Four Transportation Security Administration (TSA) employees were not able to convince a court that their agency violated the Privacy Act when an agency hard drive with personal information on some 100,000 TSA employees went missing in 2007. (Jones v. Rossides, D.D.C. Civil Action 07-00855 (HHK)(JMF), 9/28/09)
The missing hard drive contained names, social security numbers, birth dates, bank account and routing information, payroll data and payroll allotment information on TSA employees covering the period January 2002 and August 2005. It had last been seen in a controlled area at the agency’s headquarters Office of Human Capital. (Opinion p. 2)
The four transportation security officers who leveled the Privacy Act claim against TSA charged that the defendants had violated the act by failing to have appropriate safeguards to protect the personnel records that went missing. The district court has now granted the agency’s motion for summary judgement, meaning the plaintiffs have lost. (p. 1)
What was at stake? The Privacy Act calls for actual damages or a minimum of $1000 if a court finds that a government agency "acted in a manner which was intentional or willful." (pp. 1-2)
TSA contended that summary judgement for the agency was in order because the agency had reasonable safeguards in place when the hard drive went missing, there was no evidence of an intentional or willful violation of the Privacy Act, and therefore plaintiffs could not meet the burden of proof required under the law. The court agreed, pointing out that the plaintiffs had submitted no evidence supporting their claim of actual damages. It is not enough, says the court, to make "conclusory assertions of harm, unsupported by any evidence…." (p. 6)
