Department of Veterans Affairs Medical Center, Charleston, SC and National Association of Government Employees, Local R5-136, 0-AR-3628 and 0-AR-3639, July 17, 2003, 58 FLRA No. 170.

The Authority set aside two awards in which the arbitrators found that the agency violated the Privacy Act by requesting information from the grievants' medical providers without first seeking to obtain the information directly from the grievants. In one case, where the agency requested the information by phone rather than in writing, as required by 20 CFR 10.06, FLRA found that the agency's action didn't amount to a willful and intentional violation of the Privacy Act. In the other case, the award was defective because, given that the record evidence demonstrated that the grievant didn't lose any benefits to which she was entitled, the record didn't support a finding that there was an adverse effect.

Jurisdiction. In both cases the agency claimed that the arbitrators lacked jurisdiction to hear grievances alleging a violation of the Privacy Act, claiming that federal district courts have exclusive jurisdiction over such claims. FLRA disagreed, finding, in the first place, that the Privacy Act is a law "affecting conditions of employment" within the meaning of the § 7103(a)(9)(C)(ii) definition of grievance. (Chairman Cabaniss disagreed, reiterating the view she first expressed in 58 FLRA 270, 272--namely, that the Privacy Act isn't a law affecting conditions of employment.) It also found that although § 552a(g)(1)(D) states that an individual may bring a civil action against an agency and district courts have jurisdiction, there is nothing in this provision saying that district court jurisdiction is exclusive.

AR-3628. In this case the grievant, who had a worker's compensation claim pending, learned that the agency's worker's compensation specialist had contacted her medical providers by phone and obtained information about the grievant's medical condition without her knowledge. The arbitrator rejected the agency's claim that its actions were permitted by 20 CFR 10.506, which allows agencies to contact an employee's medical providers directly in certain circumstances. In his view, contacts made under this provision must be in writing only. He accordingly found the agency had violated the Privacy Act and ordered that the grievant be made whole.

FLRA said that liability is imposed only when the agency violates the Act in a willful or intentional manner and pointed out that "federal courts have found no violation of the Privacy Act where agencies have acted pursuant to regulations or other authority that the agencies justifiably believed authorized their actions." Here, 20 CFR 10.506 permitted the agency to obtain information from the grievant's medical providers, and although the contact was by phone rather than by writing, the grievance didn't allege a violation of 20 CFR 10.506. "Moreover, even assuming, without finding, that the Agency violated § 10.506, that violation would not, in and of itself, amount to a willful and intentional violation of the Privacy Act, where the Agency's action would have been proper had it fully complied with the regulation." FLRA accordingly set aside this award.

AR-3639. In this case the grievant was injured at work and received worker's compensation, which allowed her to be paid for time spent away from work while attending therapy sessions. The agency became suspicious that the grievant had inappropriately requested compensation and contacted the grievant's medical providers on three occasions in order to verify medical appointments. It also requested and received information about the grievant's medical condition.

The arbitrator concluded the agency violated the Privacy Act. He found that the grievant was under a "cloud of suspicion" for requesting reimbursement for therapy sessions she didn't attend. The agency's use of the information could have resulted in an adverse determination about the grievant's rights, benefits, or privileges. He awarded the grievant $1,000 for each of the three violations.

FLRA set aside the award because the record didn't support a finding that the agency's actions caused an adverse effect.

A de novo review of the record evidence demonstrates that the grievant did not lose any benefits to which she was entitled. To the contrary, the record shows that the grievant requested reimbursement for therapy sessions that she did not attend and that the Agency's actions prevented her from receiving benefits to which she was not entitled.

In reviewing these awards FLRA noted that three conditions have to be met in order to obtain relief for violations of the Privacy Act. The grievant must show that "(1) the agency failed to elicit information directly from him or her to the greatest extent practicable; (2) the agency's violation of the Act was intentional or willful; and (3) the agency's action had an adverse effect on the grievant." In the first case, the violation wasn't intentional or willful; in the second, the agency's actions had no adverse effect.