EPIC Amicus Brief in Conboy v. AT&T

00-7284
UNITED STATES COURT OF APPEALS
FOR THE SECOND CIRCUIT

EDWARD J. CONBOY, EILEEN M. CONBOY,
Individually and on behalf of all others similarly situated,
Plaintiffs/Appellants,

v.

AT&T CORPORATION and AT&T UNIVERSAL
CARD SERVICES CORPORATION,

Defendants/Appellees.

On Appeal from the United States District Court
for the Southern District of New York
[District Court Opinion]

Brief of Amicus Curiae Electronic Privacy Information Center
Supporting Appellants and Urging Reversal

David L. Sobel
Marc Rotenberg
Electronic Privacy Information Center
1718 Connecticut Avenue, N.W.
Suite 200
Washington, DC 20009
(202) 483-1140
Harry C. Batchelder, Jr. (No. 9653)
100 Maiden Lane
New York, NY 10038
(212) 504-5629

Counsel for Amicus Curiae Electronic Privacy Information Center

Adam Hicks
EPIC Legal Intern

INTEREST OF AMICUS CURIAE
The Electronic Privacy Information Center ("EPIC") is a non-profit, public interest organization in Washington, DC, focusing on privacy and civil liberties in the fields of telecommunications, electronic information and computer networks. EPIC frequently presents testimony before Congress and administrative bodies, publishes educational materials, and participates in litigation addressing significant and precedent-setting issues.

STATEMENT OF THE CASE
Recognizing that consumers have a substantial interest in preventing the unauthorized disclosure of personally identifiable information, Congress enacted privacy protections as part of the Telecommunications Act of 1996 ("the Act"), Pub. L. No. 104-104, 110 Stat. 56 (February 8, 1996). Specifically, the Act prohibits telecommunications carriers from disseminating "Customer Proprietary Network Information," which includes, inter alia, telephone billing information, unlisted telephone numbers and home addresses of service subscribers. 47 U.S.C. § 222.

The principal issue on appeal is whether judicial relief is available for the violation of the Act's privacy protections. AT&T Corporation ("AT&T") allegedly violated the Act when it disclosed the unlisted phone number, home address and telephone billing information of Edward and Eileen Conboy ("appellants") to AT&T Universal Card Services ("UCS"), a non-affiliated credit card issuer. Subsequent to the disclosure of this personal information, appellants received numerous unwanted and harassing telephone calls from UCS regarding the whereabouts of appellants' daughter-in-law. The district court held that appellants have no private right of action because they "have not demonstrated that they suffered any damage" as a result of AT&T's unauthorized disclosure. That decision strays from the traditional judicial recognition of the injury that results from the unauthorized and improper dissemination of personal data, and fails to protect the individual's fundamental and Congressionally recognized right to privacy.

ARGUMENT
I. The Courts Consistently Recognize the Harm that Results
from the Unauthorized Disclosure of Personal Information

An individual's right to maintain the privacy of personal information and prevent unauthorized disclosures of such data is well established in American jurisprudence. As the Supreme Court has framed the right, "both the common law and the literal understandings of privacy encompass the individual's control of information concerning his or her person." U.S. Department of Justice v. Reporters Committee for Freedom of the Press, 489 U.S. 749, 763 (1989). The individual's right to control the dissemination and use of personal information enables each of us to establish the conditions under which others may intrude (or not intrude) upon our lives, homes and personal solitude. It is in this respect that privacy, in the oft-quoted words of Justice Brandeis, is "the right to be let alone -- the most comprehensive and the most valued by civilized men." Olmstead v. United States, 277 U.S. 438, 479 (1928) (Brandeis, J., dissenting). Indeed, the Court recently has noted that the "principle of respect for the privacy of the home" has ancient antecedents. Wilson v. Layne, 526 U.S. 603, 610 (1999). "In 1604, an English court made the now-famous observation that 'the house of every one is to him as his castle and fortress, as well for his defence against injury and violence, as for his repose.'" Id. at 609 (citation omitted).

