[00:00:03] Speaker 00:
case number 16 as 5258.

[00:00:07] Speaker 00:
Richard A. Chachakley, appellant versus reps, W. Christian, United States Secretary of State, and his official capacity at L. Ms.

[00:00:14] Speaker 00:
Turner for the amicus cari, Ms.

[00:00:16] Speaker 00:
Merrin for the appellees.

[00:00:18] Speaker 02:
Thank you.

[00:00:20] Speaker 02:
May it please the court, my name is Kendall Turner, and I am arguing as court-appointed amicus in support of appellant Richard Chachakley.

[00:00:27] Speaker 02:
I'd like to reserve two minutes of my time for rebuttal.

[00:00:30] Speaker 02:
Simply put, the defendants cannot rely on the routine use exception to justify broadcasting an individual's social security and driver's license numbers to the general public via the internet.

[00:00:42] Speaker 02:
Such disclosures are anything but routine.

[00:00:44] Speaker 03:
The driver's license was Australian, right?

[00:00:48] Speaker 03:
That's correct.

[00:00:49] Speaker 03:
Does Australia protect the privacy of driver's license numbers?

[00:00:53] Speaker 03:
And if so, where's the allegation to that effect?

[00:00:56] Speaker 03:
For all we know, that's public information.

[00:01:00] Speaker 02:
I don't know about Australian law, Your Honor.

[00:01:02] Speaker 03:
Well, then if, excuse me, the claim fails on that ground alone.

[00:01:08] Speaker 02:
Your Honor, even if you believe that the driver's license number was not protected, the Social Security number certainly should be protected.

[00:01:14] Speaker 03:
Well, that's a different story, focusing on the drivers.

[00:01:19] Speaker 02:
Yes, I don't know about Australian law.

[00:01:22] Speaker 02:
I would be happy to submit a supplemental brief on that matter.

[00:01:25] Speaker 02:
As for the Social Security number, we have been unable to locate and the government has not pointed to any Privacy Act decision upholding broad public disclosure of those numbers.

[00:01:37] Speaker 02:
And that's for good reason.

[00:01:38] Speaker 02:
These identifiers are uniquely sensitive and their public availability renders someone particularly vulnerable to identity fraud, which is exactly what happened here.

[00:01:47] Speaker 02:
On these facts, and given that Mr. Duchaffee filed his complaint pro se, he has adequately pled a violation of the Privacy Act, and we ask that this court reverse the district court's dismissal of his complaint.

[00:02:02] Speaker 02:
As to the routine use exception, which the government relies so heavily on, this cannot fall within that exception for two reasons.

[00:02:12] Speaker 02:
The disclosure was not compatible with the purposes for which the information was collected and it is not consistent with the purposes of the Privacy Act.

[00:02:22] Speaker 02:
This court, as Judge Kavanaugh knows from Ames and Judge Randolph knows from Blood of Harriers, has not resolved the meaning of compatible, and it need not do so here.

[00:02:30] Speaker 02:
Under either definition of that term, whether it's Judge Silverman's view that it has to meaningfully converge with the purpose for which the information was collected, or whether it's Judge Williams's view that there can be simply no conflict between the collection and the disclosure,

[00:02:46] Speaker 02:
the appellant would prevail.

[00:02:48] Speaker 02:
Under the meaningfully converged standard, he would prevail because the general public does not meaningfully require social security numbers to effectuate law enforcement or sanctions enforcement objectives.

[00:03:04] Speaker 04:
Aren't banks part of the general public?

[00:03:07] Speaker 04:
Financial institutions.

[00:03:09] Speaker 02:
Yes.

[00:03:09] Speaker 02:
And we concede that the defendants could disclose Mr. Chackley's social security number to financial and governmental institutions.

[00:03:18] Speaker 02:
My understanding, and it's not in the record, and this is exactly why we would like a remand for factual development, is that agencies within the Treasury Department already routinely send information securely to banks and other financial institutions on a biweekly basis.

