Opinion
Civil Action 24-1092 (RC)
08-09-2024
AMERICA FIRST LEGAL FOUNDATION, Plaintiff, v. XAVIER BECERRA, et al., Defendants.
Re Document No.: 6
MEMORANDUM OPINION
RUDOLPH CONTRERAS UNITED STATES DISTRICT JUDGE
Granting Plaintiff's Motion for a Preliminary Injunction
I. INTRODUCTION
Upon learning that the Centers for Disease Control and Prevention (“CDC”) deletes the emails of its former employees shortly after the employee leaves the agency, Plaintiff America First Legal Foundation alerted the U.S. Department of Health and Human Services (“HHS”) and the National Archives and Records Administration (“NARA”) to CDC's allegedly unlawful records-retention practice. NARA conducted an investigation but ultimately concluded that CDC's policies and practices were consistent with the Federal Records Act. It therefore declined to further pursue the matter. Dissatisfied with that result, Plaintiff filed suit against HHS; Xavier Becerra, in his official capacity as Secretary of HHS; NARA; and Colleen Shogan, in her official capacity as Archivist of the United States (collectively, “Defendants”). Generally speaking, Plaintiff alleges that CDC's disposition of its former employees' emails violates the Federal Records Act and the Administrative Procedure Act, as does Secretary Becerra's and Archivist Shogan's decision not to refer the issue to the Attorney General. Before the Court is Plaintiff's motion for a preliminary injunction. For the reasons discussed below, the Court grants Plaintiff's motion.
II. BACKGROUND
A. The Federal Records Act
Congress has enacted various statutory provisions, collectively known as the Federal Records Act (“FRA”), that govern “the creation, management and disposal of federal records.” See Armstrong v. Bush (“Armstrong I”), 924 F.2d 282, 284 (D.C. Cir. 1991). The FRA requires heads of federal agencies to “make and preserve records containing adequate and proper documentation of the organization, functions, policies, decisions, procedures, and essential transactions of the agency.” 44 U.S.C. § 3101. The statute also requires agencies to establish and maintain an active records management program that complies with the FRA and regulations promulgated by NARA, id. § 3102, and to establish safeguards “against the removal or loss of records” that the agency head determines should be preserved, id. § 3105.
When those safeguards fail, the FRA provides for a “system of administrative enforcement,” Armstrong I, 924 F.2d at 294, whereby agency heads and the Archivist (the head of NARA) “are to work together to ensure that no documents are unlawfully” lost or destroyed, Jud. Watch, Inc. v. Tillerson, 293 F.Supp.3d 33, 37 (D.D.C. 2017), aff'd sub nom. Jud. Watch, Inc. v. Pompeo, 744 Fed.Appx. 3 (D.C. Cir. 2018). Specifically, the statute mandates that:
The head of each Federal agency shall notify the Archivist of any actual, impending, or threatened unlawful removal, defacing, alteration, corruption, deletion, erasure, or other destruction of records in the custody of the agency, and with the assistance of the Archivist shall initiate action through the Attorney General for the recovery of records the head of the Federal agency knows or has reason to believe have been unlawfully removed from that agency, or from another Federal agency whose records have been transferred to the legal custody of that Federal agency.Id. § 3106(a). If a reasonable time passes yet the agency head does not enlist the Attorney General's assistance, “the Archivist shall request the Attorney General to initiate such an action, and shall notify the Congress when such a request has been made.” Id. § 3106(b). And if both the agency head and the Archivist fail to initiate remedial action in a timely manner, “private litigants may sue under the [Administrative Procedure Act] to require them to do so.” Armstrong I, 924 F.2d at 296 n.12; see also Judicial Watch, Inc. v. Kerry, 844 F.3d 952, 954 (D.C. Cir. 2016).
B. Factual Background
In March 2023, Plaintiff filed a Freedom of Information Act (“FOIA”) request with CDC for records relating to the agency's publication of a document entitled LGBTQ Inclusivity in Schools: A Self-Assessment Tool. Compl. ¶ 25. After Plaintiff and the agency agreed to narrow the scope of the search to a list of specific custodians, a CDC FOIA analyst informed Plaintiff that although three employees had worked on publishing the document, only one of those employees still worked at CDC. Id. ¶ 26. That was significant, the FOIA analyst explained, because it was CDC's practice to delete former lower-level employees' email accounts (and any emails remaining in those accounts) thirty days after the employee's departure from the agency. Id. ¶ 27. Consequently, the FOIA analyst informed Plaintiff that potentially responsive emails belonging to the two former employees would have already been destroyed. Id. ¶ 26.
That information appears to have been slightly incorrect. CDC relinquishes control of its former employees' email accounts ninety days-not thirty days-after the employee leaves the agency. See Defs.' Opp'n to Pl.'s Mot. for Prelim. Inj. at 6, ECF No. 13; see also Tr. of Mot. Hearing at 8:6-10, ECF No. 15. The difference is immaterial for present purposes.
Concerned that CDC was “willfully disregarding” its “duties and obligations” under the FRA, Plaintiff sent a letter describing CDC's alleged noncompliance to the HHS Office of Inspector General. Id. ¶ 28; see also Compl., Ex. A, ECF No. 1-1. Plaintiff sent a “courtesy copy” to the NARA Records Management Oversight and Reporting Program. Compl. ¶ 29. Plaintiff's letter spurred NARA to action. On April 7, 2023, NARA informed CDC that it had received “a complaint . . . alleging that the CDC has had a pattern and practice of unlawfully deleting the emails of employees who separate from employment within as little as thirty days from the date of separation” notwithstanding the fact that the applicable records disposition schedule-General Records Schedule (“GRS”) 6.1-required the agency to preserve employee emails for a minimum of three years. See Compl., Ex. C (“Apr. 2023 Letter”), ECF No. 1-3; Compl., Ex. E (“General Records Schedule 6.1”) at 5, ECF No. 1-5.
At this point, it is worth pausing to briefly discuss GRS 6.1. GRS 6.1 is one of a number of general records schedules issued by the Archivist pursuant to her authority under the FRA to promulgate “schedules authorizing the disposal, after the lapse of specified periods of time, of records of a specified form or character.” See 44 U.S.C. § 3303a(d). GRS 6.1 applies to email and other electronic messages for agencies which, like CDC, have adopted the so-called Capstone approach to records management. See General Records Schedule 6.1 at 1; see also Id. (explaining that agencies that use GRS 6.1 “must apply it to email records” (including associated attachments) “regardless of how the email messages are managed or what email technology is used”). The Capstone approach distinguishes between Capstone and non-Capstone officials. “Capstone Officials are senior officials designated by account or position level,” Id. at 3, whereas non-Capstone officials are “all other officials, staff, and contractors,” Id. at 5. For Capstone officials, GRS 6.1 provides a disposition instruction for emails of “permanent” retention. Id. at 3. For non-Capstone officials, GRS 6.1 sets a retention period of three years for “support” and “administrative” staff, Id. at 5, and seven years for everyone else, Id. The “majority” of an agency's employees fall into the category of employees whose email must be retained for seven years. Id.
With that context in mind, NARA requested that CDC “determine whether email records of separated employees have been prematurely deleted, and are not being preserved and managed in accordance with GRS 6.1.” Apr. 2023 Letter. A month later, CDC reported that it had investigated the matter and “conclude[d] [that] CDC policies and procedures prohibit disposing of separated employees' email accounts without authorization and not before stringent criteria has been met.” See Decl. of Laurence Brewer (“First Brewer Decl.”) ¶ 14, ECF No. 13-2. This did not sufficiently address NARA's query into CDC's “use of GRS 6.1 to manage emails” so, on August 4, 2023, CDC further explained that the agency does not use GRS 6.1 to manage all employee emails, but rather only uses GRS 6.1 to manage and preserve the emails of Capstone officials. See id. ¶ 15. For all other emails, the agency relies on its employees to “use traditional records management practices, meaning that they must file and preserve their records based on their subject matter.” Id.
In contrast to a traditional records management approach, GRS 6.1 is content agnostic-the period of time that an email must be retained depends on the role of the sender, not the content of the email. See Decl. of Mary Wilson ¶ 6, ECF No. 13-1.
