2nd Circuit Skepticism Seen on Lack of FirstNet PIA
NEW YORK -- One 2nd U.S. Circuit Court of Appeals judge seemed to struggle Tuesday with the idea AT&T, as a contractor working on behalf of the U.S. government as it runs the FirstNet national public safety broadband network (NPSBN), has no obligation to follow mandates on federal agencies such as privacy impact assessments (PIA). In oral argument as VTDigger appeals a lower court's dismissal of its Commerce Department litigation (see 1807300058) on FirstNet responsiveness to Freedom of Information Act requests and its lack of PIA, the appellate court also questioned the reasoning federal agencies gave for not looking for information requested in the FOIAs.
Sign up for a free preview to unlock the rest of this article
Timely, relevant coverage of court proceedings and agency rulings involving tariffs, classification, valuation, origin and antidumping and countervailing duties. Each day, Trade Law Daily subscribers receive a daily headline email, in-depth PDF edition and access to all relevant documents via our trade law source document library and website.
Under questioning by Judge Susan Carney about obligations on contractors, DOJ lawyer Laura Myron, representing the defendant Commerce Department, said the government generally can't contract around obligations like PIA. Here, the lawyer said, the government is responsible only for contracting FirstNet deployment and maintenance and won't access the information transmitted across the system, with that data to be encrypted.
Judge Raymond Lohier pressed Myron on the NTIA FOIA answer that says it didn't do searches for requested data because it wasn't involved in the FirstNet contract, asking her for an analysis of why that's reason enough not to do a search. Myron said Commerce was reasonable in its responses because the information demands included documents to which Commerce didn't have access. She said AT&T has no statutory obligation to provide NTIA and Commerce the sought-after documents, and the FOIAs asked for documents within agency possession. When asked by Lohier whether an agency should have to do a search for requested documents if it's possible the agency would have them, Myron readily agreed.
It's entirely possible a search by NTIA might not turn up any such documents, but for the agency to say it's futile to even look "is a very high bar in the law," said plaintiffs' lawyer Kel McClanahan of National Security Counselors. Judge John Walker asked if an agency has a substantial reason to think a search will turn up nothing, why isn't that sufficient justification. Replied McClanahan, if there's good reason to think such searches would turn up nothing, it wasn't reflected in the record. He suggested the case could be remanded to the lower court with the requirement federal agencies make a more-thorough justification for not doing a search.
Lohier and McClanahan went back and forth about what statutory standard there is for assessing the adequacy of agency statements that a data request isn't likely to be fruitful. Is an NTIA statement that it has nothing to do with AT&T and FirstNet enough, Lohier asked. McClanahan responded that NTIA never asserted that.
Allowing an agency to operate "entirely in the dark ... is not the way our government is set up," McClanahan said. He said Congress never intended to exempt entire agencies from FOIA. AT&T acknowledges there's not an exemption from judicial review, he said.
A PIA is a privacy protection that's supposed to be built into a government action from the start, McClanahan said. But part of the lower court summary judgment decision in favor of Commerce was based on the NPSBN not even being operational yet, McClanahan said, noting it's still not clear if it's nonoperational.
Myron said the network's operability isn't relevant, with the lower court ruling on a standing issue. She said the plaintiffs haven't shown concrete injury to privacy. Carney asked what mechanisms are in place to enforce agency conforming to PIA requirements. Myron said the collection of information taking place under the FirstNet program is being done by a private third party -- AT&T -- and Commerce has no obligation to do a PIA because it's not the one collecting the information.