COUNTY OF NORTHAMPTON OFFICE OF DISTRICT ATTORNEY NORTHAMPTON COUNTY GOVERNMENT CENTER 669 WASHINGTON STREET EASTON, PENNSYLVANIA. 18042-7492 a eee eee Area Code (610) 829-6630 Pee ae Fax (610) 859-3035 February 8, 2017 Philip D. Lauer, Esq. Northampton County Council Solicitor 701 Washington Street Easton PA 18042 Re: Disclosure of the Social Security Number of a Named Former Northampton County Employee Dear Attorney Lauer: Please be advised that a copy of your memorandum dated February 2, 2017 to Northampton County Councilman Hayden Phillips was forwarded to me by Linda Zembo at the request of Councilman Phillips. I assume Councilman Phillips wanted my input as to potential criminal liability regarding this matter.! In that regard, I agree with your research as to the applicability of the various provisions of the federal Privacy Act, the Social Security Act and the case law that you have cited. You cited two sections of the Privacy Act as follows: © SUS.C.A. §552(b) which provides as follows: “No agency shall disclose any record which is contained in a system of records by any means of communication to any person .... except pursuant to a written request by, or with the prior written consent of, the individual to whom the record pertains... ” * [do not address herein any civil liability issues.© SUS.C.A. §552(i)(1) which provides as follows: “Criminal Penalties—Any officer or employee of an agency, who by virtue of his employment or official position, has possession of, or access to, agency records which contain individually identifiable information the disclosure of which is prohibited by this section or by the rules or regulations established thereunder, and who knowing that disclosure of the specific material is so prohibited, willfully discloses the material in_any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000.” It is my opinion based on your research that in order to implicate criminal liability under the aforesaid Privacy Act, the disclosure of the individually identifiable information must be done “willfully.” This opinion is supported by the case law. In the case of Luster v. Vilsack, 667 F.3d 1089 (2011), the United States Court of Appeals for the 10" Circuit specifically held that in order to prevail on a violation under the Privacy Act, a plaintiff must demonstrate that any disclosure of protected information was “willful or intentional.” ‘The court held that mere negligence or reckless transmission of protected information that might have been viewed by an unauthorized individual did not constitute prohibited disclosure under the Privacy Act. In short, the court held that actual willful and intentional disclosure was required for violation of the Act. See also Andrews v. Veterans Administration of the United States, 838 F.2d 418 (1988) It is my understanding that Controller Barron was engaging in a television interview during which the cameraman zoomed in on Mr. Barron’s computer screen. At that time, the screen was displaying a protected document containing the social security number of a former Northampton County employee. It is my understanding that during the broadcast of the interview with Controller Barron, the television station publicly televised Mr. Barron’s computer screen displaying, briefly, the protected information. Assuming those facts to be true, it would appear that Controller Barron did not act in a “willful and/or intentional” manner implicating criminal penalties under the Privacy Act. Although his conduct could be considered negligent, and maybe even reckless, that type of conduct would be insufficient to implicate the criminal penalties of the Privacy Act.You also referenced the following section of the Social Security Act— 42 U.S.C.A. §408(a)(8) which provides as follows: “Whoever... (8) discloses, uses, or compels the disclosure of the social security number of any person violation of the laws of the United States shall be guilty of a felony and upon conviction thereof shall be fined under Title 18 or imprisoned for not more than five years, or both...” ‘This statute is applicable when an unauthorized disclosure is “....in violation of the laws of the United States...” While the Privacy Act provision above speaks to “any record” as defined, the above section of the Social Security Act specifically applies only to the disclosure of a person’s social security number. Regardless of same, criminal liability would generally contemplate a willful, deliberate and/or intentional act. Generally, it is the policy of this office to refer matters to federal law enforcement officials only in situations in which this office has determined that there exists some evidence supporting that a federal criminal law violation may have occurred. Referrals from state prosecutors to federal authorities are taken seriously and, therefore, we do not make referrals lightly. Assuming that the facts are as I understand them to be, we do not believe that there exists a prima facie case that Mr. Barron violated the aforesaid provisions of federal law that would warrant a referral to federal law enforcement. Of course, if you feel otherwise, or if there are facts of which I am not aware of, you would have the absolute right to make any referral yourself. I hope that this sufficiently answers any concerns you ‘or any members of County Council may have. Very truly yours, a A LA Wire John M. Morganelli / District Attorney JMMist a ec: All Members of Northampton County Couneit Linda Zembo, Clerk to Northampton, County Council Stephen Barron, Northampton County Controller John Brown, Northampton County Executive