RICHARD SEEBORG

ORDER RE CROSS-MOTIONS FOR SUMMARY JUDGMENT

I. INTRODUCTION

These are cross-motions for summary judgment in an action challenging the adequacy of the response of the U.S. Customs and Border Protection ("CBP") to various Freedom of Information Act ("FOIA") and Privacy Act requests made by plaintiff Edward Hasbrouck in 2007 and 2009. Hasbrouck requested information about himself contained in various CBP law enforcement databases, information about searching for and retrieving data from those databases, and information about the processing of one of his Privacy Act requests. CBP released certain documents in their entirety, released other documents with redactions, and withheld other documents in their entirety. As set out below, the record establishes that while CBP's withholding decisions generally are supported by the law and the facts, some issues remain as to the adequacy of its search efforts and the completeness of its production.

II. BACKGROUND

Plaintiff Hasbrouck is a self-described professional journalist, author, and blogger. He was formerly a travel agent and asserts he is recognized as an expert on numerous travel-related issues. Hasbrouck serves as a consultant on travel-related issues to the Identity Project, a non-profit organization that provides advice, assistance, publicity, and legal defense to those who believe their rights have been infringed, or their legitimate activities curtailed, by demands for identification.

This action arises from four requests for disclosure of information that Hasbrouck made to the CBP. First, Hasbrouck made a Privacy Act request to the CBP Office of Field Operations in 2007 for copies of all information relating to himself "contained in the system of records established for the Automated Targeting System ("ATS")," as described in the System of Records Notice ("SORN"). He also filed an administrative appeal related to this request.

In October of 2009, Hasbrouck submitted a second Privacy Act request to CBP in which he both renewed his earlier request for ATS records, and additionally sought copies of all information about himself from these additional systems of records: Advance Passenger Information System (APIS); Border Crossing Information System (BCIS); and U.S. Customs and Border Protection TECS. He included a request for all Passenger Name Record (PNR) and Interagency Border Inspection System (IBIS) data, regardless of where it was located, as well as all information about him referenced in the "Categories of Records in the System" section of the SORN, and an accounting of all disclosures of any of these records. He filed an appeal when he received no response.

On the same date in October of 2009 , Hasbrouck made a separate request under FOIA and the Privacy Act seeking copies of any and all documents and records created by CBP or other agencies in the course of processing of his 2007 Privacy Act request and appeal. An appeal again followed when he received no response.

Finally, on the same date, Hasbrouck made another separate request under FOIA for copies of any and all documents and records describing the search systems and methods, indexing, query formats and options, data fields and formatting, and the numbers or other identifying particulars by which PNR or other data can be retrieved from ATS, APIS, BCIS, ADIS, and TECS. Specifically, he asked for "[A]ny user manuals, training manuals or materials, reference manuals, query format guides, search protocols or instructions, interpretation guides, standard operating procedures, contract specifications, software use cases or other functional or technical specifications, Application Programming Interface (API) specifications and formats for any software or systems which contain, process, or interact with these records, and the contents of any online or electronic help or reference system for any of these systems." Once again, an administrative appeal resulted when he received no response.

After this action was filed, the parties engaged in meet and confer negotiations, which they report were successful in narrowing the scope of their disputes to some degree. They brought these cross-motions seeking resolution of the remaining issues. As reflected by the briefing, however, some of the disputes continued to evolve, and at the hearing the parties acknowledged that further meet and confer may be appropriate in some instances. This order, therefore will provide resolution as to those issues on which the parties have clearly reached impasse, but will direct them to engage in further discussions to resolve any disputes that may not be fully disposed of herein.

III. DISCUSSION

A. Privacy Act exemptions

Hasbrouck contends that CBP is improperly relying on regulatory exemptions adopted in 2010 to withhold materials that would otherwise be responsive to his Privacy Act requests made in 2007 and 2009. In the context of exemptions to disclosure under FOIA, the rule is clear that exemptions in effect by the time of any lawsuit are a sufficient basis to preclude disclosure, even if enacted after the request in dispute was made. See Southwest Center. for Biological Diversity v. Dep't of Agriculture, 314 F.3d 1060, 1061 (9th Cir. 2002).

