Doe v. Chao
The Supreme Court ruled that a black lung benefits claimant whose Social Security number was improperly disclosed by the Department of Labor could not collect the Privacy Act's guaranteed $1,000 minimum payment, because he never showed he suffered any actual damages from the disclosure.
The decision resolves a split among the federal appeals courts over how the Privacy Act's damages provision works, holding that the $1,000 minimum is a floor on top of proven harm rather than a stand-alone payout available to anyone affected by a willful violation.
“The statute guarantees $1,000 only to plaintiffs who have suffered some actual damages.”
The Court's core holding on what a Privacy Act plaintiff must show to collect the $1,000 minimum.
How it got here: A federal trial court awarded Doe $1,000; the Fourth Circuit reversed, ruling actual damages were required; the Supreme Court agreed to resolve the resulting circuit split.
The Case in Depth
What happened
Buck Doe applied for black lung benefits through the Department of Labor's Office of Workers' Compensation Programs. The agency used his Social Security number on hearing notices sent to multiple people, including other claimants, employers, and lawyers, disclosing it beyond what the Privacy Act allows. Doe and six other claimants sued the Department, and the government admitted the disclosures violated the Act.
The question before the Court
If a federal agency wrongly discloses someone's Social Security number, does that person automatically get $1,000 in damages, or must they first prove they were actually harmed?
The Court's answer
No — the Court ruled that a person whose Social Security number was wrongly disclosed by a federal agency cannot collect the Privacy Act's $1,000 minimum payment just by showing the disclosure happened and upset them. The statute's text ties the $1,000 guarantee to the same clause that covers "actual damages sustained," so a plaintiff must first show some real, provable harm — even a small one — before the $1,000 floor kicks in.
Doe's only evidence was his own unsupported claims of being "torn to pieces" and "worried" about potential identity theft, with no corroborating proof of any concrete harm. Because he did not meet that threshold, he was not "a person entitled to recovery" under the statute, even though the government admitted its violation was intentional or willful.
Curious how the Court got there? See the step-by-step legal reasoning →
Why it matters
People whose personal information is mishandled by federal agencies now know they cannot collect the Privacy Act's guaranteed $1,000 payment on the strength of anxiety or worry alone — they must show some concrete harm, even a small one like a credit-report fee. This raises the practical bar for suing the government over privacy violations and could reduce the number of successful claims.
What changes now
The Fourth Circuit's ruling against Doe stands, meaning he receives no payment despite the government's admitted Privacy Act violation. The decision settles, for future cases, that plaintiffs must show some actual damages before claiming the $1,000 minimum, resolving a split among the circuits on that specific point. The Court explicitly left open a separate, related question — exactly what kinds of harm count as 'actual damages' — for future cases to resolve.
What this does not decide
The Court expressly did not decide what qualifies as "actual damages" — for example, whether purely emotional distress without any out-of-pocket cost can count. That question, on which lower courts are divided, was left open because it was not raised in Doe's petition.
Concurrences and dissents
Concurrence in part — Justice Scalia
Justice Scalia joined the Court's opinion in full except for one paragraph and a footnote discussing the drafting history of the entitlement-to-recovery phrase, suggesting he did not want to endorse that particular explanation for why Congress kept language referring to a 'person entitled to recovery' after deleting the general-damages provision.
Dissent — Justice Ginsburg
“I think it dubious to insist on such readily created costs as essential to recovery under § 552a(g)(4).”Ginsburg's objection that requiring trivial, easily manufactured expenses as 'actual damages' makes little sense.
Justice Ginsburg argued that anyone who suffers an 'adverse effect,' including emotional distress, from a willful or intentional Privacy Act violation is 'a person entitled to recovery' and should get the $1,000 minimum without separately proving actual damages. She read the statute's text, structure, and history, plus most circuit courts' interpretations and a longstanding agency guideline, as supporting this broader view, and warned that the majority's reading renders the phrase 'entitled to recovery' meaningless.
Dissent — Justice Breyer
Justice Breyer joined Justice Ginsburg's dissent in full and wrote separately to stress that adopting her broader reading would not expose the government to runaway liability, because lower courts have already construed 'intentional or willful' narrowly, akin to a bad-faith standard, limiting recoveries to cases of real government misconduct.
How the Court got there
The legal reasoning, step by step
- The Court read the Privacy Act's damages clause closely, noting it awards 'actual damages sustained' and then guarantees that 'a person entitled to recovery' gets at least $1,000 — reasoning that the $1,000 floor logically refers back to the actual-damages provision just before it, since that is the statute's only provision for recovering money.
- The Court looked to traditional tort law, which normally requires proof of some real harm before someone can recover damages, and found Doe's reading — treating any adverse effect from a willful violation as automatically 'entitled to recovery' — inconsistent with that background principle.
- The Court examined the Act's history: Congress created a study commission to consider whether to allow 'general damages' (harm presumed without proof), and an earlier Senate bill would have allowed such presumed damages, but that language was deleted from the final statute — showing Congress deliberately rejected automatic recovery without proof of harm.
- The Court explained that the 'adverse effect' language in the statute still does meaningful work: it identifies who has suffered enough injury to have standing to sue in the first place, separate from what is needed to actually win money damages.
- Applying this framework, the Court concluded that Doe's own evidence — unsupported claims of being 'torn all to pieces' and 'worried' — did not amount to actual damages, so he could not collect the $1,000 minimum despite the agency's willful violation.