[00:03:36] Speaker 02:
And if this court were to adopt Judge Williams' view that there simply can be no conflict between the purpose for which the information was collected and the disclosure, we submit that there is a conflict between the purpose of collection and the purpose of disclosure here because... What's the conflict?

[00:03:54] Speaker 02:
Yes.

[00:03:56] Speaker 02:
Because...

[00:03:57] Speaker 02:
Although the agency has collected the information in order to effectuate the sanctions regime, and it has reports that it has released that information to effectuate the sanctions regime, public availability of social security number actually undermines identification of individuals on that list, because it allows people to impersonate them, and it increases the likelihood that people will conduct transactions in their name, which is exactly what Mr. Tichakoli alleges happened here.

[00:04:24] Speaker 05:
That sounds like a good policy argument, but isn't the government in a better position to know whether what you just said is accurate, whether it's really going to undermine the purposes of the program?

[00:04:38] Speaker 02:
Well, I certainly am not asking you to second-guess the judgment of the agency, but just as a common-sense principle,

[00:04:49] Speaker 02:
individuals don't ask for social security numbers routinely in engaging in small transactions in which financial institutions wouldn't otherwise be involved.

[00:04:59] Speaker 02:
So if I go down to a corner store and I want to buy soda from someone, although I have an obligation not to transact with people on the SDN list,

[00:05:08] Speaker 02:
I'm not going to ask him for a social security number, and if he gave it to me, probably wouldn't give me his real one.

[00:05:14] Speaker 02:
So having social security numbers publicly available simply doesn't further the objective for which the information was collected.

[00:05:21] Speaker 02:
And again, it actually undermines the objective because it allows people to impersonate individuals on this list and engage in transactions which are intended to be barred by the relevant statute.

[00:05:35] Speaker 04:
But given the fact that so many people have the same name, isn't it reasonable to have a social security number on the list because that's a unique identifier?

[00:05:48] Speaker 02:
No, Your Honor.

[00:05:49] Speaker 02:
I mean, we identify people without social security numbers all the time, and while it's true that individuals have the same name, often individuals have the same name, again,

[00:05:58] Speaker 02:
banks are going to be or financial institutions are going to be involved in most transactions and they will have individual social security numbers so they can assure that accounts are not opened in their name or that large scale transactions are not occurring.

[00:06:12] Speaker 02:
And in terms of the sort of smaller cash based transactions

[00:06:16] Speaker 02:
that banks are not involved in, people do not meaningfully use or require social security numbers.

[00:06:22] Speaker 02:
There's no reason why the general public needs that information to effectuate.

[00:06:27] Speaker 04:
What if Mr. Chachakli wants to, you know, become a real estate agent or join the DC bar or become a member of, you know, the treasurer of his homeowners association?

[00:06:44] Speaker 04:
How are they going to, you know, how are those people going to be aware that they're not supposed to transact with him?

[00:06:55] Speaker 02:
Sure, so it might be a little bit case by case, but in the bar circumstance, you know, again, we concede that government institutions could receive a social security number.

[00:07:04] Speaker 04:
The bar isn't a government institution.

[00:07:06] Speaker 04:
The DC bar is.

[00:07:07] Speaker 02:
I guess that's true.

[00:07:10] Speaker 02:
But when I applied for the bar, I had to submit a routine credit check, or I had to submit a credit report.

[00:07:17] Speaker 02:
And your credit report reflects whether or not you are on the SDN list.

[00:07:21] Speaker 02:
There's a OFAC publication that we cite in our brief that specifically makes that point, that anyone can run a credit check or submit a credit check, and it will reflect this status.

[00:07:31] Speaker 02:
Social Security numbers are simply not meaningfully required to effectuate these counterterrorism or law enforcement objectives.

[00:07:40] Speaker 02:
And just before I sit down before rebuttal, I just wanted to note that Tshakri has adequately pled damages on page

[00:07:50] Speaker 02:
48 of the appendix, where he specifically pleads that he lost thousands of dollars to identity thieves.

