the Agency to amend her records, monetary damages, and attorney’s fees and costs. On October 6, 2004, the CIA wrote a letter to Leighton’s counsel, informing her that it denied her administrative request to amend her records. It stated that Leighton had the right to enter a statement into her file to describe how, in her view, the files’ contents were inaccurate. The CIA letter also described the process for appealing this decision administratively. It noted, however, that Agency regulations prohibited it from considering such an appeal if the issue is the subject of ongoing litigation. II. The CIA’s Motion to Dismiss The CIA moved to dismiss the complaint on the following grounds: (1) Count I for lack of subject matter jurisdiction because Leighton failed to exhaust administrative remedies; (2) Counts I and II for failure to state a claim because all of her records are accurate; (3) Counts I and II for failure to state a claim because her lawsuit is an impermissible collateral attack on the merits of revoking her security clearance; (4) Count III for failure to state a claim because it failed to allege a disclosure of a “record” under the Privacy Act; and (5) Counts I, II and III for failure to state a claim because she failed to plead any acts sufficient to give rise to a damages award. Because the complaint is dismissed on other grounds, defendants’ third and fifth arguments are not addressed below. In ruling on a motion to dismiss, courts are to accept plaintiffs version of facts as true and construe the complaint liberally, “granting plaintiff[] the benefit of all inferences that can be derived from the facts alleged.” Browning v. Clinton, 292 F.3d 235, 242 (D.C.Cir.2002) (internal citations and quotations omitted). However, courts accept “neither inferences drawn by plaintiffs if such inferences are unsupported by facts set up in the complaint, nor legal conclusions cast in the form of factual allegations.” Id. (internal citations and quotations omitted). The Privacy Act generally provides a means for individuals to seek removal of any records in their personnel file that contain inaccurate facts. It also prohibits the disclosure of an individual’s “record,” and allows for a party to file suit if the disclosure results in an “adverse effect” for that individual. 1 *34 A. Count I: Failure to Exhaust Administrative Remedies 1. Failure to Exhaust in Seeking Injunctive Relief The CIA argues that Leighton failed to exhaust her administrative remedies, relying primarily on Dickson v. OPM, 828 F.2d 32 (D.C.Cir.1987). Dickson, an occasional civil service employee, requested the Office of Personnel Management (“OPM”) to remove from its files documents regarding his military discharge and his previous work history. OPM replied that it would not release his file to any requesting agency during a 30-day period of review. Despite that pledge, it sent Dickson’s file to the Smithsonian, where Dickson then worked as a security guard. Nearly three months after Dickson’s letter, OPM informed him that it removed the information from his file regarding his military discharge, but it refused to implement any of the other amendments that Dickson requested. Dickson did not file an administrative appeal; instead he filed suit in federal court. The district court dismissed the complaint, ruling in part that Dickson failed to exhaust administrative remedies. On appeal Dickson argued that the dilatory response from OPM, coupled with the concededly improper release of his OPM file to the Smithsonian, demonstrated bad faith and made it futile to pursue an administrative remedy. The court of appeals affirmed the lower court’s ruling, holding that Dickson failed to exhaust his administrative remedies. The court ruled that the Privacy Act “provides no exemption from administrative review when an agency fails, even by several months, to abide by a deadline, and none is reasonably implied.” Id. at 40 (citations omitted). In the instant case, the CIA points out that Leighton did not complete the internal administrative procedures before filing this lawsuit. In fact, she did not wait until her first initial appeal was resolved before resorting to litigation. Leighton offers two arguments in response. First, she argues that the provision she invokes in her Privacy Act claim— § 552a(d)(2) — is distinct from the other Privacy Act provisions and does not require administrative exhaustion. This argument is manifestly incorrect. The Privacy Act contemplates a two-step process for an individual who seeks to amend his or her agency records. First, under Section 552a(d)(2), each agency that maintains a system of records shall “permit [an] individual to request amendment of a record pertaining to him.” It also provides that the agency shall “promptly” either correct the record or provide a rea *35 son for its decision to not correct the record. Second, under Section 552a(d)(3), if the agency refuses to amend the records, the party may obtain a review of this decision