Hasbrouck v. U.S. Customs and Border Protection

Filing 50

ORDER RE CROSS-MOTIONS FOR SUMMARY JUDGMENT. Signed by Judge Richard Seeborg on 1/23/12. (cl, COURT STAFF) (Filed on 1/23/2012)

**E-filed 1/23/12**

1
2
3
4
5
6
7

IN THE UNITED STATES DISTRICT COURT

8

FOR THE NORTHERN DISTRICT OF CALIFORNIA

9

SAN FRANCISCO DIVISION

11
For the Northern District of California

United States District Court

10

12

No. C 10-3793 RS

EDWARD HASBROUCK,

ORDER RE CROSS-MOTIONS FOR
SUMMARY JUDGMENT

Plaintiff,
v.

13
14
15
16

U.S. CUSTOMS AND BORDER
PROTECTION,
Defendant.
____________________________________/

17
18
19

I. INTRODUCTION
These are cross-motions for summary judgment in an action challenging the adequacy of the

20

response of the U.S. Customs and Border Protection (“CBP”) to various Freedom of Information

21

Act (“FOIA”) and Privacy Act requests made by plaintiff Edward Hasbrouck in 2007 and 2009.

22

Hasbrouck requested information about himself contained in various CBP law enforcement

23

databases, information about searching for and retrieving data from those databases, and information

24

about the processing of one of his Privacy Act requests. CBP released certain documents in their

25

entirety, released other documents with redactions, and withheld other documents in their entirety.

26

As set out below, the record establishes that while CBP’s withholding decisions generally are

27

supported by the law and the facts, some issues remain as to the adequacy of its search efforts and

28

the completeness of its production.

II. BACKGROUND

1
2

Plaintiff Hasbrouck is a self-described professional journalist, author, and blogger. He was

3

formerly a travel agent and asserts he is recognized as an expert on numerous travel-related issues.

4

Hasbrouck serves as a consultant on travel-related issues to the Identity Project, a non-profit

5

organization that provides advice, assistance, publicity, and legal defense to those who believe their

6

rights have been infringed, or their legitimate activities curtailed, by demands for identification.

7

This action arises from four requests for disclosure of information that Hasbrouck made to

8

the CBP. First, Hasbrouck made a Privacy Act request to the CBP Office of Field Operations in

9

2007 for copies of all information relating to himself “contained in the system of records established
for the Automated Targeting System (“ATS”),” as described in the System of Records Notice

11
For the Northern District of California

United States District Court

10

(“SORN”). He also filed an administrative appeal related to this request.

12

In October of 2009, Hasbrouck submitted a second Privacy Act request to CBP in which he

13

both renewed his earlier request for ATS records, and additionally sought copies of all information

14

about himself from these additional systems of records: Advance Passenger Information System

15

(APIS); Border Crossing Information System (BCIS); and U.S. Customs and Border Protection

16

TECS. He included a request for all Passenger Name Record (PNR) and Interagency Border

17

Inspection System (IBIS) data, regardless of where it was located, as well as all information about

18

him referenced in the “Categories of Records in the System” section of the SORN, and an

19

accounting of all disclosures of any of these records. He filed an appeal when he received no

20

response.

21

On the same date in October of 2009 , Hasbrouck made a separate request under FOIA and

22

the Privacy Act seeking copies of any and all documents and records created by CBP or other

23

agencies in the course of processing of his 2007 Privacy Act request and appeal. An appeal again

24

followed when he received no response.

25

Finally, on the same date, Hasbrouck made another separate request under FOIA for copies

26

of any and all documents and records describing the search systems and methods, indexing, query

27

formats and options, data fields and formatting, and the numbers or other identifying particulars by

28

which PNR or other data can be retrieved from ATS, APIS, BCIS, ADIS, and TECS. Specifically,

2

1

he asked for “[A]ny user manuals, training manuals or materials, reference manuals, query format

2

guides, search protocols or instructions, interpretation guides, standard operating procedures,

3

contract specifications, software use cases or other functional or technical specifications,

4

Application Programming Interface (API) specifications and formats for any software or systems

5

which contain, process, or interact with these records, and the contents of any online or electronic

6

help or reference system for any of these systems.” Once again, an administrative appeal resulted

7

when he received no response.

