Touchstone Research Group LLC v. Department of Defense

UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF NEW YORK -------------------------------------------------------------x TOUCHSTONE RESEARCH GROUP LLC, et al., : : Plaintiffs, : 18-CV-3451 (OTW) : -against- : OPINION AND ORDER : UNITED STATES OF AMERICA, et al., : : Defendants. : : -------------------------------------------------------------x ONA T. WANG, United States Magistrate Judge: Plaintiffs Touchstone Research Group LLC (“Touchstone”) and “John Does 1-50 and Jane Does 1-50” brought this action, primarily alleging violations of the Privacy Act of 1974 (the “Privacy Act”), 5 U.S.C. § 552a, and the Administrative Procedure Act (“APA”), 5 U.S.C. § 701 et seq., against Defendants the U.S. Department of Defense; James Mattis, Secretary of Defense; Robert Wilkie, Under Secretary of Defense for Personnel and Readiness; Michael V. Sorrento, Director of the Defense Manpower Data Center; Peter A. Robinson, Chief of the Freedom of Information and Privacy Office; and the “United States of America.” Touchstone, a company that obtains veterans’ military records from government records facilities for a fee, alleges that Defendants have violated the Privacy Act and the APA by refusing to provide Touchstone with their customers’ military records or delaying Touchstone’s records requests. Presently before me is Defendants’ Motion to Dismiss Plaintiff’s Amended Complaint in accordance with Fed. R. Civ. P. 10(a), for failure to name all parties, Fed. R. Civ. P. 12(b)(6), for failure to state a claim upon which relief can be granted, and Fed. R. Civ. P. 12(b)(3), for improper venue. (ECF 37).1 For the reasons that follow, Defendants’ motion to dismiss is GRANTED. I. Background A. Facts2 1. Government’s Maintenance of Veteran Military Records The United States government stores veterans’ military records at more than 60 government records facilities across the country. (Am. Comp. ¶ 28). All records prior to the “mid-1990s” are maintained primarily by the National Personnel Records Center (“NPRC”) and are available in hard copy. (Id.). Records from approximately the last 25 years are maintained by “the various military branches themselves” and can be accessed through an online database, the Defense Personnel Records Information Retrieval System (“DPRIS”). (Id.). A number of government records facilities also maintain “client service windows,” at which a veteran may appear in person and request his or her records directly at no charge.3 (Id. ¶ 29). These facilities include the NPRC, the Headquarters of the U.S. Marine Corps (“HQMC”), the Navy Personnel Command (“NPC”), and the Air Reserve Personnel Center (“ARPC”), which are not parties to this action. (Id.). Once the records are requested, the facility “is [] tasked with making that veteran’s 1 Because the Court finds dismissal warranted under Fed. R. Civ. P. 10(a) and 12(b)(6), the Court does not reach Defendants’ arguments concerning improper venue. 2 The following facts are drawn from the Amended Complaint. (ECF 34). “In assessing the legal sufficiency of [a complaint], [a court] must accept factual allegations in the complaint as true and draw all reasonable inferences in favor of the nonmoving party.” Bldg. Indus. Elec. Contractors Ass’n v. City of New York, 678 F.3d 184, 187 (2d Cir. 2012) (citing DiFolco v. MSNBC Cable LLC, 622 F.3d 104, 111 (2d Cir. 2010)). 3 “No fees will be charged for search and review time expended by the Office to produce a record, or for making a photostatic copy of the record, or for having it personally reviewed by the data subject, when a record is retrieved from a system of records pertaining to that data subject. Additional copies provided may be charged under the Office’s established fee schedule.” 5 CFR § 297.206 . request a priority” and must provide the records the same day or “very soon thereafter.” (Id. ¶ 29 ). 