Summary
holding that a Privacy Act claim premised on a different disclosure of personal information did not relate back to the original complaint
Summary of this case from Faulkner v. Adt Sec. Servs., Inc.Opinion
No. 03-35877.
Argued and Submitted March 11, 2005.
Filed March 14, 2006.
Marianne Dugan, Facaros Dugan, Eugene, OR, for the appellant.
Karin J. Immergut, U.S. Attorney, and James L. Sutherland, Assistant United States Attorney, Eugene, OR, for the appellee.
Appeal from the United States District Court for the District of Oregon; Michael R. Hogan, District of Oregon, Presiding. D.C. No. CV-02-06301-MRH/TMC.
Before PROCTER HUG, JR., MARSHA S. BERZON, and JAY S. BYBEE, Circuit Judges.
Petitioner Robert Oja sued the United States Army Corps of Engineers ("the USACE") and Robert Flowers (collectively "Defendants") under the Privacy Act of 1974, Pub.L. No. 579, 88 Stat. 1896 (codified as amended at 5 U.S.C. § 552(a)), for disclosing Oja's personal information by posting it on the USACE's public Internet website. The District of Oregon granted summary judgment for Defendants. We affirm, holding that the district court properly applied the Privacy Act's statute of limitations to both of Oja's amended complaints. In the course of answering Oja's claims, we hold that the single publication rule applies to Privacy Act claims relating to Internet posting.
I. FACTS AND PROCEEDINGS
Given that the district court granted the USACE's motion for summary judgment, we view the alleged facts in the light most favorable to Oja, the non-moving party. See Am. Bankers Ass'n v. Gould, 412 F.3d 1081, 1086 (9th Cir. 2005) ("We must determine, viewing the evidence in the light most favorable to the nonmoving party, whether there are any genuine issues of material fact and whether the district court correctly applied the relevant substantive law.").
A. Background
Oja served as Regulatory Chief of the Alaska District of the USACE from 1985 until 1998. During his tenure at the USACE, Oja avers that he "was frequently critical of the USACE, accusing the agency of thwarting his efforts to enforce wetlands violations and bending to pressure from oil companies." Oja made numerous protective disclosures under the Whistle-blower Protection Act of 1989, Pub.L. No. 101-12, 103 Stat. 16 (codified in scattered sections of 5 U.S.C.), and documented repeated statutory violations by the USACE's Alaska construction projects in investigative reports required under the Clean Water Act of 1977, Pub.L. No. 95-217, 91 Stat. 1566 (codified in scattered sections of 33 U.S.C.). In 1997, the USACE stripped Oja of his duties' as Regulatory Chief. In February 1998, Oja filed a claim for job-related illness. That same month, the USACE acknowledged in writing that Oja's medical records demonstrated that he was disabled for work due to a stress-related illness.
A protective disclosure is "any disclosure of information by an employee or applicant which the employee or applicant reasonably believes evidences . . . a violation of any law, rule, or regulation, or . . . gross mismanagement, a gross waste of funds, an abuse of authority, or a substantial and specific danger to public health or safety. . . ." 5 U.S.C. § 2302(b)(8)(A).
In 1999, Oja and the USACE entered into a settlement agreement regarding his claim for job-related illness ("Settlement Agreement"). The USACE agreed to "convert the basis" for Oja's termination from "excessive absence and failure to follow leave procedures" to "continued absence due to illness." The USACE also agreed to purge the former explanation from its records. Oja agreed to file for retirement, which the USACE subsequently granted, retroactive to March 1998.
In September 2000, The Washington Post published a series of articles critical of the USACE. The series included a discussion of the Alaska District and Oja's tenure as Regulatory Chief and mentioned Oja's earlier complaints that the USACE had thwarted his efforts to enforce wetlands violations.
At some point shortly after the Post articles appeared, the USACE posted a point-by-point response to the articles on its Internet website under "Corps Facts" at http://www.hq.usace. army.mil/cepa/pubs/Alaska.htm. One of these points reads:
Issue: Mr. Robert Oja, Chief of Regulatory in the Alaska District . . .
Removal from Job: Mr. Oja stopped coming to work on October 23, 1997, and failed to provide information about the likelihood of returning to work. Effective September 5, 1998, Mr. Oja was removed from his position for excessive absence due to illness.
The USACE removed the posting from its public Internet website on November 27, 2000. The following month, Oja asserts, he discovered "the very same personal information about me could be accessed by going into the [USACE's] Public Affairs website, clicking on `news publications,' and then finding a new posting that contained the [same] personal information about me."
In September 2001, Oja filed a Petition for Enforcement with the Merit Systems Protection Board ("MSPB"). He alleged that the USACE had breached the Settlement Agreement by posting employment and medical information about him on its Internet website and by not providing relocation entitlements. He further alleged that these breaches were intentional and that the USACE had continued to abuse him as if the Settlement Agreement had never existed. He stated in his petition that
In September 2000, (more than a year after the settlement terms had taken effect, I learned that the [USACE] posted the following information about me on their national Internet web site.