by an agency official. If the individual follows this two-step process and is not satisfied, then he or she can seek judicial review pursuant to 5 U.S.C. § 552a(g)(l). The judicial review provision provides .that- an individual may bring a civil action in a U.S. district court when an agency either “(A) makes a determination under subsection (d)(3) ... not to amend an individual’s record ..., or fails to make such review in conformity with that subsection,” or “(D) fails to comply with any other provision of this section, or any rule promulgated thereunder, in such a way as to have an adverse effect on an individual.” The judicial review provision identifies subsection (d)(3) because it contemplates that an individual bringing suit has exhausted his or her administrative appeal. It also includes a catch-all provision to allow for judicial review if the agency fails to follow other provisions of the Privacy Act. Leighton appears to argue that, because she is alleging a violation of (d)(2) — the original decision not to amend her records — the catchall provision of subsection 552a(g)(l)(D) is triggered. In contrast, if she alleged a violation of (d)(3) — the administrative appeal provision— 552a(g)(l)(A) would have been triggered. Leighton further contends that while 552a(g)(l)(A) contains language mandating exhaustion, 552a(g)(l)(D) does not. This argument fails, for two main reasons. First, there is nothing in the language of the provision that distinguishes between mandatory or non-mandatory exhaustion requirements. If the 552a(g)(l)(A) provision mandates administrative exhaustion — as Leighton concedes it does (see Opp. Br. 4) — then 552a(g)(l)(D) must as well. There is no basis to distinguish the statute on this basis. Second, the court in Dickson confronted this very question in its decision. In substance, Dickson was challenging the agency’s initial failure to correct his records pursuant to its duty under § 552a(d)(2)— which is precisely the provision that Leigh-ton invokes here. The court held that a party must exhaust its administrative remedies, including the administrative appeal process, before it can file suit in a district court for injunctive relief. If anything, Leighton’s case is easier to decide than Dickson because she did not complete the first-level administrative appeal before she filed suit, much less the second. Leighton’s second basis for her claims that she has no obligation to exhaust administrative remedies is that it would be futile. She argues that the CIA does not allow an appeal of the CIA’s decision while this litigation is pending. CIA regulations make clear that an administrative appeal cannot commence during the pendency of federal litigation. See 32 C.F.R. § 1901.42(c). If her appeal is “futile” based on this regulation, it is a futility of her own making. She could remove this bar to her appeal by seeking a dismissal without prejudice to allow the administrative appeal to proceed. Leighton also appears to argue that exhaustion would be futile because the agency would have taken too long to resolve her complaint. As Dickson held, however, there is no exemption from administrative review even if the agency takes several months to respond. Dickson, 828 F.2d at 40. Finally, at oral argument Leighton’s counsel maintained that pursuing administrative remedies would have been futile because they would have been unsuccessful. These allegations are insufficient to *36 avoid the exhaustion requirements. See id. 2. Failure to Exhaust in Seeking Monetary Damages Although Leighton failed to exhaust her administrative remedies with respect to her claims for injunctive relief, both parties fail to note that claims for damages do not have to satisfy exhaustion requirements. As the D.C. Circuit explained, “[ejxhaustion of these administrative remedies is a prerequisite to bringing civil suit to compel amendment [of personnel records].... By contrast, exhaustion of administrative remedies is not required where an individual seeks damages pursuant to 5 U.S.C. § 552a(g)(4).” Nagel v. U.S. Dept. of Health, Ed. & Welfare, 725 F.2d 1438, 1441 & n. 2 (D.C.Cir.1984) (citations omitted). As a result, Leighton’s prayer for injunctive relief is dismissed without prejudice; Leighton’s claims for monetary damages survive the remedies exhaustion challenge. However, as related below, the claims in all three Counts are dismissed for failure to state a claim. B. Counts I and II: Failure to Allege Inaccurate Information The CIA moves to dismiss Counts I and II for their alleged failure to state a claim. The CIA argues that Leighton has not alleged any erroneous “facts” that are maintained in her file. Leighton alleges that there are statements in her file that she divulged sensitive or classified information to the media. However, under controlling law in this Circuit, this item in her personnel file is not a “fact” subject to correction. Additional “facts” alleged at oral argument are nowhere to be found in Leighton’s