A. The Courts Continually Expand Privacy Protections in
Response to New Threats to the Fundamental Right

Judicial recognition of the right of privacy has evolved with changes in society and the advent of new technology. Thus, the Supreme Court's holding in Olmstead that wiretapping did not implicate the Fourth Amendment's protection against unreasonable searches gave way to a more expansive understanding of privacy when, in Katz v. United States, 389 U.S. 347 (1967), the Court held that a warrantless wiretap of a public telephone booth did contravene the Constitution. Rejecting its earlier precedents holding that constitutional privacy protections extended only to the physical trespass of a protected place (such as the confines of the home), in Katz the Court articulated a more expansive analysis consisting of a two-part inquiry; (1) is there a subjective expectation of privacy; and (2) is the expectation reasonable. 389 U.S. at 360. The elimination of the physical trespass requirement provided citizens with broader protections against unreasonable intrusions into their lives and paved the way for the extension of privacy rights in the modern communications environment.[1]

The Court's recognition of the various circumstances that can threaten the individual's privacy interests has continued to evolve. Thus, in Whalen v. Roe, 429 U.S. 589 (1977), the Court noted "the threat to privacy implicit in the accumulation of vast amounts of information in computerized data banks" and wrote that government's "duty to avoid unwarranted disclosures ... has its roots in the Constitution." Id. at 605; see also id. at 606 (Brennan, J., concurring) ("the central storage and easy accessibility of computerized data vastly increase the potential for abuse of that information").

Most recently, in Reno v. Condon, ___ U.S. ___, 120 S. Ct. 666 (2000), the Court considered the constitutionality of the Driver's Privacy Protection Act ("DPPA"), 18 U.S.C. § 2721-2725 (1994 ed. and Supp. III), which regulates the disclosure of personal information (including a driver's name, address and telephone number) contained in the records of state motor vehicle departments ("DMVs"). Congress enacted the DPPA to prevent states from "sell[ing] this personal information to individuals and businesses." 120 S. Ct. at 668. Rejecting South Carolina's challenge to the statute on federalism grounds, the Court held that the DPPA "does not require the States in their sovereign capacity to regulate their own citizens," but rather "regulates the States as the owners of databases." Id. at 672. By declining to limit the ability of Congress to regulate the dissemination of personal data by state DMVs, the Court vindicated the substantial privacy interests millions of Americans have in preventing the unauthorized disclosure of the precise type of information at issue in this case.

B. The Sanctity of the Home is a Fundamental Privacy Interest

No circumstance implicates "the right to be let alone" more squarely than an individual's ability to control and prevent intrusions into the quiet enjoyment of the home. Indeed, even before the Supreme Court expanded the zone of privacy protection in Katz, the sanctity of the home was seen as the focal point of constitutional notions of privacy. The "privacy of the home ... is accorded special consideration in our Constitution, laws, and traditions." Department of Defense v. Federal Labor Relations Authority ("FLRA"), 510 U.S. 487, 501 (1994), citing Rowan v. United States Post Office Department, 397 U.S. 728, 737 (1970); Olmstead, 277 U.S. at 478 (Brandeis, J., dissenting). The "special consideration" accorded privacy interests involving an individual's home has prevailed even in cases in which those interests conflicted with other important national policy objectives.

In FLRA, the Court was confronted with such a conflict: whether the home addresses of federal employees could be disclosed under the Freedom of Information Act ("FOIA"), 5 U.S.C. § 552. The Court began its analysis with a recognition that "FOIA reflects 'a general philosophy of full agency disclosure unless information is exempted under clearly delineated statutory language'" and that "'disclosure, not secrecy, is the dominant objective'" of FOIA. 510 U.S. at 494 (citations omitted).[2] Under FOIA Exemption 6, 5 U.S.C. § 552(b)(6), information in government files may be withheld if disclosure "would constitute a clearly unwarranted invasion of personal privacy." The Court weighed the privacy interests of employees who had not consented to the disclosure of their home addresses to the bargaining representative seeking access:

Many people simply do not want to be disturbed at home .... Employees can lessen the chance of such unwanted contacts by not revealing their address to their exclusive representative. Even if the ... communications facilitated to the disclosure of home addresses were limited to mailings, this does not lessen the interest that individuals have in preventing at least some unsolicited, unwanted mail from reaching them at their home. We are reluctant to disparage the privacy of the home, which is accorded special consideration in our Constitution, laws, and traditions."