8
9

After this action was filed, the parties engaged in meet and confer negotiations, which they
report were successful in narrowing the scope of their disputes to some degree. They brought these
cross-motions seeking resolution of the remaining issues. As reflected by the briefing, however,

11
For the Northern District of California

United States District Court

10

some of the disputes continued to evolve, and at the hearing the parties acknowledged that further

12

meet and confer may be appropriate in some instances. This order, therefore will provide resolution

13

as to those issues on which the parties have clearly reached impasse, but will direct them to engage

14

in further discussions to resolve any disputes that may not be fully disposed of herein.

15
III. DISCUSSION

16
17

A. Privacy Act exemptions

18

Hasbrouck contends that CBP is improperly relying on regulatory exemptions adopted in

19

2010 to withhold materials that would otherwise be responsive to his Privacy Act requests made in

20

2007 and 2009. In the context of exemptions to disclosure under FOIA, the rule is clear that

21

exemptions in effect by the time of any lawsuit are a sufficient basis to preclude disclosure, even if

22

enacted after the request in dispute was made. See Southwest Center. for Biological Diversity v.

23

Dep’t of Agriculture, 314 F.3d 1060, 1061 (9th Cir. 2002).

24

As explained in Southwest Center, “[t]here are many situations in which ‘a court should

25

apply the law in effect at the time it renders its decision.’” Id. (quoting Landgraf v. USI Film

26

Products, 511 U.S. 244, 273 (1994)). Applying present law will only be characterized as having

27

“retroactive” effect where doing so “would impair rights a party possessed when he acted, increase a

28

party’s liability for past conduct, or impose new duties with respect to transactions already

3

1

completed.” Landgraf, 511 U.S. at 280. Although a party requesting information under FOIA prior

2

to the enactment of an applicable exemption arguably has a “right” to that information that is

3

“impaired” by the subsequent adoption of the exemption, Southwest Center makes clear there is no

4

objectionable “retroactive effect,” because the party cannot show prejudicial reliance on the prior

5

state of the law. See Southwest Center, 314 F.3d at 1062 (“the ‘action’ of the Center was merely to

6

request or sue for information; it was not to take a position in reliance upon existing law that would

7

prejudice the Center when that law was changed.”); see also Center for Biological Diversity v. U.S.

8

Dept. of Agriculture, 626 F.3d 1113, 1117-18 (9th Cir. 2010) (following Southwest Center and

9

further explaining that there is no retroactive effect where plaintiff is seeking the prospective relief

11
For the Northern District of California

United States District Court

10

of an order compelling disclosure of information).
Hasbrouck argues that Southwest Center is not controlling here because the Privacy Act

12

serves different purposes than FOIA. See Flowers v. Exec. Office of the President, 142 F. Supp. 2d

13

38, 42 (D.D.C. 2001) (“the purposes of the Privacy Act and the FOIA are quite different: the FOIA

14

was enacted to provide citizens with better access to government records, while the Privacy Act was

15

adopted to safeguard individuals against invasions of their privacy.”). As a result, Hasbrouck

16

contends, he had a “vested” and private interest in reviewing information about himself maintained

17

by the CBP that is materially different than the public interest rights asserted by the plaintiff in

18

Southwest Center. In a similar vein, Hasbrouck insists that, unlike the Southwest Center plaintiff, he

19

can show he prejudicially relied on the former state of the law, in that he would have avoided

20

disclosing information that might end up in the possession of the CBP had he known that he would

21

subsequently be precluded from reviewing CBP records to safeguard his privacy rights.