"Removal from Job. Mr. Oja stopped coming to work on October 23, 1997, and failed to provide information about the likelihood of returning to work. Effective September 5, 1998, Mr. Oja was removed from his position for excessive absence due to illness."
Oja later confirmed that "I first saw the [USACE] Internet posting about me in September 2000." In October 2001, the USACE informed Oja that it had placed his personal information on its Internet website to "defend" the USACE from "media inquiries."
Oja filed his original complaint in the District of Oregon on November 5, 2002, alleging that the USACE had violated the Privacy Act by posting Oja's private information on its public Internet website ("Original Complaint"). He then filed an amended complaint on November 25, 2002 ("First Amended Complaint"). Both complaints stated that "[d]uring the month of November 2000, and continuously until at least November 27, 2000, the defendants posted private information about Mr. Oja on the public portions of the USACE's Internet website." On March 10, 2003, Oja filed a Second Amended Complaint. In that complaint, Oja did not repeat his allegations that the USACE violated the Privacy Act by posting private information on its public Internet website from September to November 2000. Rather, he alleged that "[d]uring the month of December 2000" Defendants posted private information about him on "public portions of the USACE's Public Affairs Internet website." Oja noted that this was the same information he "had previously located on a different USACE website, but which had disappeared from that website in late November 2000." Oja alleged that the USACE continuously posted this information on the USACE Public Affairs Internet website from December 2000 until January 2001. Defendants filed a motion for summary judgment in response to Oja's First Amended Complaint and a motion to dismiss in response to Oja's Second Amended Complaint.
B. Proceedings
1. First Amended Complaint
Defendants filed for summary judgment against Oja's First Amended Complaint on the basis that Oja had not filed his claim within the Privacy Act's two-year statute of limitations. See 5 U.S.C. § 552a(g)(5) (specifying that an "action to enforce any liability created under this section may be brought . . . within two years from the date on which the cause of actions arises"). The Defendants submitted Oja's statement before the MSPB that he had discovered the Internet postings in September 2000, and argued that his Original Complaint — filed November 5, 2002 — had not been filed within the Privacy Act's statute of limitations; accordingly, Defendants argued that the district court lacked jurisdiction to consider Oja's Original and First Amended Complaints.
Oja opposed the Motion, asserting that the continuously-available Internet posting constituted a perpetual violation of the Privacy Act and that his action was therefore within the statute of limitations. He also argued that the statute of limitations should actually have commenced to run when the USACE informed him in October 2001 of its reason for posting the information because it was only as of that point that he had actual knowledge that the posting was "willful or intentional."
The magistrate judge recommended granting Defendants' summary judgment request. The magistrate judge found that Oja's First Amended Complaint only referenced the posting he discovered in September 2000; the September 2000 posting did not fall within the narrow parameters of the continuing violation doctrine and, accordingly, the statute began to run at the time Oja discovered the posting; and Oja's cause of action accrued when Oja first became aware of the posting rather than when Oja first learned that the posting had been intentionally or willfully published on the USACE public website. After a de novo review, the District Court adopted the magistrate judge's findings and recommendation, and entered judgment for Defendants.
2. Second Amended Complaint
Defendants filed a motion to dismiss Oja's Second Amended Complaint, asserting that it was also filed more than two years after Oja discovered the second posting on the USACE Internet website. Defendants argued that because the Second Amended Complaint concerned a posting distinct from that contemplated in Oja's Original and First Amended Complaints, the Second Amended Complaint did not relate back to the First Amended Complaint. See Fed.R.Civ.P. 15(c). Oja opposed the motion, arguing that his Second Amended Complaint averred that he found the same information referenced in his Original and First Amended Complaints on a different USACE Internet website; thus, the conduct and basic facts alleged in the First and Second Amended Complaints were identical, his Second Amended Complaint should relate back to the First Amended Complaint's filing date, and the Second Amended Complaint should accordingly be considered filed within the statutory period. Oja argued in the alternative that the multiple publication rule should apply to his case because the USACE engaged in serial disclosure of identical private information; under that theory, each disclosure made to those who accessed the personal information on the USACE's website commenced a new statute of limitations period.
After considering the foregoing, the magistrate judge recommended granting the Defendants' motion to dismiss. The magistrate judge viewed the "question before the court [as] . . . whether the second posting [discovered in December 2000], to a different website, can reasonably be viewed as involving the same transaction as the first posting [discovered in September 2000]." The magistrate judge held that the "posting of information — even identical information — on a website different from that to which the information was first posted is a discrete act, independent of the first posting." Analogizing the instant case to a publication of the same article in two different issues of two different magazines owned by a single parent company, the magistrate judge stated that a plaintiff could "not amend his complaint . . . and expect that it would relate back because the two publications are entirely independent factual bases for separate claims." Finding that the December 2000 USACE Internet website posting was a transaction wholly independent of the September 2000 posting, the magistrate judge held that the relation back doctrine was inapplicable, and, accordingly, the statute of limitations for the Privacy Act cause of action in Oja's Second Amended Complaint expired three months before the filing of that complaint. After conducting a de novo review, the District Court again adopted the magistrate judge's findings and recommendation, and granted Defendants' Second Motion for Summary Judgment. This timely appeal by Oja followed.