510 U.S. at 501 (citations omitted).

The Court next considered the impact of the disclosure of home addresses to other parties, "such as commercial advertisers and solicitors" (which would be entitled to similar access as that provided to the union): "it is clear that the individual privacy interest that would be protected by nondisclosure is far from insignificant." Id. The Court thus concluded that the disclosure of the home addresses would constitute a "clearly unwarranted invasion of personal privacy." Id. at 502.

Even before the Supreme Court grappled with the requested disclosure of home addresses, this court considered the issue on at least two occasions and recognized the substantial privacy interest in such information. In Hopkins v. Department of Housing and Urban Development, 929 F.2d 81 (2d Cir. 1991), a union sought access to the payroll records for federal construction contracts, which contractors are required to file under the Davis-Bacon Act, 40 U.S.C. §§ 276a et seq. Before releasing the records, HUD deleted all names, addresses and Social Security numbers of workers, and the union filed suit for access to that information. The court noted that Exemption 6 "requires an analysis unusual under the FOIA, involving a balancing of the harm to the individual whose privacy would be breached against the public interest that would be served by disclosure," 929 F.2d at 86 (emphasis added), and found that "individual private employees have a significant privacy interest in avoiding disclosure of their names and addresses," id. at 87. The court next considered the union's claim that disclosure was necessary in order to ensure HUD's enforcement of the Davis-Bacon Act's prevailing wage requirements:

[E]ven if we were to agree ... that the public interest is advanced by the disclosure of information that facilitates an investigation of an agency's performance, we would still conclude that this interest is outweighed here by the privacy interests employees have in controlling dissemination of their names, addresses and wage information. Indeed, the likelihood that the Union would use the requested identifying information to contact employees at their homes dramatically increases the already significant threat to the employees' privacy interests that disclosure of this information would entail.

Id. at 88 (emphasis added; citations omitted); see also Painting and Drywall Work Preservation Fund, Inc. v. Department of Housing and Urban Development, 936 F.2d 1300 (D.C. Cir. 1991). In light of "the significant privacy interests at stake," this court held that disclosure of the personally identifying information would be "clearly unwarranted." Id. at 89.

The sensitivity of individuals' names and home addresses was again at issue in Federal Labor Relations Authority v. Department of Veterans Affairs, 958 F.2d 503 (2d Cir. 1992). The court began its analysis with the following observation:

It used to be thought that citizens had a right to pass through the world without their successes and failures or comings and goings being the subject of comment, discussion or publication. But the advent of the data computer bank has nearly swept away that long-held notion, has virtually stripped from the individual's grasp control of information concerning his or her person, and has placed the precious and increasingly scarce "right to be let alone" in an endangered state.

Id. at 504. Finding that disclosure of a list of government employees' names and home addresses was "necessary" to enable a union "to fulfill its statutory obligations" under federal labor relations law, id. at 507-508, this court nonetheless refused to order the release of the personal data. Quoting Reporters Committee, the court noted that "disclosure of records containing personal details about private citizens can infringe significant privacy interests," and concluded that Supreme Court precedent "makes clear that an individual has a general privacy interest in preventing dissemination of his or her name and home address." Id. at 510 (citation omitted). See also id. at 513 ("[t]here is a measurable privacy interest that is threatened by the potentially unlimited disclosure of a list of names and addresses").

Other circuits have also long recognized the significant personal privacy interest individuals have in preventing disclosure of their home addresses and other identifying information. In Wine Hobby USA, Inc. v. Internal Revenue Service, 502 F.2d 133 (3d Cir. 1974), the Third Circuit considered the propriety of disclosing the addresses of taxpayers claiming exemptions for home winemaking. Noting that "there are few things which pertain to an individual in which his privacy has been more respected than his own home," id. at 136-137, the court evaluated the harm that would result from the disclosure of the home addresses.