[00:07:58] Speaker 02:
Also, the statute of limitations does not provide an alternative basis for affirmance because it is not clear from the record that Mr. Tuchakri has not fell within the statute of limitations.

[00:08:09] Speaker 02:
And this court has explained that that is a basis for a term of affirmance only where it's clear from the record.

[00:08:15] Speaker 05:
Thank you.

[00:08:16] Speaker 05:
Thank you.

[00:08:26] Speaker 01:
I'd like to begin with the question of the role of Social Security information in the implementation of OFAC sanctions and the assertion that it undermines the efficacy of the program.

[00:08:41] Speaker 01:
the facts on the ground, both in this case and in other, social security information is used not only to identify those individuals who are properly subject to sanctions, but also importantly to distinguish individuals who are not.

[00:08:54] Speaker 01:
As you mentioned, Judge Wilkins, there are a number of individuals who have similar names, individuals who have many aliases, especially individuals who are subject to this list often have many aliases or many known birth dates, and that information

[00:09:07] Speaker 01:
is not always enough to be able to identify both the proper individual subject to the sanction and also to distinguish individuals who are not.

[00:09:16] Speaker 01:
It is part of OFAC's consideration, and very reasonably so, that this program be targeted in such a way that it is limited only to those individuals properly subject to the sanction.

[00:09:28] Speaker 01:
It is a very significant and burdensome sanction.

[00:09:31] Speaker 01:
It is a prohibition on engaging in any commercial transactions in the United States.

[00:09:36] Speaker 01:
And as a result, the agency has a significant interest in ensuring that it is only applied to those people to whom it is properly

[00:09:44] Speaker 01:
to whom were probably subject to the prohibition.

[00:09:48] Speaker 04:
What was the first system of records notice that said that public disclosure of Social Security numbers would occur?

[00:09:59] Speaker 04:
When was that promulgated?

[00:10:01] Speaker 01:
So the first system of records notice that expressly references the general public is the 2010 disclosure.

[00:10:10] Speaker 01:
the there have been systems of records notice in place long before that, since long before Mr Chachakley's information was published and OFAC has always considered the publication and dissemination of this information as part of the implementation of sanctions to be covered by systems of records notices that are in place.

[00:10:29] Speaker 04:
But how do you square that with our case law about their needing to be explicit in the system of records notice?

[00:10:39] Speaker 01:
I certainly think the language of the system of records notice would cover the dissemination here.

[00:10:43] Speaker 01:
The one that was in place in 2002 references third parties, which would certainly encompass financial institutions, individuals, the public, et cetera.

[00:10:55] Speaker 01:
And I might also put a pin in this and suggest that

[00:10:59] Speaker 01:
Mr. Tichocli did not make this argument below and it's not properly before this court, but OFRAC has always believed that the dissemination of information in this manner was covered by the system of records notice that was in place going back well before the publication of Mr. Tichocli's information in 2005.

[00:11:18] Speaker 04:
But how can that be when the system of records notice doesn't say anything about Social Security numbers?

[00:11:28] Speaker 01:
It does reference personal information, information that would be relevant to holding of assets.

[00:11:35] Speaker 01:
And I think given the use of social security information that is pervasive in the financial world, it is very reasonable for OFAC to consider the inclusion of social security information as covered by that system of records notice.

[00:11:52] Speaker 04:
But I mean, the whole purpose of this is so that the public and others can weigh in when you promulgate that regulation and so that that issue can be debated and aired and the agency can take into consideration people's privacy and other concerns and then potentially amend the regulation or try something on a trial basis, et cetera.

[00:12:18] Speaker 04:
There's lots of things that agencies do in response to public comment.

[00:12:22] Speaker 04:
here, where was the public debate about this issue?

[00:12:27] Speaker 01:
Well, as I said, OFRAC has been disseminating information in this manner since long before.

[00:12:33] Speaker 01:
Mr. Cicciocchi's information has been doing so consistent with the system of records notice at issue at that time and didn't see any suits of similar nature or complaints about the dissemination of information as an impermissible routine use.

