Case 1:19-cv-02367-ABJ Document 30-4 Filed 11/18/19 Page 1 of 8

Strzok v. Barr, No. 1:19-CV-2367-ABJ

Exhibit 3
 Case 1:19-cv-02367-ABJ Document 30-4 Filed 11/18/19 Page 2 of 8

IN THE UNITED STATES DISTRICT COURT

)
PETER P. STRZOK, )
)
Plaintiff, )
) Case No. 1:19-cv-2367-ABJ
v. )
)
ATTORNEY GENERAL WILLIAM F. BARR, )
in his official capacity, et al., )
)
Defendants. )
)
)

DECLARATION OF PETER WINN

I, Peter Winn, hereby declare:

1. I am the Director of the Office of Privacy and Civil Liberties (“OPCL”) at

the United States Department of Justice (“Department” or “DOJ”), and a member of the

Senior Executive Service. Since January 20, 2017, have been the Acting Chief Privacy

and Civil Liberties Officer (“CPCLO”) of the Department, where I report to the Deputy

Attorney General. I have worked at DOJ since 1994, both as an Assistant United States

Attorney and as an Attorney-Advisor at the Office of Legal Counsel. I also served on a

detail as the Acting General Counsel of the Privacy and Civil Liberties Oversight Board,

during its review of the NSA programs that were the subject of the Edward Snowden

disclosures.

2. I have taught privacy law at the University of Washington, Southern

Methodist University, and the University of Melbourne, have published a number of

articles on privacy law and hold certifications as an information privacy professional in

United States government privacy law and domestic privacy law from the International
 Case 1:19-cv-02367-ABJ Document 30-4 Filed 11/18/19 Page 3 of 8

Association of Privacy Professionals. I have worked on issues involving privacy law and

policy at the Department of Justice, with other federal agencies, and with the Rules

Committee of the Judicial Conference of the United States. I obtained my J.D. from

Harvard Law School in 1986, clerked for Judge James B. McMillan, in the Western District

of North Carolina, and worked at private law firms in New York City and Dallas, Texas.

3. Among my responsibilities as the head of OPCL, is to provide authoritative

legal advice and guidance to the Department’s leadership and DOJ components on

questions about the Privacy Act of 1974. I also advise DOJ leadership and the heads of

DOJ components on questions regarding the lawfulness of proposed disclosures under the

Privacy Act. The statements herein are based on my personal knowledge and other

information I acquired while performing my official duties.

4. On December 12, 2017, then-Acting Deputy Attorney General (“ADAG”),

Scott Schools, contacted me, seeking advice on whether disclosure to the news media of

certain text messages exchanged between Peter Strzok and an FBI attorney on a

Department-issued mobile device would be permissible under the Privacy Act and other

Department policies. ADAG Schools provided the relevant messages to me with the

proposed redactions so that I could review them. My advice was limited to the question

whether the proposed disclosure of the texts as redacted would violate the non-disclosure

provisions of the Privacy Act, not whether the disclosure was advisable as a matter of

policy.

5. ADAG Schools informed me that one or more congressional committees

had requested the text messages from the Department and that the Department intended to

provide them to at least some of the requesting members of Congress on December 13,

2
 Case 1:19-cv-02367-ABJ Document 30-4 Filed 11/18/19 Page 4 of 8

2017. He also informed me that the Department’s Office of the Inspector General (“OIG”)

did not object to the disclosure to Congress.

6. Given the politically charged nature of the text messages, it was my

understanding that one or more members of the requesting committee(s) would very likely

disclose them to the public shortly after receiving them from the Department. Accordingly,

according to ADAG Schools, the Department wanted to be as open and transparent with

the public as possible, consistent with the law and established Department policy.

7. Under the Privacy Act of 1974, 5 U.S.C.§ 552a, agencies of the United

States Government are authorized to disclose records contained within a system of records,

among other reasons, for a routine use published in the Federal Register with an

opportunity for interested persons to comment. See id. § 552a(b)(3); see also id.

§ 552a(e)(11).

8. Ordinarily, Department emails and text messages maintained in the

Department’s general archives have not constituted “records” in a “system records” that

would be subject to the Privacy Act. The Office of Management and Budget Guidelines

explain that a system of records exists if: (1) there is an “indexing or retrieval capability

using identifying particulars [that is] built into the system”; and (2) the agency “does, in

fact, retrieve records about individuals by reference to some personal identifier.” OMB

Guidelines, 40 Fed. Reg. 28,948, 28,952 (July 9, 1975). The Guidelines state that the “is

retrieved by” criterion “implies that the grouping of records under the control of an agency

is accessed by the agency by use of a personal identifier; not merely that a capability or

potential for retrieval exists.” Id. This narrow interpretation of “system of records” has

been adopted by courts that have had occasion to address the question. See Kreiger v. U.S.

3
 Case 1:19-cv-02367-ABJ Document 30-4 Filed 11/18/19 Page 5 of 8

Dep’t of Justice, 529 F. Supp. 2d 29, 42 (D.D.C 2008) (stating that email archives were not

a system of records, in part, because the plaintiff “offers no facts suggesting that [the

Department] would have been indexed by name, or that an electronic folder existed that

grouped emails related to [the plaintiff] by name or other identifier”); Minshew v. Donley,

911 F. Supp. 2d 1043, 1071 (D. Nev. 2012) (finding emails about individual as the method

of disclosure and not the source or record of the disclosure); Counce v. Nicholson, No.

