(CN) – Staff members at a prison hospital in Kentucky might be entitled to more than $1,000 each for the breach of privacy that occurred when a federal investigator “inadvertently” left a folder containing their personal information, including addresses and Social Security numbers, on a desk where inmates could see it, the 6th Circuit ruled.
The federal appeals court in Cincinnati upheld a lower court’s determination that the privacy breach had been “willful,” even though the agent’s final act of leaving the folder on a civilian worker’s desk was “inadvertent.”
While investigating unauthorized inmate computer use at a prison hospital’s UNICOR work facility, special investigative agent Walter Clint Jones left behind a green folder containing a roster of all Federal Medical Center employees’ names, addresses, Social Security numbers, home telephone numbers, pay grades and other personal information.
The folder was not marked “Limited Official Use-Sensitive” as required by the federal Bureau of Prisons.
Two inmates later testified that they saw a fellow inmate looking at something on the desk where the folder lay before a staff member found the folder and turned it over to her supervisor.
More than a year later, 106 hospital staff members sued the Bureau of Prisons, the attorney general, and the Lexington Federal Medical Center and its officials, asserting privacy violations and tort claims.
After a 23-day bench trial, the federal district court found that the defendants violated the Privacy Act and awarded $1,000 to all but two plaintiffs, who were able to prove higher damages. The judge also ruled that the folder had been “disclosed” to inmates, despite no direct evidence of disclosure, because the defendants had destroyed the folder.
On appeal, a 2-1 majority of the 6th Circuit largely upheld the lower court’s findings, but ruled that the plaintiffs should have been allowed to seek “lost time” damages over $1,000.
The majority affirmed all but the denial of lost-time damages, which it reversed and remanded.
In the dissenting opinion, Judge Cornelia Kennedy said she disagreed with the majority’s conclusion that “bringing an unlabelled folder containing Plaintiffs’ Privacy Act-protected information into an unsecured workplace rose to the level of ‘intentional or willful’ agency action.”