22

Both these arguments, however, prove too much. Hasbrouck has not argued, and could not

23

reasonably do so, that exemptions promulgated in 2010 would not apply to any request he might

24

make today. Yet the same previously-collected information would fall within the scope of the

25

exemptions and could properly be withheld from any materials produced in response to a new

26

request. This highlights the observation in Biological Diversity that “retroactivity” simply is not

27

implicated, because plaintiff’s claim in essence seeks prospective injunctive relief—an order

28

requiring CBP to turn over information now. As such, this is one of the many circumstances in

4

1

which “a court should apply the law in effect at the time it renders its decision,” notwithstanding the

2

happenstance that Hasbrouck made his Privacy Act requests before the current exemptions were

3

promulgated.

4

Finally, Hasbrouck also argues that analysis under Landgraf is inappropriate here without

5

first addressing the “threshold question” of whether the CBP has statutory authority to engage in

6

“retroactive rulemaking” in the first instance. See Bowen v. Georgetown Univ. Hosp., 488 U.S. 204,

7

208 (1988) (“In determining the validity of the Secretary’s retroactive cost-limit rule, the threshold

8

question is whether the Medicare Act authorizes retroactive rulemaking.”). Hasbrouck’s reliance on

9

Bowen is misplaced. In that case, there was no dispute that the regulation at issue, as applied by the
agency, had a retroactive effect. See 488 U.S. at 207 (“In effect, the Secretary had promulgated a

11
For the Northern District of California

United States District Court

10

rule retroactively, and the net result was as if the original rule had never been set aside.”) The only

12

question was whether the agency had the power to adopt a retroactive rule. See id. at 209 (“The

13

Secretary contends that the Medicare Act provides the necessary authority to promulgate retroactive

14

cost-limit rules . . . .”)

15

Here, in contrast, the question is not whether CBP might have the authority to adopt a

16

retroactive regulation, but whether applying the exemptions promulgated in 2010 to this case can be

17

characterized under Landgraf as a “retroactive” application of the regulations. For the reasons

18

explained above, it cannot. Accordingly, CBP’s potential statutory authority to adopt truly

19

retroactive regulations—or its lack thereof—is simply irrelevant to the analysis.1 CBP therefore is

20

entitled to rely on exemptions promulgated after the dates on which Hasbrouck made his Privacy

21

Act requests.

22
23
24
25
26
27
28

1

Southwest Center introduces the term “impermissible retroactive effect,” which arguably implies
that the FOIA exemption it was considering was “retroactive,” just not impermissibly so. In
context, however, it is clear that Southwest Center found it permissible to apply the recently-enacted
FOIA exemption to the case before it because doing so could not be characterized as “retroactive”
under Landgraf. See Landgraf, at 511 U.S. at 269 (“A statute does not operate ‘retrospectively’
merely because it is applied in a case arising from conduct antedating the statute’s enactment.”)

5

1

B. “Personal identifiers”

2

Hasbrouck contends that he has a right both under the Privacy Act and FOIA to disclosure of

3

the list of “personal” or “unique” identifiers by which data can be retrieved from an individual’s

4

ATS, APIS, BCIS, ADIS, and TECS records. CBP publicly discloses that records can be searched

5

by an individual’s name and address, but does not list what other “personal” or “unique” identifiers

6

it maintains. Hasbrouck speculates that the list likely includes such identifiers as birthdates,

7

passport numbers, credit card numbers, telephone numbers, and the like.

8
9

As seemingly innocuous as such a list might appear to be at first blush, CBP asserts that it is
entitled to withhold such information pursuant to FOIA Exemption 7(E), 5 U.S.C.§ 552(b)(7)(E).
That exemption permits withholding of records or information compiled for law enforcement

11
For the Northern District of California

United States District Court

10

purposes that would “disclose techniques and procedures for law enforcement investigations or

12

prosecutions, or would disclose guidelines for law enforcement investigations or prosecutions if

13

such disclosure could reasonably be expected to risk circumvention of the law.” Perhaps because

14

the scope of the parties’ dispute did not crystallize until late in the briefing process, neither side

15

provided focused argument on how disclosure of merely the list of personal or unique identifiers

16

would or would not impact law enforcement investigations or prosecutions. Nevertheless, CBP’s

17

showing as to the applicability of Exemption 7(E) to broader aspects of Hasbrouck’s requests is

18

sufficient to establish that even the list of identifiers has been properly withheld.