II. STANDARD OF REVIEW
We review de novo the question of when a cause of action accrues and whether a claim is barred by the statute of limitations. Orr v. Bank of America, NT SA, 285 F.3d 764, 779-80 (9th Cir. 2002). We also review de novo the district court's application of the Federal Rules of Civil Procedure, including Rule 15(c)'s relation back doctrine. In re Dominguez, 51 F.3d 1502, 1509 (9th Cir. 1995).
III. ANALYSIS
Over the last several years, we have labored to apply settled principles of law and procedure to the relatively new medium of the Internet. That application has often proved difficult and occasionally unsatisfying, given the novel structure and ubiquity of the web and its growing importance to social dialogue and electronic commerce. The present appeal raises a novel question in this circuit: when does a cause of action accrue for an unauthorized, Internet-borne publication of information protected by the Privacy Act?
See, e.g., Gator.Com Corp. v. L.L. Bean, Inc., 341 F.3d 1072 (9th Cir. 2003) (finding general personal jurisdiction on basis of Internet-based commerce), rehearing en banc granted, 366 F.3d 789 (9th Cir. 2004), appeal dismissed as moot, 398 F.3d 1125 (9th Cir. 2005) (en banc); Cybersell, Inc. v. Cybersell, Inc., 130 F.3d 414, 416-20 (9th Cir. 1997) (applying traditional jurisdictional prerequisites to claims arising from Internet-borne contact); see also Rio Props., Inc. v. Rio Int'l Interlink, 284 F.3d 1007, 1017-18 (9th Cir. 2002) (considering the benefits and draw-backs to allowing email as an alternative service of process).
The Privacy Act provides:
No agency shall disclose any record which is contained in a system of records by any means of communication to any person, or to another agency, except pursuant to a written request by, or with the prior written consent of, the individual to whom the record pertains. . . .
5 U.S.C. § 552a(b). The Privacy Act also specifies civil remedies to be imposed for violations:
Civil Remedies. — Whenever any agency
. . .
(D) fails to comply with any other provision of this section, or any rule promulgated thereunder, in such a way as to have an adverse effect on an individual, the individual may bring a civil action against the agency, and the district courts of the United States shall have jurisdiction in the matters under the provisions of this subsection.
The statute declares — as plainly as words can convey — that no agency shall disclose any record within its system without a written request by or the prior written consent of the individual affected, subject to certain exceptions not applicable here. Oja has alleged (and for purposes of this appeal we must assume) that the USACE violated § 552a(b) by disclosing his personal information on its Internet website without Oja's prior written request or consent. The only question before us, then, is whether the Privacy Act's statute of limitations bars Oja from bringing his suit more than two years after he first learned of the USACE's disclosure. A suit seeking civil damages under the Privacy Act must be filed
within two years from the date on which the cause of action arises, except that where an agency has materially and willfully misrepresented any information required under this section to be disclosed to an individual and the information so misrepresented is material to establishment of the liability of the agency to the individual under this section, the action may be brought at any time within two years after discovery by the individual of the misrepresentation.
In general then, an individual must bring suit within two years of the unauthorized disclosure except where an agency has willfully misrepresented information required to be disclosed to the individual and which would be material to establishing the agency's liability under the Privacy Act; in such exceptional circumstances, § 552a(g)(5) affords the individual two years from the time he discovers the agency's actions.
Oja's Original Complaint was filed on November 5, 2002, and then amended and refiled as his First Amended Complaint on November 25, 2002. The First Amended Complaint states that "[d]uring the month of November 2000, and continuously until at least November 27, 2000, the defendants posted private information about Mr. Oja on the public portions of the USACE's Internet website. . . ." In Oja's Petition for Enforcement filed with the MSPB on September 8, 2001, however, he acknowledged that
In September 2000, (more than a year after the settlement terms had taken effect), I learned that the Agency posted the following information about me on their national Internet web site : "Removal from Job. Mr. Oja stopped coming to work on October 23, 1997, and failed to provide information about the likelihood of returning to work. Effective September 5, 1998, Mr. Oja was removed from his position for excessive absence due to illness."
Oja then filed his Second Amended Complaint in March 2003, in which he alleged that the USACE had posted the same information on its Public Affairs Internet website from December 2000 until January 2001. Obviously, Oja's Original and First Amended complaints were filed more than two years after he first learned that the USACE had posted private information on its website. Similarly, Oja filed his Second Amended Complaint more than two years after he discovered that the USACE had posted the same information on a different portion of its website.