3:06cv00171, 2007 WL 1191013, at *15 (M.D. Tenn. Apr. 18, 2007) (concluding that

“email contain[ing] information regarding a potential presentation on bullying that

[plaintiff’s] supervisors directed her to submit for their review” was not a “record”).

9. That said, if the records of these text messages had been copied from the

FBI’s general archives into a “system of records,” for instance into an OIG investigative

file, it is conceivable that they would come under the protection of the Privacy Act, and

could not be disclosed without the consent of the individual involved, absent a routine use

allowing for such a disclosure. I determined that, assuming the text messages at issue came

from a system of records maintained by the OIG, the relevant routine uses would have been

published in the Federal Register as System of Records Notice JUSTICE/OIG-001, “Office

of the Inspector General Investigative Record.” 82 Fed. Reg. 36,725 (July 5, 2007).

10. One of the routine uses within JUSTICE/OIG-001 permits compatible

disclosures “[t]o the news media and the public, including disclosures pursuant to 28 C.F.R.

§ 50.2, unless it is determined that release of the specific information in the context of a

particular case would constitute an unwarranted invasion of personal privacy.” 82 Fed.

Reg. at 36,726.

4
 Case 1:19-cv-02367-ABJ Document 30-4 Filed 11/18/19 Page 6 of 8

11. The Department practice has been to treat the “unwarranted invasion of

personal privacy” limitation in its routine uses, as requiring the same analysis required

under the FOIA’s 552(b)(7)(C) and 552(b)(6) exemptions. That is, the Department would

not disclose records to the public or to news media under this routine use if such a

disclosure “could reasonably be expected to constitute an unwarranted invasion of

privacy.” See 5 U.S.C. § 552(b)(6), (b)(7)(C). This in turn requires balancing the public

interest in the information against the privacy interest of the individual to which the record

pertains, effectively the same balancing test that is required under the privacy provisions

of the FOIA. Id.

12. My analysis was based in part on the leading Supreme Court case in this

area, in which the Court stated that, “[w]hether disclosure of a private document under

Exemption 7(C) is warranted must turn on the nature of the requested document and its

relationship to the basic purpose of the Freedom of Information Act ‘to open agency action

to the light of public scrutiny.’ . . . rather than on the particular purpose for which the

document is being requested.” U.S. Dep’t of Justice v. Reporters Committee for Freedom

of the Press, 489 U.S. 749, 772 (1989). Information that sheds light on an agency’s

performance of its statutory duties falls squarely within that statutory purpose. Id. at 773.

The public interest is at its zenith when based on the information a reasonable person could

conclude that the agency was acting inconsistent with the presumption of legitimacy it

would ordinarily enjoy.

13. Applying that test, and based upon my review of the materials, I considered

it relevant that the text messages were exchanged between two high-ranking FBI officials,

and that the text messages exhibited very strong political opinions about an individual who

5
 Case 1:19-cv-02367-ABJ Document 30-4 Filed 11/18/19 Page 7 of 8

was the subject of an ongoing FBI investigation, an investigation in which both of the

authors of the text messages appeared to be personally involved.

14. Further, the communications between the DOJ employees took place not on

personal devices, but on Department-issued mobile devices, which contained clear banner

warnings that inform users of the lack of any reasonable expectation of privacy. While the

Department permits limited personal use of its equipment, this policy does not exempt

mobile devices from Department monitoring and oversight, and Department employees

receive regular training and notices that any activity and content on Department devices is

subject to monitoring.

15. I felt that the two individuals knew or should have been aware that these

texts would have been subject to review by others in the Department and possibly even the

subject of a FOIA request or disclosed in connection with discovery in a possible criminal

prosecution.

16. In addition, because the public had already become aware of the names of

both individuals, there appeared to be no way to mitigate the invasion of privacy that would

accompany the release of the texts by redacting the individuals’ names. However, the fact

that the Department proposed to redact non-work-related personal information from the

text messages before releasing them to the media reduced the individual’s privacy interests

in the texts. It is also significant that the text messages would be disclosed to Congress—

as is permitted by the Privacy Act, see 5 U.S.C. § 552a(b)(9)—and that Deputy Attorney

General Rosenstein was scheduled to testify publically before Congress the next day where

he was expected to be asked questions about these text messages. Congress, of course,

could have released the text messages itself without creating any Privacy Act implications.

6
 Case 1:19-cv-02367-ABJ Document 30-4 Filed 11/18/19 Page 8 of 8

17. As to the public interest side of the balancing, the texts displayed what a

reasonable person could consider to constitute bias. This in turn risked undermining public

confidence in the objectivity and impartiality of the work of the FBI and the Department,

given that the apparent bias concerned individuals who figured prominently in a criminal

investigation for which the FBI senior officials were responsible. It bears mention that the

appearance of possible bias in this matter also involved the potential exercise of

government power against a citizen. I believed, and continue to believe, that such an

appearance of bias in connection with criminal investigations, was sufficient to shift the

presumption away from protecting personal privacy to one favoring public transparency.

18. Under all the facts and circumstances presented to me at the time, it was my

considered judgment that the public interest outweighed the privacy interest of the two

individuals, and that the Department’s disclosure of the text messages would not violate

the Privacy Act. I advised ADAG Schools accordingly.

I declare under penalty of perjury, pursuant to 28 U.S.C. § 1746, that the foregoing

i?d
is true and correct, to the best of my knowledge and belief.

Dated: November 18, 2019