19

While it may be of little consequence to law enforcement efforts to disclose that CBP can

20

retrieve information based on obvious identifiers such as birthdates, passport numbers, or similar

21

data, it manifestly would implicate security concerns to disclose that CBP also tracks one or more

22

non-obvious identifier, or for it to admit that it cannot retrieve information except by obvious

23

identifiers. Accordingly, CBP need not provide the list of identifiers Hasbrouck is seeking.

24
25
26
27
28

6

1

C. Adequacy of search efforts
1. Software specifications

2
3

Hasbrouck asserts that he seeks information regarding the software used with CBP’s

4

databases so that he can determine what “personal identifiers” may be used to retrieve information.

5

In light of the conclusion of the preceding section, CBP need not respond further to this category.
2. Search parameters

6
7

CBP has not shown why it would be unreasonable, unduly burdensome, or otherwise

8

inappropriate to require it to conduct electronic searches for responsive information with variant

9

spellings of Hasbrouck’s name, as specified in his requests. While it may be true that Hasbrouck
would be unlikely to misspell his own name, it is plausible that it would not always be entered into

11
For the Northern District of California

United States District Court

10

data sources correctly. Accordingly, CBP shall run searches using the parameters requested by

12

Hasbrouck, and produce any non-cumulative results that are not subject to withholding on some

13

other basis.

14

3. “Search logs,” “Significant Activity Reports,” correspondence, and other
materials

15
16

CBP contends that Hasbrouck’s remaining complaints as to the adequacy of its search efforts

17

or production relate to materials either that simply do not exist, or as to which Hasbrouck has not

18

adequately explained what he is looking for. CBP acknowledges, however, that in at least some

19

instances it could provide further information, either in meet and confer negotiations, or by

20

declaration that would more fully explain why it believes no further documents need be produced.

21

At the hearing, CBP also admitted that it contends certain documents are not only non-responsive to

22

the requests, but also exempt from disclosure. To the extent CBP intends to rely on exemptions,

23

even in the alternative, it should supplement its Vaughn index.

24

The current record does not permit a conclusive determination as to exactly what remains in

25

actual dispute. CBP, of course, cannot be compelled to produce materials that do not exist, and at

26

some point its declarations so stating must be accepted, even if Hasbrouck believes additional

27

materials should exist. Accordingly, the parties are hereby directed to engage in further meet and

28

confer discussions to clarify, and potentially resolve, any disputes that may remain between them.

7

IV. CONCLUSION

1
2

CBP’s motion is granted to the extent that the rulings set forth above relieve it of producing

3

particular further items or categories of information. Conversely, Hasbrouck’s motion is granted to

4

the extent this order requires CBP to engage in further searches and the production of any resulting

5

information. The motions are otherwise denied without prejudice. The parties shall engage in

6

further meet and confer discussions to address their remaining disputes. Within 60 days of the date

7

of this order the parties shall submit a joint report setting out:

8
9

11
For the Northern District of California

United States District Court

10

12

1. Any issues that are ripe for further adjudication by the Court as to the respective rights
and obligations of the parties.
2. The status of any issues which the parties are continuing to discuss, or which cannot be
fully resolved pending possible further responses from CBP to Hasbrouck’s requests.
3. The parties’ joint or separate proposals for a procedure and schedule for bringing this

13

litigation to final resolution, including their views as to whether a judgment will be necessary and

14

the form any judgment should take.

15
16
17

IT IS SO ORDERED.

18

Dated: 1/23/12

19

RICHARD SEEBORG
UNITED STATES DISTRICT JUDGE

20
21
22
23
24
25
26
27
28

8