Oja raises three arguments for why his First and Second Amended Complaints were nonetheless filed within the Privacy Act's statute of limitations. First, Oja argues that posting information on the Internet is a continuing tort, that each disclosure gives rise to a cause of action and new limitations period, and that the single publication rule should not apply to Internet publications. Accordingly, Oja argues that his First Amended Complaint was timely because it was filed on November 5, 2002 — less than two years after November 27, 2000, the date on which the USACE removed the posted information. Second, Oja avers that because the USACE posted identical information at a second website, his Second Amended Complaint related back to the dates on which he filed his Original and First Amended Complaint. Third, Oja asserts that his suit was timely because his cause of action did not actually accrue until October 2001, when he learned that the USACE intentionally or willfully disclosed private information on its Internet website. We consider each of these arguments in turn.
A. The Single Publication Rule and Internet Publications
As a threshold matter, we note the enormous impact of the Internet on commerce and the marketplace of ideas. Indeed, "[f]rom the publishers' point of view, [the World Wide Web] constitutes a vast platform from which to address and hear from a worldwide audience of millions of readers, viewers, researchers, and buyers." Reno v. ACLU, 521 U.S. 844, 117 S.Ct. 2329, 138 L.Ed.2d 874, (1997). Such broad access to the public carries with it the potential to influence thought and opinion on a grand scale. By extension, the publication of defamatory and private information on the web has the potential to be vastly more offensive and harmful than it might otherwise be in a more circumscribed publication. Accordingly, in search of cogent principles, we compare the Internet to other media with great care.
Almost all of the cases to have considered the publication rules associated with other media have done so in the context of defamation actions. See infra note 5 and accompanying text. Such claims are governed by state law, while we are called upon to consider publication in the context of the federal Privacy Act. Accordingly, we note that while we look to the states' approaches to and decisions regarding media publication rules for their persuasive value, we are not bound by their precedents in construing a federal law.
While the language of the Privacy Act speaks in terms of "disclosures," the magistrate judge analogized the USACE's website posting to the publication of a magazine or office manual. We agree that the analogy to mass media, defamation law, and the notion of publication is appropriate when considering unauthorized disclosures under the Privacy Act, given that the statutory text prohibits disclosure "by any means of communication" and such disclosure implies the concept of publication to a third party. In addition, the term "disclose" is defined as "to make known or public." See MERRIAM-WEBSTER'S COLLEGIATE DICTIONARY 330 (10th ed. 1999). In light of these textual and grammatical indicia, we conclude that it is appropriate to import publication considerations into our analysis of the Privacy Act. In so doing, we also consider legal doctrines generally associated with the realm of defamation law, namely the single publication rule. We also note that the fact that both the Privacy Act and defamation law are driven by similar policy concerns — personal integrity and reputational interests — makes the application all the more apt.
Courts that have considered the issue of when Internet-based information is properly considered "published" have done so largely in the context of state defamation suits. These courts have generally concluded that the posting of information on the web should be treated in the same manner as the publication of traditional media (i.e., books, newspapers, magazines, and radio and television broadcasts), that is, that traditional media's "single publication rule" should apply to postings on the Internet. Under the single publication rule, "any one edition of a book or newspaper, or any one radio or television broadcast, exhibition of a motion picture or similar aggregate communication is a single publication." RESTATEMENT (SECOND) OF TORTS § 577A(3) (1977). Under this rule, the aggregate communication can give rise to only one cause of action in the jurisdiction where the dissemination occurred, and result in only one statute of limitations period that runs from the point at which the original dissemination occurred. Zuck v. Interstate Publ'g Corp., 317 F.2d 727, 729-30 (2d Cir. 1963).
See, e.g., Van Buskirk v. New York Times Co., 325 F.3d 87 (2d Cir. 2003); Mitan v. Davis, 243 F.Supp.2d 719 (W.D.Ky. 2003); Lane v. Strang Commc'ns Co., 297 F.Supp.2d 897 (N.D.Miss. 2003); Simon v. Ariz. Bd. of Regents, 28 Media L. Rep. (BNA) 1240 (Ariz.Super.Ct. 1999); Traditional Cat Ass'n, Inc. v. Gilbreath, 118 Cal.App.4th 392, 13 Cal. Rptr.3d 353 (2004); McCandliss v. Cox Enter., 265 Ga.App. 377, 593 S.E.2d 856 (Ga.App. 2004); Abate v. Me. Antique Digest, No. 03-3759, 2004 WL 293903, *1-2 (Mass.Super.Ct. Jan. 26, 2004); Churchill v. State, 378 N.J.Super. 471, 876 A.2d 311 (App.Div. 2005); Firth v. State, 98 N.Y.2d 365, 747 N.Y.S.2d 69, 775 N.E.2d 463 (2002); E.B. v. Liberation Publ'ns, Inc., 7 A.D.3d 566, 777 N.Y.S.2d 133 (N.Y.App.Div. 2004).
