Wired News reports on a class-action lawsuit filed concerning a 2006 data security breach tied to the Department of Veterans Affairs. In May 2006, an unencrypted laptop and hard drive containing sensitive data on 26.5 million current military personnel, veterans, and their spouses were stolen from a Veterans Affairs’ employee’s home.
The 11th U.S. Circuit Court of Appeals, in largely dismissing a class-action, ruled Wednesday that the veterans could recoup at least $1,000 under the Privacy Act if they could show financial damages, not mental anguish.
What’s more, the Atlanta-based court noted that the veterans — some already suffering post-traumatic stress syndrome from their Vietnam War days – likely could recover damages for mental anguish associated with the data breach if the lawsuit was before a different court.
That’s because the courts of appeal across the nation have issued conflicting interpretations of the Privacy Act of 1974, which allows people to sue the government for privacy breaches and recover “actual damages.” Precedent in the 11th Circuit, which includes Alabama, Florida and Georgia, interprets “actual damages” as money losses only. […]
The 11th Circuit noted (.pdf) that the 5th U.S. Circuit Court of Appeals and the 10th U.S. Circuit Court of Appeals “do not restrict ‘actual damages’ under the Privacy Act to pecuniary losses.” And the Supreme Court has refused to resolve the circuit splits.