NARA acknowledged CDC's findings in a letter NARA sent to CDC on February 23, 2024. In the letter, NARA confirmed that CDC policy does “not require the preservation of all emails,” but rather requires employees to “preserve[] all records from [their] email accounts.” See Compl., Ex. D (“Feb. 2024 Letter”) at 1, ECF No. 1-4. NARA further explained that “CDC's records management policy instructs all agency personnel to maintain records outside of email accounts in a proper record-keeping system, shared drive, personal drive, or physical format,” and that “CDC instructs individual email account holders to apply retention based on the email's content value and its applicability to a NARA-approved records schedule.” Id. In the letter, NARA further stated “that the CDC's policies and procedures prohibit disposing of separated employees' email accounts without authorization, and specific criteria must be met before the email accounts of separated employees' are deleted.” Id. All that being so, NARA determined that CDC's policy was consistent with the FRA and closed the investigation. Id.
C. Procedural History
Less than two months later, Plaintiff filed suit in federal district court. Generally speaking, Plaintiff's complaint alleges that CDC's policy and practice of deleting non-Capstone employees' emails months after their departure violates GRS 6.1 and therefore also violates the FRA and Administrative Procedure Act (“APA”). See Compl. ¶¶ 37-44, 77-83. Plaintiff further alleges that, despite their awareness of this allegedly unlawful removal and deletion of CDC records, neither the Secretary nor the Archivist have referred the matter to the Attorney General. See id. ¶¶ 62-64, 68-76.
Two weeks after filing its complaint, Plaintiff filed a motion for a preliminary injunction. See Pl.'s Mem. in Supp. of Appl. for Prelim. Inj. (“Pl.'s Mot.”), ECF No. 6-1. Plaintiff's motion asks the Court to “enjoin HHS from permitting the unlawful removal or destruction of lower-level employee emails by the CDC before the periods prescribed by [GRS] 6.1.” Id. at 3. Plaintiff also requests that the Court order the Secretary and the Archivist “to initiate an action through the Attorney General for the recovery of records already removed by the CDC, including those records responsive to AFL's FOIA request.” Id. Defendants oppose Plaintiff's motion, see Defs.' Opp'n to Pl.'s Mot. for Prelim. Inj. (“Defs.' Opp'n”), ECF No. 13, and Plaintiff has filed a reply, see Pl.'s Reply in Supp. of Appl. for Prelim. Inj. (“Pl.'s Reply”), ECF No. 14. The Court heard oral argument on May 23, 2024, after which the parties submitted supplemental briefing on certain factual and legal issues that arose during argument. See Defs.' Suppl. Br. to Defs.' Opp'n to Pl.'s Mot. for Prelim. Inj. (“Defs.' Suppl. Br.”), ECF No. 16; Pl.'s Resp. to Defs.' Suppl. Br. in Opp'n to Pl.'s Appl. for Prelim. Inj. (“Pl.'s Suppl. Resp.”), ECF No. 18.
III. LEGAL STANDARD
“A preliminary injunction is an extraordinary remedy never awarded as of right.” Winter v. Nat. Res. Def. Council, Inc., 555 U.S. 7, 24 (2008). The party seeking relief “must make a ‘clear showing'” that (1) it is likely to succeed on the merits; (2) it is likely to suffer “irreparable harm in the absence of preliminary relief;” (3) the “balance of the equities [is] in its favor;” and (4) an injunction “accord[s] with the public interest.” Archdiocese of Wash. v. Wash. Metro. Area Transit Auth., 897 F.3d 314, 321 (D.C. Cir. 2018) (quoting League of Women Voters of the U.S. v. Newby, 838 F.3d 1, 6 (D.C. Cir. 2016)). “The last two factors ‘merge when the Government is the opposing party.'” Guedes v. Bureau of Alcohol, Tobacco, Firearms & Explosives, 920 F.3d 1, 10 (D.C. Cir. 2019) (quoting Nken v. Holder, 556 U.S. 418, 435 (2009)).
Before the Supreme Court's decision in Winter, courts in this circuit applied a “slidingscale” approach to the preliminary injunction analysis under which “a strong showing on one factor could make up for a weaker showing on another.” Sherley v. Sebelius, 644 F.3d 388, 392 (D.C. Cir. 2011). Since Winter, the D.C. Circuit has hinted on several occasions that “a likelihood of success is an independent, free-standing requirement for a preliminary injunction,” Id. (citation omitted), but it has repeatedly declined to decide the issue, see, e.g., Changji Esquel Textile Co. v. Raimondo, 40 F.4th 716, 726 (D.C. Cir. 2022); Archdiocese of Wash., 897 F.3d at 334; see also League of Women Voters, 838 F.3d at 7. Here, because the Court concludes that all four factors weigh in favor of granting a preliminary injunction, Plaintiff is entitled to preliminary relief regardless of whether the sliding-scale approach applies.
IV. ANALYSIS
A. Likelihood of Success on the Merits
The first aspect of the Court's analysis considers Plaintiff's likelihood of success on the merits of its claims. A plaintiff's likelihood of success is the “most important factor” in determining whether preliminary injunctive relief is warranted. See Aamer v. Obama, 742 F.3d 1023, 1038 (D.C. Cir. 2014). Indeed, “a failure to show a likelihood of success on the merits alone is sufficient to defeat a preliminary-injunction motion.” Standing Rock Sioux Tribe v. U.S. Army Corps of Engineers, 205 F.Supp.3d 4, 26 (D.D.C. 2016).
Plaintiff's complaint advances two claims. Count One charges that the Secretary and the Archivist violated the APA and the FRA by declining to alert the Attorney General to CDC's allegedly unlawful deletion of its former employees' emails. See Compl. ¶¶ 68-76. Count Two charges HHS with violating those same statutes by failing to maintain an adequate recordkeeping system. See id. ¶¶ 77-83. The Court addresses these claims in turn.
1. Count I: Referral to the Attorney General
The APA provides that courts “shall . . . hold unlawful and set aside agency action, findings, and conclusions” that are “arbitrary, capricious, an abuse of discretion, or otherwise not in accordance with law,” 5 U.S.C. § 706(2)(A), and “compel agency action unlawfully withheld or unreasonably delayed,” Id. § 706(1). “Although the Federal Records Act does not contain an express or implied private right of action,” the APA permits a claim pursuant to section 706(1) “that an agency failed to take a discrete agency action that it is required to take.” Kerry, 844 F.3d at 954 (quoting Norton v. S. Utah Wilderness All., 542 U.S. 55, 64 (2004)).
Count One of Plaintiff's complaint alleges such a claim. Specifically, Plaintiff alleges that the Secretary and the Archivist violated the APA and the FRA by failing to ask the Attorney General to initiate legal action to remedy CDC's deletion of former employees' emails. See Id. ¶¶ 68-76. Plaintiff contends that all it needs to show to prevail on this claim is that (1) CDC was (or is) removing or destroying former employees' emails, (2) that the removal or destruction of those emails was (or is) unlawful, and (3) that the Secretary and Archivist were aware of CDC's unlawful practice yet failed to refer the matter to the Attorney General. See Pl.'s Mot. at 12-13; see also Price v. U.S. Dep't of Just., No. 18-cv-1339, 2019 WL 2526439, at *6 (D.D.C. June 19, 2019) (explaining that, to show a likelihood of success on similar claim, plaintiff needed to “convincingly (1) identify records that fall under the FRA; (2) allege that those records are being removed or destroyed in violation of the FRA; and (3) allege that the relevant agency head . . . and/or Archivist knew about the FRA violations and yet failed to initiate corrective action”). Plaintiff argues that all three of those requirements are satisfied here because (1) CDC concededly deletes its former, lower-level employees' emails within ninety days of their departure, see Pl.'s Mot. at 13; (2) CDC's deletion of its former employees' emails is inconsistent with GRS 6.1 and thus unlawful, see id. at 13-14; and (3) both the Secretary and Archivist were aware that CDC was deleting emails within months of employees' departure, but neither alerted the Attorney General, see id. at 14.