[00:12:49] Speaker 01:
So I don't

[00:12:51] Speaker 01:
There hasn't been that kind of discussion even though this has been going on for a long time and certainly is covered by the system of records notice that was at issue in 2010 and we haven't seen objection or debate about it under that system of records notice either.

[00:13:09] Speaker 03:
The Treasury notice in 2005

[00:13:14] Speaker 03:
that you mentioned, and you mentioned that there's an exception or a routine use for disclosure of third parties, but it's for, during the course of an investigation, to the extent necessary to obtain information pertinent to the investigation.

[00:13:33] Speaker 03:
How does that fit here?

[00:13:35] Speaker 01:
OFAC considers these both to be implementations and also ongoing investigations.

[00:13:40] Speaker 01:
They continue to collect information from financial institutions and other kinds of entities about instances in which individuals who are subject to sanction

[00:13:51] Speaker 01:
attempt to engage in transactions in the United States.

[00:13:53] Speaker 01:
They also continue to collect information about individuals subject to sanctions that might speak to the propriety of continuing those sanctions.

[00:14:01] Speaker 01:
So the fact that they're disseminating information to entities that might be transacting or where individuals might be attempting to transact business with those is part of ongoing investigation by the agency and certainly falls within the system of records notice that was published at that time.

[00:14:21] Speaker 01:
And if I may speak just briefly to the assertion that somebody who is buying something at the corner store

[00:14:31] Speaker 01:
doesn't need this kind of information, I would say in response that the information is disseminated much more widely than just financial institutions and government institutions.

[00:14:44] Speaker 01:
It goes to car dealerships, to real estate agents, to employers, to landlords.

[00:14:48] Speaker 01:
And those are the kinds of institutions that are also obligated not to transact

[00:14:53] Speaker 01:
with individuals subject to this list.

[00:14:55] Speaker 01:
And OFAC gets compliance calls from car dealerships all the time.

[00:15:00] Speaker 01:
So it is certainly the case that this information is being used by entities more broadly than just financial institutions in order to implement these kinds of sanctions.

[00:15:10] Speaker 01:
for the purpose of buying something at the corner store.

[00:15:13] Speaker 01:
OFAC issues what are called living licenses, which allow people to engage in low-level transactions, even within the implementation of this kind of program.

[00:15:22] Speaker 04:
But, I mean, you just kind of undermine your argument by saying OFAC gets calls all the time.

[00:15:27] Speaker 04:
I mean, you could serve the same and achieve the same goal by publicizing a list of names

[00:15:38] Speaker 04:
And then on the internet, and then if somebody sees the name and they don't know whether it's the right person, they could then run a credit check or contact OFAC and OFAC could look up in their database and confirm whether it's the same person, right?

[00:15:55] Speaker 01:
It's certainly true that other systems might be workable, but the question before this court is whether this permissible, this is a permissible routine use under the Privacy Act.

[00:16:04] Speaker 01:
And in order to answer that question, we look both to whether it's compatible with the purpose for which the information was collected, which certainly it is in this instance, and second, to whether it's consistent with the purposes of the Privacy Act.

[00:16:16] Speaker 01:
And the purpose of the Privacy Act is not to restrict the disclosure of information to the least intrusive means possible.

[00:16:23] Speaker 01:
The purposes of the Privacy Act are to

[00:16:25] Speaker 01:
uh, routinized the collection, maintenance, and dissemination of personal information by the government.

[00:16:31] Speaker 04:
And there are a number of exceptions within the statute that allow the- So, so the word privacy and privacy act, we should just kind of ignore that?

[00:16:38] Speaker 04:
I'm not sure I understand your argument.

[00:16:40] Speaker 01:
No, Your Honor.

[00:16:41] Speaker 04:
The purpose is just to routinize disclosure?

[00:16:43] Speaker 04:
The purpose- The privacy doesn't have anything to do with what we're talking about?

[00:16:46] Speaker 01:
I might point you to Judge Randolph's dissent in National Association of Letter Characters, in which he discusses that routine uses and disclosure of information are permissible under the Privacy Act when they're justified by a substantial public interest.