Disclosure of the requested lists would involve a release of each registrant's home address, information that the individual may fervently wish to remain confidential or only selectively released. One consequence of this disclosure is that a registrant will be subjected to unsolicited and possibly unwanted mail .... Disclosure of these facts concerning the home and private activities within it constitutes an "invasion of privacy."

Id. at 137 (footnotes omitted). The court cited Chief Justice Burger's observation in Rowan v. United States Post Office Department, 397 U.S. 728, 736 (1970), that "[i]n today's complex society we are inescapably captive audiences for many purposes, but a sufficient measure of individual autonomy must survive to permit every house holder to exercise control over unwanted mail ..." 502 F.2d at 137 n.16.

Likewise, the Sixth Circuit has stressed the sensitivity of home addresses and, in language that bears directly upon the issue before this court, said

[t]he importance of the right to privacy in one's address is evidenced by the acceptance in society of unlisted telephone numbers, by which subscribers may avoid publication in the public directory, and postal boxes, which permit the receipt of mail without disclosing the location of one's residence. These [are] current manifestations of the ancient maxim that "a man's home is his castle."

Heights Community Congress v. Veterans Administration, 732 F.2d 526, 529 (6th Cir. 1984) (emphasis added; citation omitted). The D.C. Circuit similarly cited the sanctity of the home in National Association of Retired Federal Employees v. Horner, 879 F.2d 873 (D.C. Cir. 1989), where it held that disclosure of home addresses "would interfere with the subjects' reasonable expectations of undisturbed enjoyment in the solitude and seclusion of their own homes." Id. at 876; see also id. at 875 ("the privacy interest of an individual in avoiding the unlimited disclosure of his or her name and address is significant"), and id. at 878 ("substantial probability that the disclosure will lead to the threatened invasion" and "[i]t is clearer still that the invasion of ... privacy will be more than de minimis; it will be significant"). Indeed, every federal court that has considered the issue has recognized the individual's substantial privacy interest in his or her home address. See, e.g., O'Kane v. U.S. Customs Service, 169 F.3d 1308 (11th Cir. 1999); Sheet Metal Workers Local No. 9 v. U.S. Air Force, 63 F.3d 994, 997 (10th Cir. 1995) (and cases cited therein).

The judicial presumption of harm resulting from the unauthorized disclosure of identifying information is now universal, and most courts find it unnecessary to expound upon that harm. A notable and illuminating exception is found in Judge Rosenn's dissenting opinion in Federal Labor Relations Authority v. Department of Navy, 966 F.2d 747 (3d Cir. 1992) (en banc). Dissenting from the majority's holding that employee names and addresses were subject to disclosure under FOIA,[3] Judge Rosenn closely examined the affected privacy interest and reached conclusions highly pertinent to the issue before this court.

Even today, when sophisticated mail and telephone marketing techniques have rendered most homes an easy mark for an astonishing variety of unwanted sales pitches, opinion polls, and other solicitations, the fundamental principle that a person has a right to keep out unwanted intruders "has lost none of its vitality." ...
[A] home or residential building's address often reveals far more than just where an individual lives; it can identify specific and sometimes personal characteristics about residents. It is the ability of home address lists to communicate specific traits shared by a community which give them considerable commercial value to businesses, solicitors, marketing experts, insurance companies, social scientists, pollsters, and others. Thus, disclosure of one's home address and name could simultaneously divulge to an astute or interested observer significant and highly personal details about one's life as well as render the person and his/her family more easily exposed to commercial, political, social, and ominous safety invasion.

Id. at 771-772 (Rosenn, J., dissenting) (citation omitted).

As the cited authority establishes, the unauthorized disclosure of identifying information -- particular home addresses and telephone numbers -- constitutes a substantial and serious invasion of personal privacy. The attendant harm that flows from such disclosures is precisely the type of injury that Congress sought to address by enacting the Telecommunications Act's privacy protections.