2. Touchstone’s Services Touchstone is a record-retrieval company offering a fee-based service to veterans to retrieve their military records from the government. (Id. ¶ 31). Touchstone asserts that it has worked with over 80,000 veterans, helping them to locate and to obtain their military records. (Id.). Touchstone provides each veteran or family member a three-page document to consider and sign. (Pl’s Reply, at 4). The document contains a “Limited Power of Attorney” set forth on the last page, whereby the individual veteran or family member grants to Touchstone “a Limited Power of Attorney for the sole purpose of obtaining my records.” (Id., Ex. 1). Touchstone explained that it has developed an online request form with “E-signature capability” which Touchstone’s customers can use to authorize a search request. (Id. ¶ 32). Touchstone has not explained whether this online request form is the same as the three-page document with a “Limited Power of Attorney” that Touchstone also described. Plaintiff has also developed and “made commercially available” what it calls a “VetRecs Card,” a “verifiable version of a veteran’s military separation documents.” (Id. ¶ 33). Touchstone does not explain how the online request form and the VetRecs Card are relevant to this action. Touchstone also acts as a “third-party verifier” of both hard-copy and electronic records. (Id. ¶ 30). Touchstone digitally signs and locks all retrieved electronic records and affixes a holographic seal with a “$25,000 authenticity guarantee” to all hardcopy records. (Id.). Touchstone asserts that these actions confirm that the records were received directly from a government records facility, and thus prevent individuals from tampering with or forging them. (Id.). According to Touchstone, because of this service, some “private employers,” including “overseas military contractors,” (all unnamed) require veteran applicants to retrieve their military records through Touchstone. (Id.). 3. Government Records Facilities Refuse to Accept Touchstone’s Requests According to Touchstone, in 2011, the Army Human Resources Command (“AHRC”) consolidated and moved its elements in different states to a new consolidated facility at Fort Knox, Kentucky. (Id. ¶ 35). Touchstone thereafter redirected its records requests to this facility. (Id.). Touchstone claims that while it previously received responses to “record requests for recent separations” from the NPRC, the AHRC, and other facilities “within hours,” (Id. ¶ 34), after the consolidation, the AHRC refused to accept requests submitted through Touchstone’s online request form. (Id. ¶ 36). Touchstone claims that “[a]ll other government military records facilities readily accept Touchstone’s veteran request forms.” (Id.). Touchstone states that it “asserted verbally and in writing to [the] AHRC that their facility is legally required to accept Touchstone’s requests.” (Id.). In response, the AHRC cited an internal “Command Policy,” but did not provide further legal support. (Id. ¶ 37). According to Touchstone, Defendant Robinson, then Chief of the Freedom of Information and Privacy Office, “vilif[ied]” Touchstone in an email dated May 21, 2012, by stating “[i]t’s likely your company thrived by taking advantage of the uninformed veteran and the lazy federal employee.” (Id.). Defendant Robinson also allegedly reached out to Touchstone’s clients informing them that “this command does NOT do business with Touchstone [].” (Id. ¶ 38). Touchstone further alleges that beginning in late 2016, two other government facilities, HQMC and the NPC, which had previously returned Touchstone’s requests “within hours,” began returning Touchstone’s requests “within weeks or even months after submission.” (Id. ¶ 39 ). Touchstone alleges that these delays are the result of Defendants AHRC and Robinson contacting HQMC and NPC to direct them not to complete Touchstone’s requests. (Id.). Touchstone does not claim that any other record facilities have denied or intentionally delayed its record requests. 4. Touchstone’s Inability to Use DPRIS After the records facilities began denying or delaying Touchstone’s record requests, Touchstone sought access to DPRIS to retrieve the records electronically. (Id. ¶ 47). On April 5, 2017, Touchstone filled out the “online application located on the DPRIS website,” seeking access as a “designated representative of the veteran.”4 (Id. ¶ 47). Receiving no response, Plaintiff reached out to the DPRIS Help Desk and the Under Secretary of Defense on November 2, 2017 and November 29, 2017, respectively, to request a response to its online application. Yet, as of the filing date of this action, neither has responded. (Id. ¶¶ 48-50). Touchstone also asserts that neither DPRIS nor the human resources database through which it operates includes a veteran’s designated representative as an approved user, (Id. ¶ 43), and appears to argue that the Privacy Act requires that a designated representative be included within the categories of individuals designated as approved users of DPRIS. (Id. ¶¶ 40-46). 