At least to some extent, Defendants contest Plaintiff's ability to establish each of the three elements of its claim. First, although Defendants concede that CDC deletes its former employees' emails, Defendants argue that the agency does not remove those emails. See Defs.' Opp'n at 13-16. This is significant, they say, because the FRA only compels agency heads and the Archivist to initiate legal action through the Attorney General when an agency removes-not deletes or destroys-records. See id. Defendants therefore contend that neither the Secretary nor the Archivist were legally obliged to alert the Attorney General that CDC was deleting employee emails within months of their departure. See id. Second, Defendants argue that CDC's deletion of its former employees' emails was not unlawful-thus providing another reason that referral to the Attorney General was not warranted. See id. at 16; see also id. at 12-13. Third, Defendants argue that, even if CDC's deletion of emails was unlawful, the Secretary's and Archivist's decision not to initiate legal action was not “final agency action” and is thus unreviewable. See id. at 16-17 (quoting Lujan v. Nat'l Wildlife Fed., 497 U.S. 871, 882 (1990)).
a. Circumstances Under Which the FRA Requires the Secretary to Refer Matters to the Attorney General
The Court turns first to Defendants' contention that the FRA only requires agency heads and the Archivist to initiate legal action through the Attorney General to recover records that have been improperly removed from agency custody. According to Defendants, the FRA does not require either the Secretary or the Archivist to refer matters to the Attorney General in cases in which an agency destroys or deletes records. In their words, “[t]he FRA does impose duties on agency heads and the Archivist to make a referral to the Attorney General in certain circumstances, but those duties apply only to removed records, not to alleged destruction or deletion of records.” See Defs.' Opp'n at 13 (internal quotation marks and citation omitted). And because Plaintiff only alleges that CDC destroys or deletes former employees' emails, see id. at 14-15, Defendants conclude that Plaintiff cannot establish that either the Secretary or the Archivist violated the FRA by declining to make a referral to the Attorney General.
To the extent Defendants contend that the FRA only requires agency heads-here, the Secretary-to initiate an enforcement action to recover records that were improperly removed from agency custody, the Court agrees. To see why, recall the text of 44 U.S.C. § 3106(a). Section 3106(a) provides, in relevant part, that:
The head of each Federal agency shall notify the Archivist of any actual, impending, or threatened unlawful removal, defacing, alteration, corruption,
deletion, erasure, or other destruction of records in the custody of the agency, and with the assistance of the Archivist shall initiate action through the Attorney General for the recovery of records the head of the Federal agency knows or has reason to believe have been unlawfully removed from that agency ....
44 U.S.C. § 3106(a). Section 3106(a) consists of two clauses, each of which establishes a separate duty. The first clause-which establishes a duty of notification-requires the Secretary to notify the Archivist if any one of “seven triggers” occurs. See Am. C.L. Union Found. of Fla. v. U.S. Immigrs. & Customs Enf't (“ACLU”), No. 22-cv-1129, 2023 WL 6461053, at *7 (D.D.C. Aug. 31, 2023). That is, the Secretary must notify the Archivist if there is a risk of unlawful “removal, defacing, alteration, corruption, deletion, erasure, or other destruction” of agency records. Id. The second clause-which establishes a duty of enforcement and referral-is only triggered in one instance: if agency records are unlawfully “removed.” See 44 U.S.C. § 3106(a). Taken together, section 3106(a) requires agency heads “to notify the Archivist of any removal,” deletion, “or destruction of records, but mandates initiation of an enforcement action upon only removal of records.” Citizens for Resp. & Ethics in Wash. v. U.S. Dep't of Homeland Sec. (“CREW II”), No. 22-cv-3350, 2024 WL 1178472, at *9 (D.D.C. Mar. 19, 2024).
This reading of the statute has been adopted by multiple judges within this circuit. See ACLU, 2023 WL 6461053, at *7; CREW II, 2024 WL 1178472, at *9-11; Citizens for Resp. & Ethics in Wash. v. U.S. Sec. and Exch. Comm n (“ CREW I ”), 916 F.Supp.2d 141, 146-48 (D.D.C. 2013). As those judges have explained, section 3106(a)'s inclusion of “removal” alongside a list of six other triggers in the first clause, and then its inclusion of only “removal” in the second clause is significant for at least two reasons. CREW II, 2024 WL 1178472, at *10. “First, the rule against superfluity tells courts that ‘removal' has a distinct meaning from ‘defacing, alteration, corruption, deletion, erasure, or other destruction of records.'” Id.; see also TRW Inc. v. Andrews, 534 U.S. 19, 31 (2001) (explaining that it is “‘a cardinal principle of statutory construction' that ‘a statute ought . . . to be so construed that, if it can be prevented, no clause, sentence, or word shall be superfluous, void, or insignificant'” (quoting Duncan v. Walker, 533 U.S. 167, 174 (2001))). Put another way, if “removal” included “defacing, alteration, corruption, deletion, erasure, and other destruction,” there would have been no need for Congress to list the latter six terms. See ACLU, 2023 WL 6461053, at *7; see also CREW I, 916 F.Supp.2d at 146. Second, courts generally assume both that Congress “acts intentionally when it uses particular language in one section of a statute but omits it in another,” see Dep't of Homeland Sec. v. MacLean, 574 U.S. 383, 391 (2015), and that Congress's omission of language from one section of a statute “convey[s] a difference in meaning,” Bittner v. United States, 598 U.S. 85, 94 (2023). Here, then, the Court must assume that Congress intentionally excluded “destruction” and “deletion” from the second clause of section 3106(a), and that its decision to do so conveys the legislature's intent that only the unlawful “removal” of agency records triggers the Secretary's mandatory duty of enforcement. See CREW II, 2024 WL 1178472, at *10; ACLU, 2023 WL 6461053, at *7; CREW I, 916 F.Supp.2d at 147.
Plaintiff resists this reading of section 3106(a) on multiple grounds, but none is persuasive. First, Plaintiff contends that this reading of the statute is inconsistent with the Circuit's decisions in Kerry and Armstrong I. See Pl.'s Reply at 6-7. In particular, Plaintiff highlights language in both opinions which, on its face, would seem to suggest that the destruction of records triggers an agency head's duty of enforcement. See Kerry, 844 F.3d at 954 (“[I]f the agency head and the Archivist do not take the required action to prevent the unlawful destruction or removal of records, private litigants may sue under the APA to require them to do so.” (cleaned up)); Armstrong I, 924 F.2d at 295 (“[I]f the agency head or Archivist does nothing while an agency official destroys or removes records in contravention of agency guidelines and directives, private litigants may bring suit to require the agency head and Archivist to fulfill their statutory duty ....”). This language, while “helpful” to Plaintiff, is also dicta. See CREW II, 2024 WL 1178472, at *10 (quoting CREW I, 916 F.Supp.2d at 147); see also ACLU, 2023 WL 6461053, at *7. As Judge Nichols previously explained, Armstrong I analyzed “whether an agency's duties under the [FRA] may be enforced by a private litigant through the APA” and did not address “the specific statutory question at issue here.” ACLU, 2023 WL 6461053, at *7. Likewise, “the question presented [in Kerry] was whether a private litigant can still bring suit if the agency and Archivist had made a ‘sustained effort' to recover missing records.” Id. (quoting Kerry, 844 F.3d at 954). Because neither decision directly addressed the issue of statutory interpretation raised in this case, Judge Nichols concluded-and this Court agrees-that “[a]ny dicta indicating that enforcement duties for the agencies are triggered by anything other than removal is not enough to overcome the plain meaning” of section 3106(a). Id.; see also CREW II, 2024 WL 1178472, at *10; CREW I, 916 F.Supp.2d at 147-48.
Plaintiff next points to legislative history. See Pl.'s Reply at 10. But “relying on legislative history is improper” where, as here, the meaning of a statute's text is plain and unambiguous. CREW II, 2024 WL 1178472, at *10; see also CREW I, 916 F.Supp.2d at 147 (declining to consider legislative history to interpret section 3106(a) given that “legislative history cannot trump a statute's plain meaning”). After all, even when courts “consult legislative history,” they do not “allow it to be used to ‘muddy' the meaning of ‘clear statutory language.'” See Food Mktg. Inst. v. Argus Leader Media, 588 U.S. 427, 436 (2019). Here, because section 3106(a)'s language and meaning are clear, the Court's “inquiry is complete” without recourse to legislative history. See Conn. Nat. Bank v. Germain, 503 U.S. 249, 254 (1992) (citation omitted).
