The DHS can’t exempt itself from the civil remedies provided by the Privacy Act for people who are harmed by government violations of the law, according to a decision announced today by the 6th Circuit Court of Appeals in Cincinnati in the case of Shearson v. Department of Homeland Security.

The case was brought by Julia Shearson, Executive Director of the Cleveland chapter of the Council on American-Islamic Relations (CAIR). The incident that led to the case is described in today’s court opinion as follows:

Shearson and her four-year-old daughter, United States citizens by birth and Muslims, returned by car from a weekend in Canada at around 8:30 p.m. on January 8, 2006, via the Peace Bridge in the Buffalo, New York/Fort Erie area. On scanning their United States passports, the CBP computer flashed “ARMED AND DANGEROUS,” and CBP agents asked Shearson to turn over her car keys and step out of the car. Shearson was handcuffed, and, after several hours of questioning in the terminal, she and her daughter were released without explanation. As they left, Shearson inquired whether her vehicle had been searched and was told no search had been conducted. This proved to be false; Shearson’s vehicle had been searched and was damaged in the course of the search. After Shearson wrote several Ohio congressional representatives, who in turn contacted the CBP, the CBP advised the legislators that its agents had acted “in response to what later proved to be a false computer alert.”

The DHS admitted that they had improperly flagged her as a “suspected terrorist” in the (illegal) travel records system that later came to be known as the “Automated Targeting System,” but refused to say why or on the basis of what, if any evidence or allegation against her they did so. Five years later, she’s still trying to find out why — other than working for CAIR — she was labeled in ATS as a “suspected terrorist” to be arrested at gunpoint, separated from her child, and held in handcuffs.

Shearson brought suit against the DHS under the Privacy Act for, among other violations, improperly maintaining records of her religious and other activities protected by the First Amendment, failure to maintain accurate records, improper disclosure of the erroneous records about her, and refusal to show her their files about her.  She filed and argued the case pro se for several years, although Gadeir Abbas (then a law student and now a staff attorney with CAIR) and David Wolfe Leopold (now the president of AILA, the American Immigration Lawyers), later assisted in the case, and attorney Kurt Hunt represented Ms. Shearson in the appeal to the 6th Circuit Court of Appeals.

In response to the lawsuit, CBP (U.S. Customs and Border Protection, a division of DHS), argued that they had exempted themselves from any liability related to ATS for under the provisions of the Privacy Act for civil remedies. Such overbroad self-exemption claims have been a common technique of the DHS to shield itself from acountability to the courts for its actions, even when they infringe citizens’ rights.

As Shearson’s attorney in the 6th Circuit appeal, Kurt Hunt, described the ruling, it means that, “A citizen can sue the government for breaching mandatory provisions of the Privacy Act (for example: improperly maintaining records of First Amendment activity), and the government cannot simply pass a rule to ‘exempt’ itself from potential civil liability for violating those mandatory provisions. In short, it makes it possible for a citizen to actually enforce the Privacy Act in a civil action.”

Hunt notes that, “The circuits are currently split about this question, and the split appears to be widening. Because this was the first 6th Circuit decision to address civil remedies exemptions, today’s ruling will have national implications. We hope the Sixth Circuit’s decision will be the start of a trend of decisions putting the “teeth” back into the Privacy Act.”

Now that DHS’s attempt at self-exemption has been overturned by the Court of Appeals, Shearson’s case has now been remanded for further action on her claims for violation of the Privacy Act and her rights.

We don’t yet know whether similar claims of total self-exemption from  liability to civil remedies will be asserted by CBP in our own case, Hasbrouck v. CBP, which so far as we know is the only other case to have been brought under the Privacy Act and related to Automated Targeting System records.