4 Touchstone does not explain whether it sought access to DPRIS for each individual veteran for which it served as a representative or, alternatively, whether Touchstone requested general access without any reference to specific veteran clients. B. Procedural Background Touchstone filed the instant action on April 19, 2018. (ECF 1). On August 8, 2018, Touchstone filed an Amended Complaint, adding the Doe plaintiffs. (ECF 34). Defendants moved to dismiss Plaintiffs’ Amended Complaint on October 19, 2018 according to the Federal Rules of Civil Procedure 12(b)(6), 12(b)(3), and 10(a). (Def’s Motion to Dismiss (ECF 37), at 1-2). Plaintiffs opposed the Motion to Dismiss on December 4, 2018, (ECF 42), and Defendants submitted a Reply on December 18, 2018. (ECF 44). C. Plaintiffs’ Claims Plaintiffs bring four causes of action alleging violations of the Privacy Act and the APA.5 Plaintiffs first allege that Defendants violated the Privacy Act by denying Touchstone access to their clients’ records. Plaintiffs’ remaining three causes of action allege violations of the APA. Plaintiffs claim that Defendants violated the APA by denying Touchstone access to their clients’ records, by delaying their responses to Touchstone’s records requests, and by failing to provide an appeal process for denials of Touchstone’s requests. (Id. ¶ 69, 75, 84). II. Discussion A. The Rule 12(b)(6) Motion 1. Legal Standard When presented with a motion to dismiss pursuant to Rule 12(b)(6), a court must accept as true all non-conclusory factual allegations in the plaintiff’s complaint, together with the contents of any documents “integral” to the complaint and any matters of which the Court 5 In Plaintiffs’ opposition, they appear raise a claim sounding in due process for the first time. (Pl’s Opp. At 6-9). However, it is “axiomatic that the [Amended] Complaint cannot be amended by the briefs in opposition to a motion to dismiss.” O’Brien v. National Property Analysts Partners, 719 F. Supp. 222, 229 (S.D.N.Y. 1989). may take judicial notice, and draw all reasonable inferences in favor of the plaintiff. See Doe v. Columbia Univ., 831 F.3d 46, 48 (2d Cir. 2016); McCarthy v. Dun & Bradstreet Corp., 482 F.3d 184, 191 (2d Cir. 2007). However, “a pleading that offers ‘labels and conclusions’ or ‘a formulaic recitation of the elements of a cause of action will not do.’ Nor does a complaint suffice if it tenders ‘naked assertion[s]’ devoid of ‘further factual enhancement.’” Iqbal, 556 U.S. at 678 (internal citations omitted) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555, 557 (2007)). The courts must not “unlock the doors of discovery for a plaintiff armed with nothing more than conclusions.” Iqbal, 556 U.S. at 678-79. To survive a motion to dismiss made under Rule 12(b)(6), the complaint must contain “sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.’” Iqbal, 556 U.S. at 678 (quoting Twombly, 550 U.S. at 570 ). A claim is facially plausible “when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Iqbal, 556 U.S. at 678. Thus, the non-conclusory factual allegations “must be enough to raise a right to relief above the speculative level.” Twombly, 550 U.S. at 555 . If the plaintiff has not “nudged [the] claims across the line from conceivable to plausible, [the] complaint must be dismissed.” Id. at 570 . 2. Dismissal of the John and Jane Doe Claims is Warranted for Failure to State a Claim Because The Amended Complaint Lacks Specific Information Concerning These Plaintiffs Both the Privacy Act and the APA claims—brought by Touchstone “for the benefit of its [unnamed] clients”—fail to state a claim. The Privacy Act allows an individual to obtain civil remedies when an agency “refuses to comply with an individual request under subsection (d)(1) [].” 