In addition to state and federal courts, academic commentators have begun to weigh in on the issue, and have largely endorsed application of the single publication rule in the context of Internet publication. See, e.g., Sapna Kumar, Comment, Website Libel and the Single Publication Rule, 70 U. CHI. L. REV. 639, 662 (2003) (in favor of applying the single publication rule only when the Internet website is "truly available" to the public); Lori A. Wood, Note, Cyber-Defamation and the Single Publication Rule, 81 B.U.L. REV. 895 (2001) (in favor of applying the single publication rule to Internet publications). But see Odelia Braun, Comment, Internet Publications and Defamation: Why the Single Publication Rule Should Not Apply, 32 GOLDEN GATE U.L. REV. 325 (2002).
Courts that have extended the single publication rule to Internet publishing have done so on the premise that published web content is functionally identical to published traditional print media and, accordingly, Internet publication should be considered "published" in the same manner as is a print edition. While that premise is not entirely accurate, we agree that the analogy between Internet and print publication is sufficiently apt to be serviceable. Internet publication is a form of "aggregate communication" in that it is intended for a broad, public audience, similar to print media. In both print and Internet publishing, information is generally considered "published" when it is made available to the public. Once information has been published on a website or print media, there is no further act required by the publisher to make the information available to the public.
See, e.g., Mitan v. Davis, 243 F.Supp.2d at 724 ("A statement electronically located on a server which is called up when a web page is accessed, is no different from a statement on a paper page in a book lying on a shelf which is accessed by the reader when the book is opened. After carefully examining the issue, we can find no basis for treating defamatory Internet communication differently than any other form of aggregate communication. Therefore, we will apply the single publication rule to the statements in this case which were published on the Internet.").
We note, for example, that a book cannot be updated in the same manner that a web page can be; and once a book has been published and sold, an author or publisher may not be in a position to withdraw its availability, whereas a website host who is also the author of the site's content generally controls the availability of the information, at least as it is accessible from the author-host's own website. It is also true, however, that a viewer can save or print accessed material before the website host has a chance to make any changes, resulting in a permanent record.
See Wood, supra note 5, at 913 ("Information contained on Internet sites is available to the public, and is properly classified as an aggregate publication. . . . Arguably, the information on a website is even more accessible than information in many traditional forms of publication because once a person has access to the Internet, the information contained on most sites is free. Moreover, an Internet communication, even more so than publications by traditional means, can instantly reach an expansive geographical area, thus exposing the publisher to liability in every state.")
See Firth v. State, 184 Misc.2d 105, 706 N.Y.S.2d 835, 841 (N.Y.Ct.Cl. 2000) (noting that "[p]ublication occurs when the defamatory work first becomes generally available to the public or is placed on sale and it should be noted that this is not the same as the `publication date,' a term of art in the publishing industry which refers to a time substantially after the material has been shipped to bookstores and sales are already under way, and when publicity events begin." (internal citations and quotations omitted)), aff'd, 287 A.D.2d 771, 731 N.Y.S.2d 244 (N.Y.App.Div. 2001), aff'd, 98 N.Y.2d 365, 747 N.Y.S.2d 69, 775 N.E.2d 463 (2002).
It is true that an Internet publisher may have greater control over the availability of content posted on its server than a print publisher has over its printed stock; however, that fact alone does not corrupt the analogy between Internet and print publication, given that the single publication rule generally applies to books in a publisher's stock that could have been withdrawn following their initial availability for sale but were not. See Gregoire v. G.P. Putnam's Sons, 298 N.Y. 119, 81 N.E.2d 45, 48-49 (1948) (noting this approach, and rejecting a contrary result: "although a book containing libelous material may have been the product of but one edition or printing fifty years ago, if, by sale from stock or by display, the publisher continues to make unsold copies of the single publication available to the public today, such conduct would amount to a republication of any libel the book contains and thereby would become actionable. Under such a rule the Statute of Limitation would never expire. . . .").
In addition to functional similarities between print and Internet publication, the same considerations that compel application of the first publication rule to traditional forms of aggregate communication are equally compelling in the context of Internet publication. The single publication rule is designed to protect defendants from harassment through multiple suits and to reduce the drain of libel cases on judicial resources. See Keeton v. Hustler Magazine, Inc., 465 U.S. 770, 777, 104 S.Ct. 1473, 79 L.Ed.2d 790 (1984). Those same considerations present themselves in relation to Internet publishing, and militate in favor of applying the single publication rule to Internet publication. Given that "[c]ommunications posted on Web sites may be viewed by thousands, if not millions, over an expansive geographic area for an indefinite period of time," allowing Internet publications to be subject to a multiple publication rule "would implicate an even greater potential for endless retriggering of the statute of limitations, multiplicity of suits and harassment of defendants. Inevitably, there would be a serious inhibitory effect on the open, pervasive dissemination of information and ideas over the Internet, which is, of course, its greatest beneficial promise." Firth, 747 N.Y.S.2d 69, 775 N.E.2d at 466. Such concerns have motivated state courts to extend the single publication rule to Internet publication, and federal courts sitting in diversity have done likewise.