II. The District Court Erred in Holding that Appellants'
Injury is not Cognizable Under the Telecommunications Act

In light of the foregoing authority establishing that individuals are substantially harmed by the disclosure of personally identifiable information such as their names, addresses and telephone numbers, the ruling below is clear error. It renders meaningless the privacy protections Congress sought to provide in Section 222 of the Telecommunications Act of 1996. The district court's cramped reading of the damages provisions of Sections 206 and 207 of the Act would preclude any recovery for the very acts that Section 222 prohibits. Such a result -- a clearly defined wrong without a remedy -- would run counter to the Congressional intent and fundamental notions of legal redress.

In enacting the privacy protections contained in Section 222, Congress sought to establish "three fundamental principles to protect all consumers," one of which is "the right of consumers to stop the reuse or sale of [the specified personal] information." H.R. Rep. No. 104-204, 104th Cong., 1st Sess. 91 (July 24, 1995) (emphasis added). See also US West, Inc. v. Federal Communications Commission, 182 F.3d 1224, 1236 (10th Cir. 1999), cert. denied, sub nom. Competition Policy Institute v. US West, Inc., 68 U.S.L.W. 3747 (June 5, 2000) ("[t]he specific and dominant purpose of §222 is the protection of customer privacy"). A construction of the Act's damages provision that disallows recovery for the very injuries that result from improper disclosures of personal data would provide an aggrieved consumer with no mechanism to "stop" the illegal acts, thus vitiating Congress' clear intent. Indeed, under the district court's ruling, that is precisely the result from which appellants appeal.

Privacy injuries, and the legislation enacted to remedy them, are unique. They involve fundamental, though intangible, interests that are not always susceptible to more traditional methods of economic quantification. The Privacy Act of 1974, and caselaw interpreting it, provides this court with an appropriate framework in which to assess the issue of damages under the Telecommunications Act's privacy provisions. Like Section 222, Congress enacted the Privacy Act to "'provide certain safeguards for an individual against an invasion of personal privacy.'" Devine v. United States, 202 F.3d 547, 550 (2d Cir. 2000) (citation omitted). In Bechhoefer v. Department of Justice, 209 F.3d 57, 62 (2d Cir. 2000), this court found that the Privacy Act's protection of "personal information" extended to an individual's address and telephone number, the same type of personal data at issue here.

The most thorough analysis of the Privacy Act's damages provision is presented in Johnson v. Department of Treasury, 700 F.2d 971 (5th Cir. 1983). In determining the scope of cognizable damages under the statute, the Fifth Circuit had to construe the meaning of "actual damages" under 5 U.S.C. § 552a(g)(4). Looking to the legislative intent, the court found that the Privacy Act was "designed to prevent ... the wrongful disclosure and use ... of personal files held by the Federal government." Id. at 975 (citation omitted). Reviewing the relevant caselaw, the court noted that "[t]he Supreme Court has indicated that the primary damage in 'right to privacy' cases is mental distress." Id. at 977 (citing Time, Inc. v. Hill, 385 U.S. 374 (1967)). The court continued:

Obviously, mental distress is the normal and typical damage resulting from an invasion of privacy, an invasion of "our respect for the inviolability of the human personality." Interpreting "actual damages" to include only out-of-pocket losses would not only preclude recovery in large numbers of cases but also run counter to Congress' intent ....
A federal act affording special protection to the right of privacy can hardly accomplish its purpose of protecting a personal and fundamental constitutional right if the primary damage resulting from an invasion of privacy is not recoverable under the major remedy of "actual damages" that has been provided by Congress.

Id. (citation and footnote omitted; emphasis added).