5 U.S.C. § 552a(g)(1)(B). The “John Doe” and “Jane Doe” plaintiffs are not identified by name,6 and the Amended Complaint does not include any specific allegations regarding these individuals. Indeed, these plaintiffs are not mentioned in the fact section of the Amended Complaint at all; instead, they are only referenced in the “Parties” section, where the Amended Complaint notes that the John Does and Jane Does are “veterans of the U.S. military and/or their families or others whose interests may arise and/or appear during the course of the action,” (Am Comp. ¶ 3), and later in the “Causes of Action” section of the Amended Complaint. Notably absent from the Amended Complaint are any allegations that any specific John Doe or Jane Doe sought and was denied their military records, or that such a request was delayed. Therefore, the claims as they relate to the John Doe and Jane Doe parties are dismissed. 3. Dismissal Of Touchstone’s Privacy Act Claims Is Warranted Because It Does Not Have Standing And The Privacy Act Does Not Require Disclosure To Representatives Touchstone does not have standing to bring an action to enforce the Privacy Act. The plain language of the statute is clear: “the individual may bring a civil action against the agency” when the agency refuses to comply with a request. 5 U.S.C. § 552a(g)(1) (emphasis added). “Individual” is defined as a citizen of the United States or a permanent resident alien. 5 U.S.C. § 552a(a)(2). Entities, even those representing an individual, cannot bring an action under the Privacy Act. See Socialist Workers Party v. U.S. Attorney General, 642 F. Supp. 1357 , 1431 6 This is itself a potential violation of Fed. R. of Civ. P. 10(a) which functions as a ground for dismissal, because no application for these plaintiffs to proceed under a pseudonym has been made. See Fed. R. Civ. P. 10(a) (“[T]he complaint must name all the parties.”); Michael v. Bloomberg L.P., No. 14-cv-2657 (TPG), 2015 WL 585591 , at *4 (S.D.N.Y. Feb. 11, 2015) (stating that the complaint will be dismissed if Plaintiff fails to amend the complaint to identify himself by name); Jaufman v. Levin, No. 06-cv-1295 (NAM) (DRH), 2007 WL 2891987 , at *5 (N.D.N.Y. Sept. 28, 2007) (granting in part and denying in part Defendant’s motion to dismiss because “[t]he amended complaint filed on behalf of the John Doe(s) plaintiff(s) does not comply with Rule 10(a)”); see also Sealed Plaintiff v. Sealed Defendant, 537 F.3d 185, 188-89 (2nd Cir. 2008) (finding that disclosure of the names of parties is generally required unless nondisclosure is permitted under a limited number of exceptions). (S.D.N.Y. 1986) (“Only an individual, not an organization, has standing to obtain a remedy under the [Privacy] Act.”); Macvest Grp., Inc. v. United States, No. 17-CV-9833, 2018 WL 443457 , at *2 (D.N.J. Jan. 16, 2018) (“Claims under the Privacy Act may only be brought by individuals.”); Public Employees for Environmental Responsibility v. EPA, 926 F. Supp. 2d 48, 54-55 (D.D.C. 2013) (finding that a third party cannot bring a Privacy Act claim on behalf of an individual even with that individual’s permission); American Federation of Government Employees v. Hawley, 543 F. Supp. 2d. 44, 49 n. 8 (D.D.C. 2008) (“only individuals have standing” for Privacy Act claims; the statute’s “text permits no other interpretation”); Dresser Industries, Inc. v. United States, 596 F.2d 1231, 1237-38 (5th Cir. 1979) (finding that Congress did not intend for the Privacy Act to cover corporations). Touchstone seemingly argues that because it is acting on behalf of individuals it should be entitled to bring a claim, but this goes against the plain meaning of the statute. Additionally, even if Touchstone could maintain a Privacy Act claim, nothing in the Privacy Act mandates the agency to disclose an individual veteran’s records to a representative such as Touchstone. Touchstone’s reliance on 5 U.S.C. § 552a(b) (Conditions of disclosure) is misplaced. First, 5 U.S.C. § 552a(d) (Access to records), not 5 U.S.C. § 552a(b) (Conditions of disclosure), is the operative provision that governs access to records.7 Further, contrary to Touchstone’s argument, 5 U.S.C. § 552a(b) states that a written request or prior written consent is a necessary condition for disclosure, but in no way requires disclosure upon any written request or consent. See 5 U.S.C. § 552a(b) (prohibiting disclosure of an individual’s 7 As noted above, 5 U.S.C. § 552a(d) grants an individual a right of access to “his record or to any information pertaining to him which is contained in the [agency’s] system.” 