As explained in Southwest Center, "[t]here are many situations in which 'a court should apply the law in effect at the time it renders its decision.'" Id. (quoting Landgraf v. USI Film Products, 511 U.S. 244, 273 (1994)). Applying present law will only be characterized as having "retroactive" effect where doing so "would impair rights a party possessed when he acted, increase a party's liability for past conduct, or impose new duties with respect to transactions already completed." Landgraf, 511 U.S. at 280. Although a party requesting information under FOIA prior to the enactment of an applicable exemption arguably has a "right" to that information that is "impaired" by the subsequent adoption of the exemption, Southwest Center makes clear there is no objectionable "retroactive effect," because the party cannot show prejudicial reliance on the prior state of the law. See Southwest Center, 314 F.3d at 1062 ("the 'action' of the Center was merely to request or sue for information; it was not to take a position in reliance upon existing law that would prejudice the Center when that law was changed."); see also Center for Biological Diversity v. U.S. Dept. of Agriculture, 626 F.3d 1113, 1117-18 (9th Cir. 2010) (following Southwest Center and further explaining that there is no retroactive effect where plaintiff is seeking the prospective relief of an order compelling disclosure of information).

Hasbrouck argues that Southwest Center is not controlling here because the Privacy Act serves different purposes than FOIA. See Flowers v. Exec. Office of the President, 142 F. Supp. 2d 38, 42 (D.D.C. 2001) ("the purposes of the Privacy Act and the FOIA are quite different: the FOIA was enacted to provide citizens with better access to government records, while the Privacy Act was adopted to safeguard individuals against invasions of their privacy."). As a result, Hasbrouck contends, he had a "vested" and private interest in reviewing information about himself maintained by the CBP that is materially different than the public interest rights asserted by the plaintiff in Southwest Center. In a similar vein, Hasbrouck insists that, unlike the Southwest Center plaintiff, he can show he prejudicially relied on the former state of the law, in that he would have avoided disclosing information that might end up in the possession of the CBP had he known that he would subsequently be precluded from reviewing CBP records to safeguard his privacy rights.

Both these arguments, however, prove too much. Hasbrouck has not argued, and could not reasonably do so, that exemptions promulgated in 2010 would not apply to any request he might make today. Yet the same previously-collected information would fall within the scope of the exemptions and could properly be withheld from any materials produced in response to a new request. This highlights the observation in Biological Diversity that "retroactivity" simply is not implicated, because plaintiff's claim in essence seeks prospective injunctive relief—an order requiring CBP to turn over information now. As such, this is one of the many circumstances in which "a court should apply the law in effect at the time it renders its decision," notwithstanding the happenstance that Hasbrouck made his Privacy Act requests before the current exemptions were promulgated.

Finally, Hasbrouck also argues that analysis under Landgraf is inappropriate here without first addressing the "threshold question" of whether the CBP has statutory authority to engage in "retroactive rulemaking" in the first instance. See Bowen v. Georgetown Univ. Hosp., 488 U.S. 204, 208 (1988) ("In determining the validity of the Secretary's retroactive cost-limit rule, the threshold question is whether the Medicare Act authorizes retroactive rulemaking."). Hasbrouck's reliance on Bowen is misplaced. In that case, there was no dispute that the regulation at issue, as applied by the agency, had a retroactive effect. See 488 U.S. at 207 ("In effect, the Secretary had promulgated a rule retroactively, and the net result was as if the original rule had never been set aside.") The only question was whether the agency had the power to adopt a retroactive rule. See id. at 209 ("The Secretary contends that the Medicare Act provides the necessary authority to promulgate retroactive cost-limit rules . . . .")

Here, in contrast, the question is not whether CBP might have the authority to adopt a retroactive regulation, but whether applying the exemptions promulgated in 2010 to this case can be characterized under Landgraf as a "retroactive" application of the regulations. For the reasons explained above, it cannot. Accordingly, CBP's potential statutory authority to adopt truly retroactive regulations—or its lack thereof—is simply irrelevant to the analysis. CBP therefore is entitled to rely on exemptions promulgated after the dates on which Hasbrouck made his Privacy Act requests.

B. "Personal identifiers"

Hasbrouck contends that he has a right both under the Privacy Act and FOIA to disclosure of the list of "personal" or "unique" identifiers by which data can be retrieved from an individual's ATS, APIS, BCIS, ADIS, and TECS records. CBP publicly discloses that records can be searched by an individual's name and address, but does not list what other "personal" or "unique" identifiers it maintains. Hasbrouck speculates that the list likely includes such identifiers as birthdates, passport numbers, credit card numbers, telephone numbers, and the like.