Finally, the Johnson court acknowledged the difficulty of placing a value upon privacy injuries, but rejected any suggestion that such damages should not be assessed. "Specifying such damages will always be difficult, but they must be at least "an amount which will assure (the plaintiff) that (personal) rights are not lightly disregarded and that they can be truly vindicated in the courts." Id. at 978 (quoting Halperin v. Kissinger, 606 F.2d 1192, 1208 (D.C. Cir. 1979), aff'd by an equally divided Court in part, cert. dismissed in part, 452 U.S. 713 (per curiam), reh'g denied, 453 U.S. 928 (1981)). Like this case, the injury in Johnson could not be "truly vindicated" unless the statutory damages provision was construed to include the recovery of non-economic losses. Other courts construing the Privacy Act's damages provision have followed the Fifth Circuit's lead. See, e.g., Alexander v. Federal Bureau of Investigation, 971 F. Supp. 603, 607 (D.D.C. 1997) ("[a]dopting the thorough analysis used by the Fifth Circuit ... the court will ... allow plaintiffs to pursue noneconomic damages"); Dong v. Smithsonian Institution, 943 F. Supp. 69 (D.D.C. 1996) (recovery for harm to reputation, even though "injury was not severe, but when we are speaking of something as important, as amorphous, and as evanescent as reputation, even the slightest whisper can stain a lifetime of hard work").

The clear intent of Section 222 was to provide consumers with a mechanism to "stop" the unauthorized use of personal information. As with the Privacy Act, interpreting the Telecommunications Act's damages provision "to include only out-of-pocket losses would not only preclude recovery in large numbers of cases but also run counter to Congress' intent," Johnson, 700 F.2d at 977 (citation omitted).

In keeping with the legislative mandate, this court should reject the district court's unduly narrow rationale, which, if sustained, would suffocate consumers' efforts to vindicate their federally protected privacy rights.

CONCLUSION
The district court's dismissal of appellants' complaint should be reversed.

Dated: June 27, 2000
Washington, DC
Respectfully Submitted,

David L. Sobel
Marc Rotenberg
Electronic Privacy Information Center
1718 Connecticut Avenue, N.W.
Suite 200
Washington, DC 20009
(202) 483-1140

Harry C. Batchelder, Jr. (No. 9653)
100 Maiden Lane
New York, NY 10038
(212) 504-5629

Counsel for Amicus Curiae Electronic Privacy Information Center

Adam Hicks
EPIC Legal Intern

Footnotes

1. The Court's Justices have addressed the individual's privacy interest in dialed telephone numbers, a category of personal information protected by the telecommunications privacy provisions at issue here. When a 5-4 majority of the Court held in Smith v. Maryland, 442 U.S. 735 (1979), that police may make use of a pen register device to obtain the numbers that a telephone customer dials without first obtaining a warrant, Justices Stewart and Marshall, in two separate dissents, addressed the privacy interest:

The numbers dialed from a private telephone -- although certainly more prosaic than the conversation itself -- are not without "content." I doubt there are any [telephone customers] who would be happy to have broadcast to the world a list of the local or long distance numbers they have called. This is not because such a list might be in some sense incriminating, but because it easily could reveal the identities of the persons and places called, and thus reveal the most details of a person's life.

Id. at 748 (Stewart, J., dissenting).

Just as one who enters a public telephone booth is "entitled to assume that the words he utters into the mouthpiece will not be broadcast to the world," so too, he should be entitled to assume that the numbers he dials in the privacy of his home will be recorded, if at all, solely for the phone company's business purposes.

Id. at 752 (Marshall, J., dissenting) (quoting Katz, 389 U.S. at 352).

2. FOIA's presumption in favor of disclosure was not the only interest competing with personal privacy in FLRA; the Federal Labor Relations Authority had determined that "the home addresses of bargaining unit employees constitutes information that is 'necessary' to the collective-bargaining process" under the Federal Service Labor-Management Relations Statute, 5 U.S.C. §§ 7101-7135. Id. at 493.

3. The majority's holding no longer constitutes good law, as the Supreme Court resolved a split among the circuits in Department of Defense v. Federal Labor Relations Authority ("FLRA"), 510 U.S. 487 (1994), and held that disclosure of employees' home addresses constitutes an unwarranted invasion of personal privacy. See pp. 6-8, supra. See also Paul P. v. Verniero, 170 F.3d 396, 404 (3d Cir. 1999).