5 U.S.C. § 552a(d)(1). record absent a “written request by, or with the prior written consent of, the individual to whom the record pertains.”). Touchstone’s remaining argument is similarly incorrect. While 5 C.F.R. § 297.204 allows the agency to disclose records to an individual’s designated representative, nothing in the regulation requires the agency to do so. See 5 C.F.R. § 297.204 (“A record may be disclosed to a representative of the individual to whom the record pertains after the system manager receives written authorization from the individual . . .” (emphasis added)). Accordingly, Touchstone’s Privacy Act cause of action is dismissed for failure to state a claim. 4. Touchstone’s APA Claims Are Dismissed for Failure to State a Claim The APA provides a limited waiver of sovereign immunity to permit suits for nonmonetary relief. See County of Westchester v. HUD, 778 F.3d 412, 417 (2d Cir. 2015). Section 704 provides, in relevant part, that an agency action is only subject to judicial review under the APA if there is a “final agency action for which there is no other adequate remedy in a court.” 5 U.S.C. § 704 . Further, review is not available under the APA “to the extent that . . . agency action is committed to agency discretion by law.” 5 U.S.C. § 701 (a)(2). Plaintiffs claim that Defendants violated the APA by (1) denying Touchstone access to their clients’ records; (2) by delaying their responses to Touchstone’s records requests; and (3) by failing to provide an appeal process for denials of Touchstone’s requests. (Id. ¶ 69, 75, 84). a. Plaintiff’s First And Second APA Claims Should Be Dismissed Because They Simply Restate Plaintiff’s Privacy Act Claims A review of Plaintiffs’ first and second APA claims—which allege that Defendants denied or delayed Touchstone access to their clients’ records—reveals that they are “simply a restatement of [Plaintiffs’] Privacy Act claims.” Mittleman v. U.S. Treasury, 773 F. Supp. 442, 449 (D.D.C. 1991); see Westcott v. McHugh, 39 F. Supp. 3d 21, 33 (D.D.C. 2014) (“A plaintiff cannot bring an APA claim to obtain relief for an alleged Privacy Act violation.”). Thus, because “Congress did not intend the general grant of review in the APA to duplicate existing procedures for review of agency action,” Bowen v. Massachusetts, 487 U.S. 879, 903 (1988), the first and second causes of action under the APA must therefore be dismissed. b. Plaintiff’s Third APA Claim Should Be Dismissed Because Section 552a(f)(4) Does Not Govern Record Requests And There Is An Established Appeals Process Finally, Plaintiffs’ last cause of action—which alleges that Defendant AHRC violated the Privacy Act when it failed to provide an appeal procedure under 5 U.S.C. § 552a(f)(4) to Plaintiffs for each denial of a Privacy Act request—is also dismissed as the section does not govern record requests. Section 552a(f) of the Privacy Act provides in full: (f) Agency Rules.— In order to carry out the provisions of this section, each agency that maintains a system of records shall promulgate rules, in accordance with the requirements (including general notice) of section 552 of this title, which shall— (1) establish procedures whereby an individual can be notified in response to his request if any system of records named by the individual contains a record pertaining to him; (2) define reasonable times, places, and requirements for identifying an individual who requests his record or information pertaining to him before the agency shall make the record or information available to the individual; (3) establish procedures for the disclosure to an individual upon his request of his record or information pertaining to him, including special procedure, if deemed necessary, for the disclosure to an individual of medical records, including psychological records, pertaining to him; (4) establish procedures for reviewing a request from an individual concerning the amendment of any record or information pertaining to the individual, for making a determination on the request, for an appeal within the agency of an initial adverse agency determination, and for whatever additional means may be necessary for each individual to be able to exercise fully his rights under this section; and (5) establish fees to be charged, if any, to any individual for making copies of his record, excluding the cost of any search for and review of the record. The Office of the Federal Register shall biennially compile and