As seemingly innocuous as such a list might appear to be at first blush, CBP asserts that it is entitled to withhold such information pursuant to FOIA Exemption 7(E), 5 U.S.C.§ 552(b)(7)(E). That exemption permits withholding of records or information compiled for law enforcement purposes that would "disclose techniques and procedures for law enforcement investigations or prosecutions, or would disclose guidelines for law enforcement investigations or prosecutions if such disclosure could reasonably be expected to risk circumvention of the law." Perhaps because the scope of the parties' dispute did not crystallize until late in the briefing process, neither side provided focused argument on how disclosure of merely the list of personal or unique identifiers would or would not impact law enforcement investigations or prosecutions. Nevertheless, CBP's showing as to the applicability of Exemption 7(E) to broader aspects of Hasbrouck's requests is sufficient to establish that even the list of identifiers has been properly withheld.

While it may be of little consequence to law enforcement efforts to disclose that CBP can retrieve information based on obvious identifiers such as birthdates, passport numbers, or similar data, it manifestly would implicate security concerns to disclose that CBP also tracks one or more non-obvious identifier, or for it to admit that it cannot retrieve information except by obvious identifiers. Accordingly, CBP need not provide the list of identifiers Hasbrouck is seeking.

C. Adequacy of search efforts

1. Software specifications

Hasbrouck asserts that he seeks information regarding the software used with CBP's databases so that he can determine what "personal identifiers" may be used to retrieve information. In light of the conclusion of the preceding section, CBP need not respond further to this category.

2. Search parameters

CBP has not shown why it would be unreasonable, unduly burdensome, or otherwise inappropriate to require it to conduct electronic searches for responsive information with variant spellings of Hasbrouck's name, as specified in his requests. While it may be true that Hasbrouck would be unlikely to misspell his own name, it is plausible that it would not always be entered into data sources correctly. Accordingly, CBP shall run searches using the parameters requested by Hasbrouck, and produce any non-cumulative results that are not subject to withholding on some other basis.

3. "Search logs," "Significant Activity Reports," correspondence, and other materials

CBP contends that Hasbrouck's remaining complaints as to the adequacy of its search efforts or production relate to materials either that simply do not exist, or as to which Hasbrouck has not adequately explained what he is looking for. CBP acknowledges, however, that in at least some instances it could provide further information, either in meet and confer negotiations, or by declaration that would more fully explain why it believes no further documents need be produced. At the hearing, CBP also admitted that it contends certain documents are not only non-responsive to the requests, but also exempt from disclosure. To the extent CBP intends to rely on exemptions, even in the alternative, it should supplement its Vaughn index.

The current record does not permit a conclusive determination as to exactly what remains in actual dispute. CBP, of course, cannot be compelled to produce materials that do not exist, and at some point its declarations so stating must be accepted, even if Hasbrouck believes additional materials should exist. Accordingly, the parties are hereby directed to engage in further meet and confer discussions to clarify, and potentially resolve, any disputes that may remain between them.

IV. CONCLUSION

CBP's motion is granted to the extent that the rulings set forth above relieve it of producing particular further items or categories of information. Conversely, Hasbrouck's motion is granted to the extent this order requires CBP to engage in further searches and the production of any resulting information. The motions are otherwise denied without prejudice. The parties shall engage in further meet and confer discussions to address their remaining disputes. Within 60 days of the date of this order the parties shall submit a joint report setting out:

1. Any issues that are ripe for further adjudication by the Court as to the respective rights and obligations of the parties.

2. The status of any issues which the parties are continuing to discuss, or which cannot be fully resolved pending possible further responses from CBP to Hasbrouck's requests.

3. The parties' joint or separate proposals for a procedure and schedule for bringing this litigation to final resolution, including their views as to whether a judgment will be necessary and the form any judgment should take. IT IS SO ORDERED.

____________

RICHARD SEEBORG

UNITED STATES DISTRICT JUDGE

Southwest Center introduces the term "impermissible retroactive effect," which arguably implies that the FOIA exemption it was considering was "retroactive," just not impermissibly so. In context, however, it is clear that Southwest Center found it permissible to apply the recently-enacted FOIA exemption to the case before it because doing so could not be characterized as "retroactive" under Landgraf. See Landgraf, at 511 U.S. at 269 ("A statute does not operate 'retrospectively' merely because it is applied in a case arising from conduct antedating the statute's enactment.")