See, e.g., Firth, 747 N.Y.S.2d 69, 775 N.E.2d at 466; McCandliss, 593 S.E.2d at 858 (endorsing the language used and result reached in the Firth opinion); Traditional Cat Ass'n, Inc., 118 Cal.App.4th at 404, 13 Cal. Rptr.3d 353 (same).
See, e.g., Van Buskirk, 325 F.3d at 89 (applying the single publication rule to a defamation action arising from Internet publications after Firth became settled New York state law); Mitan, 243 F.Supp.2d at 722-24 (determining that Kentucky would apply the single publication rule to Internet-borne defamation); Lane, 297 F.Supp.2d at 900 (applying the single publication rule to a defamation action under Mississippi law regarding articles published on the Internet).
Oja takes issue with the analogy to traditional media and the proposition that the single publication rule should apply to Internet publication. He urges us to consider the continuous hosting of private information on an Internet website as a series of discrete and ongoing acts of publication, each giving rise to a cause of action with its own statute of limitations. Specifically, Oja compares the hosting of a website to a series of citizen telephone calls to the USACE, each caller asking the same question and each receiving the same private information in response and in violation of the Privacy Act. We find that approach problematic. The actual posting or publishing of information onto a website requires only a single, discrete act, and no additional action by the host is necessary before the information may be accessed by the general public. Thus, unlike a series of telephone calls, once a host posts information on the Internet, the host may remain passive and does not have to respond anew each time an Internet user accesses its website. Here, for example, the USACE (the website host) did not modify the substance of the published information following the initial posting of the private information in September of 2000 through November of 2000, or cause its renewed publication beyond the continued hosting of its Internet site. Although it is true that a website must be continuously hosted on a server computer for the public to access posted information, that action concerns technical maintenance rather than the particularized and original effort involved in publishing information to an audience; such routine maintenance of a website (which often amounts to no more than supplying the server computer with power) should not in itself be considered an act of republication.
We note that Oja alleged in his Second Amended Complaint that the USACE republished the private information on another website; we address that allegation in Section III.B., infra.
See, e.g., Firth, 706 N.Y.S.2d at 841 ("[T]he defendant's allegedly wrongful acts consisted of the issuance of the report on December 16, 1996 and its initial publication upon the Internet on the same date. Any continuing damage to the claimant arising from its availability upon the Internet would simply be a continuing effect of an earlier wrongful act."). Of course, substantive changes or updates to previously hosted content that are not "merely technical" may sufficiently modify the content such that it is properly considered a new publication for purposes of the statute of limitations period. See In re Davis, 334 B.R. 874 (Bankr.W.D.Ky. 2005).
Oja urges us to adopt the approach taken in Swafford v. Memphis Individual Practice Association, No. 02A01-9612-CV-00311, 1998 WL 281935 (Tenn.Ct.App. 1998), an unpublished decision by the Tennessee Court of Appeals. In Swafford, the National Practitioner Data Bank ("NPDB") provided allegedly defamatory information to health care entities which requested the information directly from the electronic data bank maintained by the NPDB. Id. at *1. "Each transmission . . . was released in response to an affirmative request by a hospital or other health care entity" and the databank could be accessed only by certified health care entities. Id. at *5. Accordingly, the court of appeals found that the single publication rule did not apply because each time a certified entity directly requested the information from the electronic data-bank held by the NPDB, the NPDB itself provided the information directly to the requesting entity. Id. at *8.
Swafford is distinguishable from our present concern, and is not inconsistent with application of the single publication rule to the vast majority of Internet publications. Unlike a typical Internet publication, the information at issue in Swafford was not available for the general public to access, nor could any unregistered and non-specific entities access the registered databank. Given the exclusive and controlled access to the NPDB "pay-to-play" databank, the release of the offending information could hardly be considered an "aggregate communication" comparable to typical Internet publication, where access is generally available to anyone at any time. Indeed, the limited access scenario set forth in Swafford resembles Oja's telephone call analogy where the agency releases the information anew each time there is a request. Swafford is much more akin to the release of personal credit reports by those agencies that track and compile credit information; in such cases, it has been widely accepted that the transmission or publication of the information does not warrant application of the single publication rule, and each transmission or publication is actionable.
See Wood, supra note 5, at 909-12 (surveying the approach taken in credit reporting cases and distinguishing such cases — and Swafford — from Firth and its progeny that would apply the single publication rule: "Although Swafford also involved defamation that occurred via the Internet, the similarity between its facts and those of Firth end there. . . . The court in Swafford appropriately relied on the credit reporting service cases, because credit reporting services closely resembled the defendant's industry. On the other hand, when a site is available to the general public, the communications contained therein more closely resemble newspapers, books, magazines, and television or radio broadcasts.").