complaint, and cannot be addressed here. 1. Facts Subject to Correction under the Privacy Act The “fact” Leighton seeks to expunge — statements that she disclosed sensitive or confidential information to the media — is legally an opinion or a judgment that is not cognizable under the Privacy Act. See Blazy v. Tenet, 979 F.Supp. 10 (D.D.C.1997), summarily aff'd by 1998 WL 315583, 1998 U.S.App. LEXIS 12917 (D.C.Cir. May 12, 1998); see also Reinbold v. Evers, 187 F.3d 348 (4th Cir.1999). In Blazy, a disgruntled CIA computer technician employee sought to expunge certain records from his personnel file that were allegedly inaccurate and that prevented him from obtaining a job at the FBI. Blazy filed suit to amend his records pursuant to 5 U.S.C. § 552a(e)(5). Specifically, Blazy alleged that there were medical opinions in his file that Blazy had previously attempted suicide. However, there was also a memo in his file from the CIA Inspector General’s Office, stating that, as part of a polygraph exam, Blezy explained that “it was very unfair to raise [the suicide issue] again 17 years later. When Mr. Blazy was 18 he took a dose of six sleeping pills after he and his girlfriend terminated their relationship. Mr. Blazy then called her to tell her what he had done. He did this to gain her sympathy, not as a suicide attempt.” Blazy, 979 F.Supp. at 21. Blazy also alleged that his file contained “inaccurate summations of his polygraph reports because these reports state that he admitted that he removed classified information.” Id. at 20. However, “[t]he polygraph summaries reflect that plaintiff admitted that he removed certain documents although he denied that they were classified or that he removed them deliberately or frequently.” Id. The district court noted that actions under the Privacy Act are not sustainable if *37 they seek to remove subjective or opinion-oriented statements in the person’s file. Id. As a result, the court held that the medical report that Blazy had contemplated suicide did not contain any erroneous “facts” and need not be expunged. The court concluded that, since the CIA Inspector General memo “clearly explains that Mr. Blazy did not feel that he was attempting to commit suicide at the time, the Court finds plaintiffs file to be accurate in this regard and that any medical opinions interpreting the incident may remain in the file along with the memorandum.” Id. at 21. In addition, the court concluded that the report that Blazy may have removed classified documents from the CIA building was similarly an expression of opinion or judgment, and not of fact. The court found that, “[wjhile plaintiff may dispute whether the documents at issue were in fact classified, that dispute does not render the summaries inaccurate since they accurately reflect the nature of plaintiffs statements.” Id. at 20-21. Blazy is very similar to the case here. Leighton seeks to expunge as a “fact” “any statement by any person that either directly or indirectly indicates that Dr. Leighton provided Vincent Cannistraro classified or sensitive information, or otherwise violated defendant’s regulations pertaining to security in her association with Mr. Cannistraro.” Compl. ¶ 18. Leighton does not dispute that she had a social relationship with Cannistraro. See Mot. to Dismiss Ex. A. The only real issue is whether Leighton provided classified or sensitive information to Cannistraro. This “fact” is an opinion or subjective judgment, akin to the report in Blaz/s file that he had removed classified information from the CIA. A subsequent decision by the CIA to reinstate her security clearance does not alter this opinion qua opinion. Similarly, in Reinbold v. Evers, 187 F.3d 348 (4th Cir.1999), Reinbold, an employee of the National Security Agency (“NSA”), sued several government agencies under the Privacy Act to expunge certain records from his files. Reinbold’s job required that he obtain and maintain a security clearance. During his employment at NSA, he had several conflicts with his supervisor (Evers), in part because Rein-bold complained that Evers ordered him to alter contractor performance evaluations. Allegedly in retaliation, Reinbold was ordered to undergo a psychological evaluation. Dr. Schmidt, the NSA psychologist who performed the evaluation, “concluded that Reinbold did not present a mental health or security risk.” Id. at 353. Subsequent ' to this evaluation, the NSA ' suspended Reinbold’s security clearance, citing concerns about his judgment, reliability and ability to protect classified information. He was reassigned to a temporary position. Later, Dr. Schmidt performed another series of psychological evaluations of Reinbold. After this second round of evaluations, Dr. Schmidt concluded that Reinbold was “delusional with paranoia-like symptoms.” Reinbold alleges that Dr. Schmidt’s conclusion was based at least in part on comments by Evers. Reinbold subsequently refused to undergo additional psychological testing. During this time an