Finally, Plaintiff argues that even if section 3106(a) only requires the Secretary to refer matters to the Attorney General when agency records are wrongfully removed, that condition is satisfied here. In support, Plaintiff points to 36 C.F.R. § 1230.3(b), which defines “removal” as “selling, donating, loaning, transferring, stealing, or otherwise allowing a record to leave the custody of a Federal agency without the permission of the Archivist of the United States.” 36 C.F.R. § 1230.3(b). Plaintiff argues that CDC allows former employees' emails to leave the agency's custody when the agency “transfers” the emails to Microsoft ninety days after the employee departs. See Pl.'s Suppl. Resp. at 3-5; see also Pl.'s Reply at 5-6. At that point, Plaintiff contends that CDC has permanently relinquished “actual custody and control” of those emails, thereby constituting removal. See Pl.'s Suppl. Resp. at 4; see also Pl.'s Reply at 5-6.
For context, CDC loses access to its former employees' emails ninety days after the employee leaves the agency. See Decl. of Mary Wilson ¶ 15, ECF No. 13-1. No more than ninety days later, Microsoft “permanently deletes all emails and associated data within the [former employee's] Microsoft 365 suit[e].” Id.
Defendants counter that Plaintiff's focus on physical custody and control is misplaced, and that the relevant question is whether CDC maintains “legal custody” of its employees' emails at all times. See Defs.' Suppl. Br. at 1. With that focus, they argue that CDC's use of Microsoft's “cloud-based platforms” to “stor[e] or maintain[] records does not amount to a removal under the FRA because those records remain in [CDC's] legal custody” until they are permanently deleted from Microsoft's servers. Id. In support, they cite NARA's guidance regarding agencies' use of cloud-based platforms, see id. at 2, CDC's contract with Microsoft, including provisions “prohibit[ing] Microsoft from removing records from the legal custody of CDC or destroying records except . . . pursuant to CDC's authorization,” see id. at 3 (internal quotation marks omitted), and various authorities suggesting that a removal of records does not occur unless an agency loses legal custody of those records, see id. at 4-9.
It is not readily apparent which party has the better argument on this front. Consequently, it is possible that Plaintiff will prevail in showing that CDC “removes” its former employees' emails when it loses access to them ninety days after an employee departs, and thus that the Secretary's enforcement obligation was triggered by that removal. At this stage, however, the Court need not conclusively determine whether Plaintiff is likely to succeed on the merits of this aspect of its claim. That is because, as discussed in the next section, the Court concludes that the Archivist was required to refer the matter of CDC's deletion of its former employees' emails to the Attorney General regardless of whether the Secretary should have done the same.
b. Circumstances Under Which the FRA Requires the Archivist to Refer Matters to the Attorney General
Plaintiff claims that, once the Archivist learned of CDC's allegedly unlawful deletion of agency records and a “reasonable period of time” had passed, the Archivist had an independent obligation to refer the matter to the Attorney General. Pl.'s Mot. at 14. Defendants disagree; they again argue that the FRA only imposes a referral duty upon the Archivist when agency records are unlawfully removed from an agency. See Defs.' Opp'n at 13-16. This time, however, the text of section 3106 is not on Defendants' side.
In advancing the argument that “section 3106(b) imposes a referral obligation duty on the Archivist as to all forms of record destruction listed in section 3106(a), not just removal,” Plaintiff relies heavily on Judge Nichols's decision in ACLU. See Pl.'s Reply at 12-13 (quoting ACLU, 2023 WL 6461053, at *7). There, the government argued that section 3106(b) establishes a referral obligation upon the Archivist that is “essentially derivative” of the referral duty imposed upon agency heads by section 3106(a). ACLU, 2023 WL 6461053, at *7. In other words, according to the government in that case, the scope of the Archivist's referral duty under section 3106(b) extends no further than does the scope of an agency head's enforcement duty under section 3106(a). See id. The government's argument was based both on its reading of the text of the relevant sections, as well as the “logical” argument that it would not make sense to impose “greater referral obligations on the Archivist than on the agencies.” Id.
Judge Nichols rejected the government's argument and concluded that, unlike section 3106(a), “section 3106(b) imposes a referral obligation duty on the Archivist as to all forms of record destruction listed in section 3106(a), not just removal.” Id. at *8. The Court finds Judge Nichols's reasoning persuasive and agrees that section 3106(b) imposes a broader enforcement duty on the Archivist than section 3106(a) does upon agency heads. To see why, consider the text of the two subsections within section 3106. As discussed, section 3106(a) requires agency heads to “notify the Archivist of any actual, impending, or threatened unlawful removal, defacing, alteration, corruption, deletion, erasure, or other destruction of records,” and to “initiate action through the Attorney General for the recovery of records [that] have been unlawfully removed.” 44 U.S.C. § 3106(a). If a reasonable time passes and the agency head “does not initiate an action for such recovery or other redress . . . after being notified of any such unlawful action described in subsection (a),” then section 3106(b) requires the Archivist to “request the Attorney General to initiate such an action.” Id. § 3106(b) (emphasis added). The premise of section 3106(b), then, is “that the agency did not initiate an action ‘for such recovery or other redress.'” ACLU, 2023 WL 6461053, at *8 (quoting 44 U.S.C. § 3106(b)). Section 3106(a), on the other hand, “only speaks of actions for the ‘recovery' of records.” Id. (quoting 44 U.S.C. § 3106(a)). The best reading of the difference between the two subsections is that “recovery” in section 3106(b) corresponds with “removal” (like it does in section 3106(a)), while “other redress” corresponds with actions to remedy the other six types of prohibited actions listed in section 3106(a). Id. To read the statute otherwise would risk rendering the “or other redress” language surplusage. Id.; but see CREW II, 2024 WL 1178472, at *11.
Further support for Judge Nichols's reading of the statute comes from the fact that the Archivist's referral duty is triggered when an agency head does not initiate an action “after being notified of any such unlawful action described in subsection (a).” 44 U.S.C. § 3106(b) (emphasis added). Subsection (a) lists seven types of unlawful action: “unlawful removal, defacing, alteration, corruption, deletion, erasure, or other destruction.” See id. § 3106(a). Had Congress meant only to refer to “removal”-and not “any such unlawful action described in subsection (a)”-it could have, and presumably would have, done so. See ACLU, 2023 WL 6461053, at *8 (explaining that “[i]t would be anomalous at best for Congress to have written ‘any such unlawful action described in subsection (a)' if it meant just ‘removal' (a word that appears several times in the statute)”).
All that being so, the Court concludes that section 3106(b) imposes a duty on the Archivist to refer matters to the Attorney General when an agency unlawfully deletes or destroys-not just removes-records. And because there is no dispute that CDC deleted and destroyed its former employees' emails (regardless of whether CDC can be said to have also removed them), the Court finds that CDC's actions may-if unlawful-trigger the Archivist's duty of enforcement.
c. Whether CDC's Deletion of Former Employees' Emails Was Unlawful
Defendants next argue that the Archivist was not required to request that the Attorney General initiate legal action because CDC's deletion of its former employees' emails was lawful. See Defs.' Opp'n at 12-13, 16; 44 U.S.C. § 3106(b). Plaintiff, of course, disagrees. See Pl.'s Mot. at 4-6, 13-14.
It is well-settled that “the FRA establishes the exclusive means by which records subject to the FRA may be discarded.” Pub. Citizen v. Carlin, 184 F.3d 900, 902 (D.C. Cir. 1999); see also 44 U.S.C. § 3314; Competitive Enter. Inst. v. U.S. E.P.A., 67 F.Supp.3d 23, 27 (D.D.C. 2014) (“A document that qualifies as a federal record may not be discarded except as provided by statute.”). The FRA, in turn, requires agencies to “get the approval of the Archivist before disposing of any record.” Pub. Citizen, 184 F.3d at 902; see also Armstrong v. Exec. Off. of the President, Off. of Admin. (“Armstrong II”), 1 F.3d 1274, 1279 (D.C. Cir. 1993). And “[a]gencies may only dispose of records on terms approved by the Archivist.” Competitive Enter. Inst. v. Off. of Sci. & Tech. Pol'y, 241 F.Supp.3d 14, 18 (D.D.C. 2017). An agency typically obtains the Archivist's approval to dispose of records in one of two ways. Pub. Citizen, 184 F.3d at 902. Under the first method, “an agency may submit a schedule of records sought to be discarded to the Archivist, who will sign off on the records' destruction only if she concludes that they do not ‘have sufficient administrative, legal, research, or other value to warrant their continued preservation.'” Armstrong II, 1 F.3d at 1279 (quoting 44 U.S.C. § 3303a(a)). Under the second method, an “agency may jettison certain common types of records pursuant to disposal schedules promulgated in advance by the Archivist.” Id.; see also 44 U.S.C. § 3303a(d). In other words, the FRA and regulations promulgated thereunder enable agencies to dispose of certain categories of records on a recurring basis as long as they have first sought and obtained the Archivist's permission to do so. See Competitive Enter. Inst., 67 F.Supp.3d at 27.