[00:17:01] Speaker 01:
And the point is not to prohibit disclosure.

[00:17:03] Speaker 01:
It's to ensure that when the government does disclose information, it has made a consideration of the substantial public interests and the consideration of the privacy interests at stake as well.

[00:17:15] Speaker 01:
In this case, there's a substantial public interest in the disclosure of information, and there's consideration of the fact that this kind of information will further the purposes of the OFAC sanctions program by ensuring that individuals who are properly subject to sanction are identified and also individuals who are not properly subject to sanction are distinguished, because as I said, this is a very burdensome

[00:17:40] Speaker 01:
obligation not to be able to engage in any transact commercial transactions in the United States so the agency does have an interest in ensuring the accuracy of the implementation in the implementation of this program.

[00:17:53] Speaker 04:
What's our standard of review of I guess the scope of the routine use exception?

[00:18:08] Speaker 01:
I would think that what you would be considering is whether the agency has made a reasonable determination that the dissemination of information is compatible with the disclosure.

[00:18:23] Speaker 01:
and considering the substantial public interest at stake and whether the agency appropriately considered the public interest on one side and the privacy interest on the other.

[00:18:35] Speaker 01:
I see my time has expired.

[00:18:38] Speaker 05:
Thank you very much.

[00:18:48] Speaker 02:
To begin,

[00:18:49] Speaker 02:
You know, the government has suggested that any disclosure of information that furthers the identification of someone on the specially designated nationals list is permissible.

[00:18:58] Speaker 02:
But that simply cannot be correct.

[00:19:00] Speaker 02:
I mean, that rationale would allow OFAC to, for example, distribute flyers, or put up posters, or with someone's social security number, or include, for example, their DNA profile or their fingerprint.

[00:19:14] Speaker 02:
And that simply cannot be what compatible means.

[00:19:18] Speaker 02:
And while we don't dispute that the government has important sanctions enforcement and law enforcement prerogatives, this case shows that the current regime simply does not further those prerogatives in a meaningful way.

[00:19:34] Speaker 02:
Rather than preventing individuals on this specially designated nationals list from engaging in transactions,

[00:19:39] Speaker 02:
actually increases the likelihood that transactions in their name will take place with their assets.

[00:19:46] Speaker 02:
That's exactly what Mr. Tichakli has alleged.

[00:19:48] Speaker 05:
But what about the idea that part of the policy here is to prevent innocent people from being ensnared who have the same name?

[00:19:58] Speaker 02:
Yes, but on the other hand, I mean, that is a valid government interest.

[00:20:04] Speaker 02:
On the other hand, you know, OFAC gets calls all the time, and it's not clear that the public availability of Social Security numbers, as opposed to the availability to government institutions and financial institutions, who would be running these sort of identity checks.

[00:20:17] Speaker 05:
Well, what about the point that on your response to your corner store hypothesis, car dealers and landlords and the like are using this information?

[00:20:28] Speaker 02:
Again, it seems unlikely to me that no financial institution is going to be involved in, for example, renting a car or paying your lease or your rental amount, your rent.

[00:20:40] Speaker 02:
There was going to be the rare person who pays those things in cash.

[00:20:44] Speaker 02:
So in general, a financial institution is going to be involved.

[00:20:47] Speaker 02:
And again, when I rented an apartment, I had to submit to a credit check.

[00:20:51] Speaker 02:
Finally, I just wanted to note that this is a pro se complaint, and Mr. DiCiacoli has adequately fled all of the elements of the Privacy Act violation.

[00:21:00] Speaker 05:
Thank you.

[00:21:00] Speaker 05:
Thank you.

[00:21:01] Speaker 05:
Ms.

[00:21:01] Speaker 05:
Turner, you were appointed by the court to assist the court in this case.

[00:21:05] Speaker 05:
You've done an outstanding job in the court.

[00:21:07] Speaker 05:
Thank you.

[00:21:08] Speaker 05:
The case is submitted.