NSA security investigator interviewed Reinbold and his colleagues in an attempt to assess his capacity to handle classified information appropriately. Based on his investigation, Dr. Schmidt’s diagnosis, and Reinbold’s refusal to undergo further psychological evaluation and treatment, NSA recommended that Reinbold’s security clearance be permanently revoked, pending administrative appeal. Reinbold faced termi *38 nation if his security clearance was revoked. In response Reinbold reviewed his personnel file, claimed to find fabrications for his proposed termination, and filed a complaint under the Privacy Act with NSA. He requested that NSA expunge from his records: (1) Dr. Schmidt’s psychological evaluation of him, (2) another supervisor’s statements about him, including that he was a danger to himself and others; that he believed the Navy was “out to get him”; and that “if [he] was going down, [he] would take everyone with him,” and (3) his supervisors’ “incident reports,” detailing his removal from his former job. Id. at 354. On appeal, an administrative panel determined that the revocation of Reinbold’s security clearance was unjustified, and Reinbold should be reinstated at NSA. After reclaiming his job, Reinbold filed suit under, inter alia, the Privacy Act, seeking to expunge his records of the three items listed above. The district court dismissed his claim. The appellate court, in affirming the lower court’s decision, concluded that the “facts” that Reinbold sought to expunge were opinions. “Accordingly, if Dr. Schmidt determined that Reinbold was paranoid and delusional, the Agencies did not err when they recorded that he reached that conclusion, even if that opinion was in error.” Id. at 361. That same logic applied to the opinions of Reinbold’s two supervisors, one of whom apparently had a vested interest in discrediting him. Although “[t]hese individuals’ opinions may be subject to debate, they are not subject to alteration under the Privacy Act as long as the opinions are recorded accurately.” Id. As the court summarized: the Privacy Act does not allow a court to alter records that accurately reflect an administrative decision, nor the opinions behind that administrative decision, no matter how contestable the conclusions may be. An individual who is unhappy with the opinions filed in his records can obtain relief by placing a concise statement in his records which sets forth his disagreement with the opinions contained therein. Id. at 360 (citations omitted). In the case at bar, Leighton accepted an offer to put a statement in her file explaining her point of view on her security clearance revocation. Beyond that, the Privacy Act does not provide a basis for her to expunge an opinion from her file with which she disagrees. Her complaint as to Counts I and II is accordingly dismissed. 2. Remaining “Facts” to be Removed Left for consideration is a nebulous universe of additional “facts” alluded to at oral argument that Leighton seeks to expunge from her record. For reasons that remain unexplained, none of these facts was mentioned in Leighton’s complaint, and consequently these factual allegations are not properly before us. D. Count III: No Disclosure of “Records” Under the Privacy Act In her complaint, Leighton avers that a “person or persons employed by and on behalf of the Agency informed U.S. News and World Report, a nationally and widely distributed magazine, that the Agency had discharged two contract employees. Dr. Leighton was a contract employee.” Compl. ¶ 13. As previously explained, U.S. News published a “Loose Lips” column on July 29, 2002, which stated “Notes from the campaign to snuff out leaks: ... the CIA is looking at contractors and suspended two in June for talking to the press.” “Washington Whispers,” U.S. News and World *39 Report, July 23, 2002 at 10. Leighton argues that this disclosure, together with the fact of Dr. Leighton’s termination on June 3, 2002, and the memorandum of June 7, 2002 from the defendant’s Executive Director ... stating that two contract employees had their security clearance revoked for having unauthorized communications with media persons revealed to persons in the intelligence community, both governmental ] and private, that Dr. Leighton had been terminated for wrongful disclosure of classified information. Compl. ¶ 27. The CIA offers two arguments that this allegation fails to state a claim. First, the CIA contends that the information allegedly disclosed was not a “record,” and, consequently, no “disclosure” occurred. The Privacy Act defines a record as “any item, collection, or grouping of information about an individual that is maintained by an agency, ... and that contains his name, or the identifying number, symbol, or other identifying particular assigned to the individual ...” 5 U.S.C. § 552a(a)(4). If an agency improperly discloses an individual’s record, that individual can file suit if the disclosure had an “adverse effect” on the individual. 