Of course, “[n]ot all documents in an agency's possession qualify as ‘records' under the FRA.” Competitive Enter. Inst. v. Off. of Sci. & Tech. Pol'y, 241 F.Supp.3d 14, 17 (D.D.C. 2017). Instead, “records” include any “recorded information” “made or received by a Federal agency under Federal law or in connection with the transaction of public business and preserved or appropriate for preservation by that agency . . . as evidence of the organization, functions, policies, decisions, procedures, operations, or other activities of the United States Government or because of the informational value of data in them.” 44 U.S.C. § 3301. All the same, NARA has previously explained that most email “meets the definition of a federal record as provided in the Federal Records Act.” NARA, White Paper on the Capstone Approach and Capstone GRS at 4 (April 2015) (available at https://bit.ly/3Jm5Nfm).
Neither party suggests that CDC used that method here.
With this backdrop in mind, the Court returns to the present dispute. As framed by the parties, the issue of whether CDC unlawfully deleted (or deletes) its former employees' emails turns on the extent to which the agency committed to following GRS 6.1-the records-disposition schedule promulgated by the Archivist that applies to agency emails. Plaintiff argues that CDC is required to follow GRS 6.1 in full. See Pl.'s Mot. at 4-6, 13-14. And because GRS 6.1 requires agencies to retain lower-level employees' emails for at least three years, Plaintiff contends that CDC acted unlawfully by deleting former employees' emails ninety days after their departure-well-short of the three-year minimum mandated by GRS 6.1. See Pl.'s Mot. at 1314.
Defendants dispute the premise on which Plaintiff's argument rests: they argue that CDC did not, in fact, adopt GRS 6.1 in full, but rather chose to adopt GRS 6.1 only “in part.” See Defs.' Opp'n at 4-6, 12. According to Defendants, CDC employs “two different record management policies regarding email records”: one that applies to its “most senior” (Capstone) officials and another that applies to “all its other employees.” Id. at 4. For Capstone officials, Defendants claim that CDC “utilizes . . . GRS 6.1.” Id. For all other employees, the agency says that it continues to “use traditional record management practices.” Id. at 5. Those traditional record management practices require employees to “determin[e] whether emails are, or contain, federal records” and, if so, to “save such emails in a shared drive with related documents.” Id. at 5. Additionally, when an employee departs CDC, the employee's supervisor meets with the employee prior to the employee's departure “to discuss where the individuals' records . . . should be filed” and, following the employee's departure, acquires access to the former employee's “Microsoft 365 suite for record management purposes.” Id. at 6. The upshot, CDC says, is that, when the agency deletes a former employee's email account ninety days after the employee's departure, all of the records that were contained in the account are adequately preserved elsewhere.
After considering the parties' positions and the record evidence in support thereof, the Court concludes that CDC's policy and practice of disposing of former employees' emails ninety days after the end of their employment is likely unlawful. That is because the available evidence suggests that CDC did indeed commit to manage and dispose of its employees' emails pursuant to the schedule established by GRS 6.1. The records management policy for HHS-of which CDC is a component-states in relevant part and without qualification that “HHS has adopted the Capstone approach (GRS 6.1).” See HHS Policy for Records Management, § 6.2 (Feb. 2024) (available at https://perma.cc/D3KFNU28). A letter sent by NARA to CDC on April 7, 2023, confirms as much: HHS “adopted the Capstone approach in 2016 to manage agency emails/email accounts.” See Apr. 2023 Letter at 1.
Even more tellingly, however, there is evidence that CDC specifically sought and obtained NARA's permission to adopt GRS 6.1 to manage the retention and disposition of all of its employees' emails. In a form submitted to NARA on October 25, 2016, CDC checked a box specifying that the agency would use GRS 6.1 to manage the email records for “all” of its employees. See Verification for Implementing GRS 6.1: Email Managed Under a Capstone Approach (“Verification Form”) at 1, (available at https://perma.cc/CA3N-MC4U). NARA approved CDC's implementation of GRS 6.1 on March 28, 2017, see id., and there is nothing in the record that suggests NARA ever approved of an alternate records-disposal schedule. Thus, it is unsurprising that, at least as of April 2023, NARA was under the impression that “all HHS components”-including CDC-“must follow the recordkeeping requirements in General Records Schedule (GRS) 6.1.” See Apr. 2023 Letter.
Defendants claim that CDC simply “checked the incorrect box” when submitting the form. Defs.' Opp'n at 5 n.3. In support, they argue that the “narrative of the form” reflects that CDC uses two different approaches to manage its upper-level and lower-level employees' emails. Id.; see also First Brewer Decl. ¶ 15. The Court disagrees. The form specifies that, unless an agency checked the “all” box, the agency must “summarize how other email is to be managed.” Verification Form at 2. Despite that instruction, the narrative to which Defendants point states only that “CDC is maintaining the emails of the CDC Director and all agency executives.” Id. The narrative does not, in other words, provide the slightest detail on “how other email is to be managed” if the CDC intended to follow a different approach. For that reason, the Court doubts that CDC simply checked the wrong box.
Defendants counter by pointing to the fact that NARA investigated CDC's recordkeeping policies and concluded that they conform with the FRA. See Defs.' Opp'n at 12-13, 16. According to NARA, CDC's policies “appropriately exercise agency discretion to manage email records in proper recordkeeping systems and . . . the policies direct employees to organize and preserve their files in accordance with CDC records schedules.” Id. at 8 (quoting First Brewer Decl. ¶ 17); see also Feb. 2024 Letter at 1. The problem, however, is that nowhere in the summary of its findings does NARA ever state that NARA actually approved CDC's use of that alternate recordkeeping system. And given that NARA did approve of CDC's use of GRS 6.1 to manage all employee emails, that omission is critical.
In short, the available evidence suggests that CDC committed to implementing GRS 6.1 to manage the emails of all of its employees, that NARA approved of CDC's full implementation of GRS 6.1, and that CDC did not seek-and NARA did not approve-an alternative schedule to govern the disposition of CDC's lower-level employees' emails or records. At the same time, there is evidence-provided by CDC itself-that the agency adopted and applied an alternate records-disposal schedule pursuant to which former employees' emails were deleted far more quickly than they would have been under GRS 6.1. And though there is evidence in the record showing that CDC has since sought the Archivist's approval to use the bifurcated approach to email retention that it appears to use in practice, the same evidence shows that the Archivist has not yet formally authorized CDC's use of that approach. See Decl. of Laurence Brewer (“Second Brewer Decl.”) ¶ 15, ECF No. 16-1 (explaining that NARA is still “in the process of reviewing” CDC's amended Capstone verification form).
Because CDC disposed of former employees' email records pursuant to a schedule that was not approved by the Archivist, it is likely that Plaintiff is correct that records removed or deleted under the CDC's unapproved policy were removed or deleted unlawfully. See Armstrong II, 1 F.3d at 1278 (“If a document qualifies as a record, the FRA prohibits an agency from discarding it by fiat.”). In such circumstances, the FRA mandates that the Archivist refer the matter to the Attorney General. See 44 U.S.C. § 3106(b); Kerry, 844 F.3d at 954. She has not done so, and thus the Court concludes that Plaintiff has demonstrated a high likelihood of success on this aspect of its claim.
Because the Court concludes that Plaintiff is likely entitled to relief under section 706(1) of the APA-which empowers courts to “compel agency action unlawfully withheld or unreasonably delayed,” 5 U.S.C. § 706(1)-it need not and does not address Defendants' argument that the Archivist's refusal to refer the case to the Attorney General does not qualify as “final agency action” for purposes of review under section 706(2)(A), see Defs.' Opp'n at 16-17.
