This post originally appeared on Montgomery McCracken’s Data Privacy and Cybersecurity blog, Data Privacy Alert.
Only July 8, 2015, the National Treasury Employees Union filed the second class action against (now former) OPM Director Archuleta stemming from the massive OPM data breach. While the plaintiffs in the first OPM data breach lawsuit, briefly discussed here, alleged violations of the Privacy Act, NTEU took a different tack and claims the data breach is a violation of the “constitutional right to informational privacy, including their right to Due Process under the Fifth Amendment[.]”
But does a “constitutional right to informational privacy” even exist? The alleged right stems from NASA v. Nelson, 562 U.S. 134 (2009), Whalen v. Roe, 429 U.S. 589 (1977) and Nixon v. Administrator of General Services, 433 U.S. 425 (1977). In NASA, federal contractors alleged a violation of the constitutional right to informational privacy, challenging the government’s right to collect certain background data (including data from forms NTEU alleges were hacked).
The majority in NASA explained that while there is no specific right to “privacy” guaranteed by the Constitution, the Supreme Court has “referred broadly to a constitutional privacy interest in avoiding disclosure of personal matters.” 562 U.S. at 138 (citations and quotation marks omitted). Citing Whalen and Nixon, the NASA majority “assume[d] for present purposes that the Government’s challenged inquiries implicate a privacy interest of constitutional significance.” Id. at 147 (emphasis added). It held: “[I]n light of the protection provided by the Privacy Act’s nondisclosure requirement, and because the challenged portions of the forms consist of reasonable inquiries in an employment background check, we conclude that the Government’s inquiries do not violate a constitutional right to informational privacy.” Id. at 159.
Justice Scalia, joined by Justice Thomas, concurred in the judgment, but called out the majority for not resolving the case on a more basic ground: “A federal constitutional right to ‘informational privacy’ does not exist.” Id. at 160 (Scalia, J. concurring). He explained: “Like many other desirable things not included in the Constitution, ‘informational privacy’ seems like a good idea—wherefore the People have enacted laws at the federal level and in the States restricting government collection and use of information. But it is up to the People to enact those laws, to shape them, and, when they think it appropriate, to repeal them.” Id. at 159-60.
Justice Scalia noted that the contractors’ brief did “not once identify which provision of the Constitution” the Federal Government violated—presumably because they could not—and made only a single “fleeting reference to the Due Process Clause, buried in a citation of the assuredly inapposite Lawrence v. Texas[.]” Id. at 160. And he rejected their assertion at oral argument, “apparently for the first time in this litigation, that the right to informational privacy emerged from the Due Process Clause of the Fifth Amendment.” The Due Process Clause “guarantees certain procedures as a prerequisite to deprivation of liberty,” not “certain (unspecified) liberties[.]” Id. at 161. Nor did Justice Scalia believe the contractors could claim that the substantive component of the Due Process Clause supported their claim—informational privacy is not a “fundamental right[] and libert[y] … objectively, deeply rooted in this Nation’s history and tradition.” Id. (citation and quotation marks omitted). Indeed, Justice Thomas wrote separately “that the Constitution does not protect the right to informational privacy … [a]nd the notion that the Due Process Clause of the Fifth Amendment is a wellspring of unenumerated rights against the Federal Government strains credulity for even the most casual user of words.” Id. at 169 (Thomas, J. concurring).
The appellate courts have provided little guidance since NASA—only two have noted NASA’s refusal to specifically hold such a right exists. Like the Supreme Court, the Second Circuit assumed arguendo that such a right existed, recognizing that “[t]he Supreme Court of the United States has explicitly declined to decide whether there is a constitutional privacy interest in avoiding disclosure of personal matters.” Men of Color Helping All Soc., Inc. v. City of Buffalo, 529 F. App’x 20, 25 (2d Cir. 2013).
Similarly, the Sixth Circuit acknowledged that “[w]hether a broader right to nondisclosure of private information even exists remains an open question under the Supreme Court’s recent jurisprudence[.]” Lee v. City of Columbus, Ohio, 636 F.3d 245, 260, n.8 (6th Cir. 2011). But it concluded “the Court has not provided us with any reason to take the opportunity to revisit our past precedents on this matter.” Id. The Sixth Circuit thus continues to narrowly construe an informational right to privacy applicable to (1) the release of personal information that could lead to bodily harm, and (2) the release of sexual, personal, and humiliating information. Id. at 260-61.
So where does this leave NTEU’s claim? NTEU filed in the Ninth Circuit—the Circuit that recognized the contractors’ right to informational privacy in NASA. The Circuit will likely continue to recognize the constitutional right to informational privacy, and NTEU’s case may very well reach the Supreme Court to decide finally whether such a right exists. With the Judges’ own information likely compromised in the breach, it will be interesting to see what the Court decides—including whether Justices Scalia and Thomas stand by their assertion that “[a] federal constitutional right to ‘informational privacy’ does not exist.”