5 U.S.C. § 552a(g)(l)(D). The information contained in the U.S. News column was not a record, the CIA insists, because it did not mention Leigh-ton’s name, nor did it “provide any arguably identifiable characteristics, such as her gender, the office for which she worked, her job title, or area of expertise.” Mot. to Dismiss at 21-22. The CIA maintains that Leighton conceded as much based on the statement in her complaint that the U.S. News disclosure, “together with” her termination and the Executive Director’s memorandum, “revealed to persons in the intelligence community ... that Dr. Leighton had been terminated for wrongful disclosure of classified information.” See id. at 22. The CIA argues that this is inherently contradictory: “the fact of Plaintiffs firing is meaningless unless the ‘persons in the intelligence community’ knew of that fact.” Id. (emphasis in original). The D.C. Circuit has identified two requirements that must be met for a disclosure to occur: it “must both be ‘about’ an individual and include his name or other identifying particular.” Tobey v. NLRB, 40 F.3d 469, 471 (D.C.Cir.1994). In Tobey the National Labor Relations Board maintained a computerized database of unfair labor practice cases, including the initials or identifying number of the field examiner assigned to the ease. An NLRB official used Tobey’s initials to search the database to assess his performance. Tobey brought suit under the Privacy Act, charging that using the database was an unauthorized access of his personal records. The D.C. Circuit disagreed. It concluded that the database was not a system of records because it did not contain information “about” individuals. Instead, it contained information “about” NLRB cases, including an individual’s initials. But these initials did not render the record to be about the examiner. Thus, even if information could be rather easily manipulated in a way so that one could collect records about an individual, that information per se is not a “record” about that individual. It is doubtful that the disclosure at issue here has presented any new information to those in the intelligence community. Under Tobey, the question of whether it was an unauthorized disclosure must be resolved on the basis of the information in isolation, not in the context of other information which enables the decoding of the alleged “disclosure.” *40 See Hollis v. U.S. Dept. of the Army, 856 F.2d 1541, 1545 (D.C.Cir.1988) (“when a release consists merely of information to which the general public already has access, or which the recipient of the release already knows, the Privacy Act is not violated.”) (citations omitted). On that basis, information in the U.S. News article was not a disclosure. At oral argument counsel for Leighton attempted to recast the issue as whether a disclosure occurred when a CIA employee disclosed a “record” to a U.S. News reporter. This may be a colorable claim, but it is not sufficiently pled in the complaint. In particular, the complaint does not allege any “adverse effect” that plaintiff suffered as a result of this disclosure that is distinct from the alleged adverse effect of the U.S. News story itself. III. Conclusion For the foregoing reasons, in an accompanying order Leighton’s complaint is dismissed without prejudice. Leighton may seek leave to file an amended complaint as provided in the Federal Rules of Civil Procedure. If she chooses to do so, she is urged to comply with the Rules and plead facts to support her allegations. Footnotes [1] The relevant provisions of the Privacy Act (5 U.S.C. § 552a) for this case provide as follows: Each agency that maintains a system of records shall ... (2) permit the individual to request amendment of a record pertaining to him and ... (B) promptly, either — (i) make any correction of any portion thereof which the individual believes is not accurate, relevant, timely, or complete; or (ii) inform the individual of its refusal to amend the record in accordance with his request, the reason for the refusal, the procedures established by the agency for the *34 individual to request a review of that refusal by the head of the agency or an officer designated by the head of the agency, and the name and business address of that official. 5 U.S.C. § 552a(d). Every agency that maintains a system of records shall ... maintain all records which are used by the agency in making any determination about any individual with such accuracy, relevance, timeliness, and completeness as is reasonably necessary to assure fairness to the individual in the determination. 5 U.S.C. § 552a(e)(5). Finally, subject to certain exceptions not relevant here, "[n]o agency shall disclose any record which is contained in a system of records by any means of communication to any person, or to another agency.” 5 U.S.C. § 552a(b). Moreover, a party may file suit under the Privacy Act if the agency fails to comply with the Act and it results in an "adverse effect” on the party. 5 U.S.C. § 552a(g)(l)(D).