Application of the single publication rule to Internet publication is not inconsistent with the Privacy Act's strictures. Application of the single publication rule to Internet publication will focus Privacy Act claims against a defendant, thereby economizing judicial resources while preserving the plaintiff's ability to bring the claims. Thus, we hold that the single publication rule should be applied under the Privacy Act to general Internet publications. Consequently, Oja's Original and First Amended Complaints were not filed timely, and the district court correctly determined that Oja's claims were barred by the statute of limitations.
Oja's Second Amended Complaint is also barred by the statute of limitations. In March 2003, Oja filed a Second Amended Complaint, alleging that the USACE published the same private information at a different Internet address in December 2000. If, in fact, the USACE published the same private information at a different URL address, then that disclosure constitutes a separate and distinct publication — one not foreclosed by the single publication rule — and the USACE might be liable for a separate violation of the Privacy Act. However, such an additional claim is still subject to the statute of limitations, which, under the Privacy Act, is two years from the date the private information is made public. See 5 U.S.C. § 552a(g)(5). Given that the alleged second disclosure occurred in December 2000, the statute would have run in December 2002, some three months before Oja filed suit for the disclosure in his Second Amended Complaint, filed in March 2003. Accordingly, the district court correctly determined that the Second Amended Complaint was untimely.
While Oja does not provide the public affairs website's URL listing in his Second Amended Complaint, he claims therein that this site was a second site, distinct from the national page site contemplated in his first two complaints: "This information [posted on the public affair's website] was the same information Mr. Oja had previously located on a different USACE website . . . but which had disappeared from that website in late November 2000." Accordingly, we herein treat the unidentified second site as separate and distinct from the USACE's national page site.
B. The Relation Back Doctrine
Oja claims that his Second Amended Complaint is timely because it relates back to the filing of his earlier complaints. Oja argues that the Privacy Act claims in his Second Amended Complaint are timely because they arose out of the same "conduct, transaction, or occurrence" alleged in his earlier complaints, given that the information in the second posting was identical to the information in the first posting; accordingly, Oja avers that his Second Amended Complaint should relate back to the filing date of his earlier complaint under Rule 15(c)(2).
After considering the issue, we find that Oja mistakes the meaning of the language of Rule 15(c)(2). Rule 15(c) of the Federal Rules of Civil Procedure provides, in pertinent part, that
An amendment of a pleading relates back to the date of the original pleading when:
. . .
(2) the claim or defense asserted in the amended pleading arose out of the conduct, transaction, or occurrence set forth or attempted to be set forth in the original pleading. . . .
The conduct, transaction, or occurrence of which Oja complained in his First Amended Complaint was the USACE's act of disclosing Oja's personal information on its website in November 2000, in violation of the Privacy Act's prohibitions. By contrast, Oja's Second Amended Complaint alleges claims arising from a second disclosure by the USACE on a separate website occurring in December 2000. Nowhere in Oja's First Amended Complaint does he reference a second disclosure on a USACE public affairs site in December 2000, and nowhere has Oja alleged that the disclosure act in December 2000 arose out of the conduct, transmission, or occurrence of the USACE's November 2000 disclosure on the USACE's national site. The Privacy Act states that "[n]o agency shall disclose any record which is contained in a system of records by any means of communication to any person," 5 U.S.C. § 552a(b), and we have determined, supra, that a disclosure occurs when the information is first posted on the Internet. The fact that the language in the two disclosures is identical is inapposite because Oja's claims under the Privacy Act are based on the acts of disclosure themselves, each of which is distinct in time and place, if not substance. Accordingly, and given that the claims made in Oja's Second Amended Complaint are otherwise barred by the statute of limitations, we agree with the district court that Oja's Second Amended Complaint does not relate back to the filing date of Oja's earlier complaint. Our conclusion is consistent with our application of the single publication rule to Internet publication.
See 6A CHARLES ALAN WRIGHT, ARTHUR R. MILLER MARY KAY KANE, FEDERAL PRACTICE AND PROCEDURE, § 1497, at 70-74 (2d ed. 1990) ("When plaintiff attempts to allege an entirely different transaction by amendment, Rule 15(c) will not authorize relation back. For example, amendments alleging the separate publication of libelous statement, . . . or even a separate violation of the same statute may be subject to the defense of statute of limitations because of a failure to meet the transaction standard." (internal footnotes omitted)).
It is worth noting that if the USACE's December 2000 publication of Oja's private information were considered the same publication as the USACE's earlier publication — as Oja asks the Court to conclude in his relation back argument — the single publication rule would be significantly narrowed, given that the statute of limitations for claims of separate disclosures of identical private information on separate websites would run from the first such publication. Such an outcome — which this opinion's holding forecloses — is inconsistent with the Privacy Act's plain language and is surely contrary to the true interests of Oja and similarly situated plaintiffs that assert Privacy Act claims.