2. Count II: Adequacy of CDC's Recordkeeping System
The second count in Plaintiff's complaint alleges that CDC violated the FRA and APA by failing to maintain an adequate recordkeeping system. See Compl. ¶¶ 77-83. According to Plaintiff, CDC's recordkeeping system is “inadequate, arbitrary, capricious, and otherwise not in accordance with the [FRA]” because it does not “provide[] consistent, effective controls over the maintenance” of employees' emails. See id. ¶¶ 79-80; see also 5 U.S.C. § 706(2). Defendants mount two principal arguments in opposition. First, they argue that the FRA precludes judicial review of Plaintiff's challenge. See Defs.' Opp'n at 10-11. Second, they argue that CDC's recordkeeping program is consistent with the FRA and APA, and thus that Plaintiff's claim fails on its merits. See id. at 12-13. The Court will address these contentions sequentially.
a. Availability of Judicial Review
Defendants first contend that “Plaintiff cannot show it is likely to succeed on its challenge to HHS and CDC's recordkeeping practices because such challenges are precluded by the FRA.” See Defs.' Opp'n at 10-11. They argue that Plaintiff's complaint does not actually “challenge the adequacy of HHS or CDC's recordkeeping guidelines,” but rather challenges CDC's compliance with the recordkeeping policies the agency has chosen to enact. See Id. (emphasis added). Plaintiff counters that Defendants mischaracterize the nature of the claim, and that Plaintiff is “squarely challenging the adequacy of the CDC's recordkeeping guidelines and directives.” See Pl.'s Reply at 15-19. Plaintiff has the better argument.
Though the FRA itself does not provide an express or implied private cause of action, see Kissinger v. Reps. Comm. for Freedom of the Press, 445 U.S. 136, 148 (1980), there are limited circumstances in which the APA empowers private litigants to sue to force agencies to comply with the FRA, Citizens for Resp. & Ethics in Wash. v. Pompeo (“Pompeo”), No. 19-cv-3324, 2020 WL 1667638, at *3 (D.D.C. Apr. 3, 2020). In Armstrong I, the seminal case on the subject, the D.C. Circuit recognized two APA-based challenges that courts may entertain regarding the FRA: (1) a claim that an agency failed “to employ adequate recordkeeping guidelines and directives” and (2) a claim challenging the Archivist's or agency head's failure to take enforcement actions required by the statute. Citizens for Resp. & Ethics in Wash. v. Pruitt, 319 F.Supp.3d 252, 257 (D.D.C. 2018); see also Armstrong 1, 924 F.2d at 291, 293-94. In contrast, the court held that “private litigants” may not sue directly “to enjoin agency actions in contravention of agency guidelines.” Armstrong I, 924 F.2d at 294. The court thus distinguished between “reviewable challenges to an agency's record-keeping guidelines under the APA, and unreviewable challenges to the agency's day-to-day implementation of its guidelines.” Competitive Enter. Inst., 67 F.Supp.3d at 33. To permit the latter, compliance-based claims, the Circuit explained, would impermissibly inject the court into the “details of record management,” a task better left “to the discretion of agency heads.” Armstrong I, 924 F.2d at 293.
With that context in mind, the Court agrees with Plaintiff that its claim is reviewable. Refined to bare essence, Plaintiff alleges that CDC enacted and obtained NARA's approval to use one recordkeeping policy and disposition schedule to govern retention of its employees' emails (i.e., GRS 6.1), see Compl. ¶¶ 32, 37, 39, 78; see also Pl.'s Mot. at 4-5, but then turned around and used some other “unknown, unpublished policy,” Compl. ¶ 44, that sets forth different requirements than GRS 6.1 and pursuant to which the agency deletes former employees' emails on a much shorter timeframe than those established by GRS 6.1, see id. ¶¶ 34, 40-44; see also Pl.'s Mot. at 14-15. Plaintiff's claim can thus be understood to allege that CDC's recordkeeping policy is unlawful and inadequate in at least two ways. First, CDC's use of an unknown, unpublished, and unapproved policy is unlawful and inadequate because the FRA requires agencies to obtain the Archivist's approval before destroying records on a recurring basis and, relatedly, mandates that agencies dispose of records only on terms approved by the Archivist. See Pub. Citizen, 184 F.3d at 902; Off. of Sci. & Tech. Pol'y, 241 F.Supp.3d at 18. Second, CDC's record management is unlawful and inadequate because the policy that it does follow-whatever that may be-does not provide for the preservation of employees' emails for the durations required by GRS 6.1.
Viewed in this light, Plaintiff is not challenging CDC's noncompliance with GRS 6.1 but rather the fact that the agency is apparently complying with whatever non-public recordkeeping policy the agency chose to adopt in its stead. And that policy is unlawful and inadequate, Plaintiff says, both because it was not approved by NARA and also because it does not preserve emails for a sufficient duration. A claim of that sort is the type of claim that the FRA permits private litigants to bring and courts to review. See Pompeo, 2020 WL 1667638, at *5 (explaining that a claim alleging “isolated violations of [agency] guidelines” is not reviewable but that a claim challenging “an agency-wide policy that violates the FRA” would be (emphasis deleted)); Pruitt, 319 F.Supp.3d at 260 (agreeing that plaintiff's “claim that the Agency's current recordkeeping policy does not conform to the FRA and implementing NARA regulations” was reviewable).
To be sure, if CDC is complying with a records disposition schedule that is materially different from GRS 6.1, that necessarily indicates that the agency is simultaneously not complying with GRS 6.1. And because Plaintiff alleges that CDC's official, announced policy is to follow GRS 6.1, the Court can conceive of a way in which Count Two could be construed as a challenge to CDC's compliance with its official policy. However, given that Plaintiff does not allege “isolated,” or ad hoc violations of GRS 6.1, Pompeo, 2020 WL 1667638, at *5, but rather an agency-wide policy of violating GRS 6.1, the Court concludes that this alternate construction of the complaint is not the best construction.
Defendants resist this conclusion principally on the ground that CDC's policy regarding the retention of employees' emails is not as unknown as Plaintiff alleges. See Defs.' Opp'n at 11. In support, Defendants point to NARA's February 2024 case-closure letter and its conclusion that “CDC's record management policy instructs all agency personnel to maintain records outside of email accounts in a proper recordkeeping system, shared drive, personal drive, or physical format.” Id.; see also Feb. 2024 Letter at 1 (concluding that “CDC does not require the preservation of all emails but rather preserves all records from email accounts”). But this only serves to underscore the reviewability of Plaintiff's claim: it strongly suggests that, like Plaintiff alleges, CDC is in fact following a records-retention policy to manage employees' emails that is distinct from GRS 6.1 and which NARA did not approve. Plaintiff's claim is, therefore, subject to judicial review.
b. Merits
Because Plaintiff's challenge to CDC's recordkeeping policy is reviewable, the Court must next consider whether Plaintiff is likely to succeed in showing that CDC's policy is unlawful or inadequate. The Court finds that Plaintiff is likely to succeed in so showing for at least two reasons.
First, it is well-established that “[a]gencies may only dispose of records on terms approved by the Archivist.” Off. of Sci. & Tech. Pol'y, 241 F.Supp.3d at 18; see also Armstrong II, 1 F.3d at 1286 n.11 (reiterating “the FRA's specific requirement that federal records may be ‘alienated or destroyed' only with the approval of the Archivist” (quoting 44 U.S.C. § 3314)). If, as here, an agency desires to dispose of certain categories of records on a recurring basis, it must obtain the Archivist's approval to do so. See Off. of Sci. & Tech. Pol'y, 241 F.Supp.3d at 18. Following the Archivist's approval of a disposal schedule, an agency must preserve records in accordance with that schedule. See 36 C.F.R. §§ 1225.10, 1226.10. It may not unilaterally decide to adopt a different schedule to govern retention of the same material. See id. § 1226.10; see also Citizens for Resp. & Ethics in Wash. v. U.S. Dep't of Homeland Sec., 592 F.Supp.2d 111, 121 (D.D.C. 2009).
Yet, as discussed above, that appears to be precisely what CDC has done. Evidence suggests that the Archivist approved CDC's use of GRS 6.1 which requires the preservation, for set periods of time, of essentially all of the emails created or stored by the agency's lower-level employees. Now, however, CDC says that it does not retain lower-level employees' emails pursuant to GRS 6.1, and instead uses a system under which employees' emails are scheduled for disposal based on their content. There is no evidence in the record that the Archivist approved this alternate practice. Thus, any emails disposed of pursuant to this alternate practice are likely being disposed of unlawfully.
Defendants are correct that CDC is by no means “required to follow the [GRS 6.1]”; the agency is “free to adopt [GRS 6.1] in part, in full, or not at all.” See Defs.' Opp'n at 12. But once an agency does decide to adopt GRS 6.1 in full-and obtains the Archivist's approval to do the same-the agency may not unilaterally change its mind and revert to a different recordkeeping policy.