publish the rules promulgated under this subsection and agency noticed published under subsection (e)(4) of this section in a form available to the public at low cost. 5 U.S.C. § 552a(f). Section 552a(f)(4)—which provides for appeals from the denial of an amendment to an individual’s records, not denial of a request for records—is inapplicable here. Section 552a(f)(3)—which does govern requests—is likewise inapplicable because it does not provide for an appeals procedure. Further, to the extent any individual’s records request has been denied, Defendants have regulations concerning denials of access to records and appeals from such denials. See 32 C.F.R. § 505.5 (i) (“Procedures for denying or limiting an individual’s right to access or amendment and the role of the Denial Authority”). In any event, Touchstone has not shown that either the Privacy Act or the regulations provide Touchstone a right to appeal.8 8 Further, Appendix H to Section 505 defines individuals for the purposes of the section to be “[a] living person who is a citizen of the United States or an alien lawfully admitted for permanent resident. The parent or legal guardian of a minor also may act on behalf of an individual. Members of the United States Armed Forces are individuals. Corporations, partnerships, sole proprietorships, professional groups, businesses, whether incorporated or unincorporated, and other commercial entities are not individuals.” 32 C.F.R. § 505 , app. H. c. The APA Claims Should Be Dismissed Because The Plaintiffs Have Not Adequately Alleged “Final Agency Action” And They Have Not Shown How Defendants’ Discretion Is Limited. Notably, Plaintiffs have not alleged a “final agency action.” A plaintiff may bring an APA action only to challenge a “final agency action.” 5 U.S.C. § 704 . An agency action is considered final when “the agency has completed its decision-making process, [and] the result of that process is one that will directly affect the parties.” Dalton v. Specter, 511 U.S. 462, 470 (1994). An action is not considered final if it is “tentative” or “advisory” in nature. See Bennett v. Spear, 520 U.S. 154, 177-78 (1997). Here, Plaintiffs allege that “Defendants have taken final agency action by adopting and implementing rules and procedures that govern the disclosure of Private Information” through the “DRPRIS Website,” “the military branch repositories.” (Am. Compl. ¶ 67, 68). Plaintiffs, however, do not explain what specific “rules and procedures” are at issue. Nor do Plaintiffs explain how these “rules and procedures” are “final agency actions” for purposes of this action. Even assuming, arguendo, that Plaintiffs have shown a “final agency action” for which “there is no other adequate remedy in a court,” both causes of action must still be dismissed under the APA’s “committed to agency discretion” exception. Review is not available under the APA “to the extent that . . . agency action is committed to agency discretion by law.” 5 U.S.C. § 701 (a)(2); Lunney v. U.S., 319 F.3d 550 , 558 (2d Cir. 2003). “[Section] 701(a)(2) requires careful examination of the statute on which the claim of agency illegality is based,” Webster v. Doe, 486 U.S. 592, 600 (1988), and requires dismissal when there is “no law to apply.” Citizens to Preserve Overton Park v. Volpe, 401 U.S. 402, 410 (1971). Here, to the extent Plaintiffs challenge final agency action denying or delaying Touchstone’s requests for veterans’ military records, Plaintiffs must specify a statute or regulation that would limit Defendants’ discretion, and they have not done so. See 5 U.S.C. § 701 (a)(2); Webster, 486 U.S. at 600 (“§ 701(a)(2) requires careful examination of the statute on which the claim of agency illegality is based”). As noted above, nothing in the Privacy Act or its implementing regulations requires Defendants to disclose veterans’ records to Touchstone or to grant Touchstone access to DPRIS. Thus, because Plaintiffs have not provided “a meaningful standard against which to judge the agency’s exercise of discretion,” dismissal is warranted. Lunney, 319 F.3d at 558. III. Conclusion For the foregoing reasons, Defendants’ Motion to Dismiss Plaintiff’s Amended Complaint is GRANTED and this action is dismissed in its entirety. SO ORDERED. s/ Ona T. Wang Dated: October 3, 2019 Ona T. Wang New York, New York United States Magistrate Judge