C. Intentional or Willful Disclosures
In the alternative, Oja argues that while he knew of the USACE's posting in September 2000, his cause of action did not actually accrue until October 2001, when he claims he first learned that the USACE's posting was "intentional or willful." 5 U.S.C. § 552a(g)(1)(D) provides that "Whenever an agency . . . (D) fails to comply with any other provision of this section, or any rule promulgated thereunder, in such a way as to have an adverse effect on an individual, the individual may bring a civil action against the agency. . . ." Section 552a(g)(4) predicates an award of monetary damages for a violation of § 552a(g)(1)(D) on "the court determin[ing] that the agency acted in a manner which was intentional or willful." (Emphasis added). Oja asserts that this reference to "willful[ness]" brings his claim within the exception to the statute of limitations provision, Section 552a(g)(5). That section states, in relevant part, that
An action to enforce any liability created under this section may be brought . . . within two years from the date on which the cause of action arises, except that where an agency has materially and willfully misrepresented any information required under this section to be disclosed to an individual and the information so misrepresented is material to establishment of the liability of the agency to the individual under this section, the action may be brought at any time within two years after discovery by the individual of the misrepresentation.
Id. (emphasis added). Thus, Oja asserts that the statute of limitations for his original Privacy Act claims did not begin to run until October 2001, placing them well within the limitations period.
"The Privacy Act's statute of limitations commences when the person knows or has reason to know of the alleged violation. Because the accrual of the statute of limitations in part turns on what a reasonable person should have known, we review this mixed question of law and fact for clear error." Rose v. United States, 905 F.2d 1257, 1259 (9th Cir. 1990) (internal citations omitted); see also Englerius v. Veterans Admin., 837 F.2d 895, 898 (9th Cir. 1988) ("We join the Seventh, Tenth and District of Columbia Circuits in holding that a cause of action under the Privacy Act does not arise and the statute of limitations does not begin to run until the plaintiff knows or has reason to know of the alleged violation."). To the extent that Oja avers that he was unaware that the USACE intentionally or willfully disclosed his personal information, we find that the record substantiates the magistrate judge's finding that Oja knew or had reason to know in September 2000 that the USACE intentionally posted his information on its Internet site. Indeed, the magistrate judge found that "it would have been unreasonable for [Oja] to believe that the posting was anything but intentional." Accordingly, the magistrate judge concluded that, "[w]hile the court allows for the possibility of an `accidental posting,' the chances of such an unintentional posting occurring are so small that the only reasonable assumption for plaintiff to make when he became aware of the posting was that it was done intentionally." We add to that assessment that the context in which Oja's information was posted compels the inference that the USACE's posting was intentional: As Oja himself notes in his First Amended Complaint, his personal information was posted in conjunction with the USACE's response to a Washington Post article that was critical of the USACE and which referred to Oja's whistle-blowing activities during his tenure with the Alaska District. Moreover, the information the USACE posted on Oja was inconsistent with the Settlement Agreement, as Oja had claimed in his September 2001 Petition for Enforcement before the MSPB. Given the foregoing, there is no error in the magistrate judge's findings or conclusions.
Oja asserted that, "[d]uring the month of November 2000, and continuously until at least November 27, 2000, the defendants posted private information about Mr. Oja on the public portions of the USACE's Internet website. . . . These statements appear to be the Corps' response to the statements in the Washington Post Article."
Oja asserts that § 552a(g)(5) tolled the statute of limitations in his claim until he learned that the USACE admitted that its posting was intentional. Oja's argument incorrectly conflates the context in which the term "willfulness" operates in §§ 552a(g)(4) and (5). Section 552a(g)(4) provides that agency disclosure of personal information must be intentional or willful in order to permit the recovery of monetary damages. As discussed previously, § 552a(g)(5) requires that all claims for actionable agency disclosures be brought within two years of the disclosure unless the agency has materially and willfully misrepresented information that the Privacy Act requires the agency to disclose to an individual, and that misrepresentation is material to establishing the individual's Privacy Act claim. Nowhere in his argument has Oja asserted that the USACE materially or willfully misrepresented information that it was required to disclose to him and that this information was material to Oja bringing his Privacy Act claim; rather, Oja asserts that the USACE failed to inform him in 2000, and he did not learn until October 2001, that the USACE's disclosure was intentional or willful. The USACE may have acted improperly in posting Oja's personal information, but the Privacy Act does not require the USACE to disclose that improper posting to Oja. Moreover, as we have stated, it was clear from the outset that the USACE's disclosures were intentional or willful and that his claim arose when he learned of the disclosures in 2000. Consequently, § 552a(g)(5)'s tolling provisions are entirely inapposite to Oja's claims.
IV. CONCLUSION
We affirm the district court's grant of summary judgment in favor of the Defendants on Oja's First Amended Complaint and the district court's dismissal of Oja's Second Amended Complaint. AFFIRMED.