A second reason Plaintiff is likely to succeed is that it is far from clear that the traditional records management approach that CDC purports to employ adequately preserves employees' emails for the durations required by GRS 6.1. Even assuming that CDC employees are, in fact, storing emails which constitute federal records elsewhere-and the Court has no reason to doubt that they are, see See Off. of Sci. & Tech. Pol'y, 241 F.Supp.3d at 21 (explaining that “government employees . . . are entitled to the presumption that they complied with agency policies, absent evidence to the contrary”)-there is no evidence that suggests that those records are being retained for the time periods required by GRS 6.1. Because the evidence suggests that the Archivist approved CDC's use of GRS 6.1, it seems likely that the agency is required to preserve its lower-level employees' emails for three or seven years. Yet CDC cites no evidence to suggest that-even if federal records are adequately being stored elsewhere-the agency is also preserving those records for the timeframes that GRS 6.1 imposes. For this additional reason, Plaintiff is likely to succeed in showing that CDC's recordkeeping system and policy is inadequate and unlawful under the FRA. See 36 C.F.R. § 1220.32 (requiring that agencies maintain “usable records” “for the length of their authorized retention period”).
For all of these reasons, Plaintiff appears likely to succeed on the merits of both of its claims. At this stage of the litigation, that is enough to tip the first factor in Plaintiff's favor.
B. Irreparable Harm
Having found that Plaintiff is likely to succeed on both of its claims, the Court next considers whether Plaintiff is likely to suffer irreparable harm in the absence of preliminary relief. See Winter, 555 U.S. at 20. A showing of irreparable injury is “is the sine qua non for obtaining a preliminary injunction” because it is what “justifies the extraordinary remedy of granting relief before the parties have had the opportunity fully to develop the evidence and fully to present their respective cases.” Meta Platforms, Inc. v. Fed. Trade Comm'n, No. 23-cv-3562, 2024 WL 1121424, at *7 (D.D.C. Mar. 15, 2024) (internal quotation marks and citations omitted). The D.C. Circuit “has set a high standard for irreparable injury.” Chaplaincy of Full Gospel Churches v. England, 454 F.3d 290, 297 (D.C. Cir. 2006) (quoting Wisc. Gas Co. v. Fed. Elec. Reg. Comm'n, 758 F.2d 669, 674 (D.C. Cir. 1985) (per curiam)). The movant must show that the injury complained of is “both certain and great,” as well as “actual and not theoretical.” Mexichem Specialty Resins, Inc. v. Env't Prot. Agency, 787 F.3d 544, 555 (D.C. Cir. 2015) (quoting Chaplaincy of Full Gospel Churches, 454 F.3d at 297). The injury must, in other words, be “of such imminence that there is a clear and present need for equitable relief to prevent irreparable harm.” Id. (quoting Chaplaincy of Full Gospel Churches, 454 F.3d at 297); see also Winter, 555 U.S. at 22 (explaining that plaintiff must “demonstrate that irreparable injury is likely in the absence of an injunction,” not just that injury is a “possibility”). The injury “must also be truly irreparable in the sense that it is ‘beyond remediation.'” Shaw v. Austin, 539 F.Supp.3d 169, 183 (D.D.C. 2021) (quoting Elec. Priv. Info. Ctr. v. Dep't of Just., 15 F.Supp.3d 32, 44 (D.D.C. 2014)).
Here, Plaintiff argues that CDC's continued deletion of its former employees' emails will permanently deprive both Plaintiff and the public at large of access to federal records. See Pl.'s Mot. at 16; see also Pl.'s Reply at 19-20 (arguing that “the primary irreparable harm here [is the] harm [that] comes from the CDC's ongoing denial of access to records that should be maintained for public access”). They emphasize that the harm is accentuated by the fact that CDC's records-particularly the types of records that Plaintiff often requests under FOIA-are relevant to “ongoing public debates.” Pl.'s Reply at 19.
The premise of Plaintiff's argument-a premise which Defendants do not meaningfully dispute-is that the loss or destruction of federal records is a significant harm to both Plaintiff and the public, and that it is a harm that cannot be cured once the records are lost or destroyed. Plaintiff's premise is sound; records that have been destroyed or deleted are almost certain to have been “lost forever to history.” Armstrong I, 924 F.2d at 288. Indeed, Defendants' own filings strongly suggest that it is exceedingly difficult, if not impossible, to recover records once they have been deleted. See Defs.' Opp'n at 18-19 (stating that if records “were deleted” it is unlikely that “they could be recovered”). It is thus unsurprising that in circumstances analogous to those presented here, courts have recognized the irreparable nature of the government's failure to properly preserve records while litigation is pending. See Citizens for Resp. & Ethics in Wash. v. Off. of Admin., 565 F.Supp.2d 23, 29-30 (D.D.C. 2008) (noting irreparable harm if records are disposed of during litigation challenging the government's treatment of those records); cf. Citizens for Resp. & Ethics in Wash. v. Exec. Off. of President, 587 F.Supp.2d 48, 59-61 (D.D.C. 2008) (finding “real and immediate” harm to plaintiff where plaintiff alleged that “emails will be lost in the future” “unless adequate preservation guidelines are promulgated and a recordkeeping system implemented” (citation omitted)).
A closer question-at least at this early stage of the litigation-is whether there exists a significant likelihood that federal records are, in fact, being removed or deleted by CDC. If one accepts Defendants' contention that CDC adopted GRS 6.1 only in part, then there is a strong argument that federal records are likely not being lost or destroyed. That is because CDC's stated record retention policy “requires employees to ensure” that any emails which constitute federal records “are maintained only in official recordkeeping systems.” See Decl. of Mary Wilson (“Wilson Decl.”) ¶ 4, ECF No. 13-1. “CDC does not consider [e]mail accounts to be recordkeeping systems,” Id., and thus the agency requires employees to determine which of their emails “are or contain federal records” so that the employee may subsequently transfer those emails that are or contain federal records to a separate, shared storage location, Id. ¶ 13; see also Id. ¶ 4.
On this view, then, whatever federal records may be created in, pass through, or reside in an employee's email account are separately saved outside of the account and thus, when Microsoft eventually deletes a former employee's account, all of the records that resided in that account have already been preserved elsewhere. This is apparently what NARA understood to be happening when it closed its investigation into CDC's recordkeeping policies and practices. See Feb. 2024 Letter at 1 (“CDC does not require the preservation of all emails but rather preserves all records from email accounts.”); see also First Brewer Decl. ¶ 17 (“My staff evaluated CDC policies and found them in conformance with the FRA because they appropriately exercise agency discretion to manage email records in proper recordkeeping systems ....”); Second Brewer Decl. ¶ 13 (“CDC instructs non-Capstone employees to identify and manage email records in appropriate recordkeeping systems based on their content, in accordance with applicable, NARA-approved records schedules. Non-Capstone employees are expected to manage their email on an ongoing basis by preserving and disposing of emails in accordance with the applicable records schedule, based on agency policy and training.”).
The problem for Defendants is that, as explained above, the available evidence suggests that CDC adopted GRS 6.1 wholesale, not just in part. See supra Part IV.A.1.c. That is significant because GRS 6.1 establishes that an email's retention value-and the time period over which an email needs to be preserved-is determined by reference to the “role of the sender” as opposed to “the content of the email.” Second Brewer Decl. ¶ 12; see also Wilson Decl. ¶ 6 (“Under [the Capstone] approach, final disposition of electronic records is based on the role or position of the end user, not the content of each individual email records.”). The traditional records management approach which CDC purports to follow, on the other hand, bases an email's retention value on the email's contents, not the sender's role. See Second Brewer Decl. ¶ 12. It seems likely that this mismatch would lead to instances in which the agency fails to preserve emails that it should be preserving under GRS 6.1, since GRS 6.1 classifies all lower-level employees' emails as having retention value, whereas the traditional approach would seem to encompass at least a slightly smaller set of emails which, based on their content, constitute federal records. See NARA, White Paper on the Capstone Approach and Capstone GRS at 4 (April 2015) (available at https://bit.ly/3Jm5Nfm) (explaining that email “often meets the definition of a federal record as provided in the Federal Records Act”).
At the very least, there is nothing in the record to suggest that NARA approved an alternate records retention and disposition program, meaning that CDC could only dispose of its lower-level employees' emails pursuant to GRS 6.1. See Competitive Enter. Inst., 241 F.Supp.3d at 18 (“Agencies may only dispose of records on terms approved by [NARA] ....”).
Defendants' arguments to the contrary miss the mark. They first argue that Plaintiff has not shown irreparable injury because the past harm of which Plaintiff complains-CDC's allegedly inadequate response to the organization's FOIA request and the unavailability of documents responsive to that request-cannot be remedied given that the documents have been destroyed. See Defs.' Opp'n at 18-19. But Defendants fundamentally misunderstand the nature of the harm claimed by Plaintiff. The harm Plaintiff seeks to avoid is the destruction of federal records now and in the future; Plaintiff's lawsuit is not a FOIA suit, and it does not aim to recover documents that would have been responsive to Plaintiff's years-old FOIA request. See Pl.'s Reply at 20.
Defendants next argue that Plaintiff has not demonstrated a likelihood of ongoing or future harm because it has not alleged that any of its pending FOIA requests to CDC-or any FOIA requests it will file in the future-will “involve former non-Capstone CDC employees” or their emails. See Defs.' Opp'n at 19. But as Defendants themselves acknowledge, Plaintiff alleges that it has “six pending FOIA lawsuits ‘seeking email records from HHS, the CDC, and other HHS components.'” Id. (quoting Compl. ¶ 11). The list of officials who qualify as Capstone officials is small; it is confined to only the most senior officials at CDC. See Verification Form at 3-7. Most CDC employees are non-Capstone officials. See General Records Schedule 6.1 at 5. It is simply not plausible that none of Plaintiff's FOIA requests will implicate the emails of the much larger group of individuals who are not Capstone officials.
Finally, Defendants argue that “Plaintiff's lack of irreparable harm is . . . demonstrated by Plaintiff's delay in seeking this emergency relief.” See Defs.' Opp'n at 20. There was, however, no significant delay. NARA did not conclude its investigation into CDC's recordkeeping practices until February 23, 2024. See Feb. 2024 Letter at 1. While the investigation was pending, Plaintiff could have assumed that NARA's investigation would lead to a referral to the Attorney General, thereby eliminating any need for Plaintiff to file a lawsuit aiming to compel the same. When that turned out not to be the case, Plaintiff did not waste time, but rather filed suit less than two months later. To be sure, there are instances in which courts have suggested that delays of similar lengths “militate[d] against a finding of irreparable harm.” Mylan Pharms., Inc. v. Shalala, 81 F.Supp.2d 30, 44 (D.D.C. 2000). But here, the Court agrees with Plaintiff that, given the circumstances, the fact that Plaintiff did not immediately rush to federal court does not diminish the likelihood of irreparable harm. See Pl.'s Reply at 21-22.
For these reasons, the Court concludes that Plaintiff has demonstrated that it “is likely to suffer irreparable harm in the absence of preliminary relief.” See Winter, 555 U.S. at 20. The second factor tilts in its favor.
C. Balance of the Equities and the Public Interest
Finally, Plaintiff must show “that the balance of equities tips in [its] favor, and that an injunction is in the public interest.” Winter, 555 U.S. at 20. Under these factors, the Court must “weigh[] the harm to [Plaintiff] if there is no injunction against the harm to the [government] if there is.” Pursuing Am.'s Greatness v. Fed. Election Comm'n, 831 F.3d 500, 511 (D.C. Cir. 2016). The two factors “merge when the Government is the opposing party.” Guedes, 920 F.3d at 10 (quoting Nken, 556 U.S. at 435).
The Court finds that, on balance, the third and fourth factors tip in Plaintiff's favor. For one thing, “[t]here is generally no public interest in the perpetuation of unlawful agency action.” League of Women Voters, 838 F.3d at 12. On the contrary, “there is a substantial public interest ‘in having governmental agencies abide by the federal laws that govern their . . . operations.” Id. (quoting Washington v. Reno, 35 F.3d 1093, 1103 (6th Cir. 1994)). Here, Plaintiff's strong likelihood of success on the merits of its claim that CDC is unlawfully and prematurely deleting its former employees' emails indicates that a preliminary injunction would serve the public interest. See Shawnee Tribe v. Mnuchin, 984 F.3d 94, 102 (D.C. Cir. 2021) (explaining that “[a] party's likelihood of success on the merits is a strong indicator that a preliminary injunction would serve the public interest because there is generally no public interest in the perpetuation of unlawful agency action” (cleaned up)).
For another thing, Defendants do not meaningfully dispute Plaintiff's contention that the Government will not suffer any significant harm if required to preserve emails pursuant to GRS 6.1 or if ordered to request the Attorney General's assistance in recovering previously deleted or removed emails. See Pl.'s Mot. at 18. Despite Plaintiff's assertions to the contrary, see id., it seems likely that establishing a system by which to ensure that all employee emails are preserved for the durations required by GRS 6.1 will impose at least some burden on HHS and CDC. It is difficult to assess the extent of that burden, however, given Defendants' lack of response to Plaintiff's briefing on the point. Accordingly, the Court agrees with Plaintiff that-whatever the extent of the burden may be-it likely does not outweigh the harm that would inure to Plaintiff (and the public at large) were CDC permitted to continue its practice of deleting former employees' emails while this litigation is pending.
* * *
All four factors weigh in favor of granting preliminary relief. Accordingly, the Court will enjoin CDC from deleting or destroying the emails of its former lower-level employees before the periods prescribed by GRS 6.1, unless and until the Archivist approves an alternate schedule by which CDC shall manage the retention and disposal of such emails. See Armstrong II, 1 F.3d at 1288 n.12 (affirming district court's order enjoining “agencies from destroying any electronic records . . . until the agencies came up with new, adequate records management guidelines to replace the ones voided by the district court's declaratory order”). Moreover, the Court will order that the Archivist seek the assistance of the Attorney General (and provide notice to Congress) so that, together, they may take all necessary steps to recover or seek other redress for CDC's past deletion of its former non-Capstone employees' emails. See id. (affirming district “court's order requiring the Archivist immediately to seek the assistance of the Attorney General and notify Congress of that action”).
Federal Rule of Civil Procedure 65(c) instructs that a court may issue a preliminary injunction “only if the movant gives security in an amount that the court considers proper to pay the costs and damages sustained by any party found to have been wrongfully enjoined.” Fed.R.Civ.P. 65(c). Notwithstanding the mandatory language of the rule, courts in this Circuit have held that the Rule “vest[s] broad discretion in the district court to determine the appropriate amount of an injunction bond,” DSE, Inc. v. United States, 169 F.3d 21, 33 (D.C. Cir. 1999), including the discretion to require no bond at all, Council on American-Islamic Rels. v. Gaubatz, 667 F.Supp.2d 67, 81 (D.D.C. 2009); see also Fed. Prescription Serv., Inc. v. Am. Pharm. Ass'n, 636 F.2d 755, 759 (D.C. Cir. 1980) (“[T]he district court has power not only to set the amount of security but to dispense with any security requirement whatsoever where the restraint will do the defendant no material damage, where there has been no proof of likelihood of harm, and where the applicant for equitable relief has considerable assets and is . . . able to respond in damages if defendant does suffer damages by reason of a wrongful injunction.”) (cleaned up); Nat. Res. Def. Council, Inc. v. Morton, 337 F.Supp. 167, 168 (D.D.C. 1971) (“It is well settled that Rule 65(c) gives the Court wide discretion in the matter of requiring security.”). Plaintiff asks that the Court exercise that discretion here, See Pl.'s Mot. at 19, and Defendants voice no opposition. The Court will therefore not require Plaintiff to post an injunction bond.
V. CONCLUSION
For the foregoing reasons, Plaintiff's Motion for a Preliminary Injunction (ECF No. 6) is GRANTED. It is hereby ORDERED that CDC is enjoined from deleting or destroying former non-Capstone employees' emails until the time periods established by GRS 6.1 have passed or pending further order of the Court upon the Archivist's approval of an alternate disposal schedule. It is FURTHER ORDERED that the Archivist shall seek the assistance of the Attorney General (1) to recover-to the extent reasonably possible-the emails of former CDC employees that have been prematurely destroyed or deleted and (2) to ensure the proper preservation of emails when lower-level CDC employees leave the agency. An order consistent with this Memorandum Opinion is separately and contemporaneously issued.