The opinion of the court was delivered by: Henry H. Kennedy, Jr. United States District Judge
Plaintiffs, four transportation security officers employed by the Transportation Security Administration ("TSA") and the unions that represent them, bring this action against defendants TSA, Kip Hawley in his capacity as Administrator of the TSA, the Department of Homeland Security ("DHS"), and Michael Chertoff in his capacity as Secretary of the DHS. Plaintiffs allege that defendants violated the Aviation and Transportation Security Act ("ATSA"), 49 U.S.C. §§ 44901 and 44935, and the Privacy Act, 5 U.S.C. § 552a, by failing to establish appropriate safeguards to insure the security and confidentiality of personnel records.
Before the court is defendants' motion to dismiss [#3]. Upon consideration of the motion, defendants' opposition thereto, and the record of this case, the court concludes that the defendants' motion should be granted in part and denied in part.
On May 3, 2007, TSA discovered that a hard drive was "missing from a controlled area at the TSA Headquarters Office of Human Capital." Compl. ¶¶ 28--29. The hard drive contained personnel data for approximately 100,000 individuals employed by TSA between January 2002 and August 2005, including names, social security numbers, birth dates, payroll information, financial allotments, and bank account and routing information. Compl. ¶¶ 28, 29, 31. On May 4, 2007, Administrator Kip Hawley issued a broadcast email to all TSA employees providing notice of the incident and stating that TSA would provide employees with free credit monitoring for one year free of charge. Id.; Defs.' Mot. Dismiss, Exh. 1 (Decl. of Holmes), Att. 1 at 1 (5/4/2007 TSA Broadcast).*fn1
On May 8, 2007, four TSA security officers ("individual plaintiffs") and their unions ("union plaintiffs") filed this class action complaint,*fn2 alleging that defendants violated ATSA and the Privacy Act by failing to ensure the security of the missing hard drive. In their motion to dismiss, defendants argue (1) ATSA does not provide a private right of action; (2) the union plaintiffs lack standing to bring their Privacy Act claim under both the act and the requirements of associational standing; (3) the individual plaintiffs lack standing because they do not allege a cognizable injury; (4) plaintiffs' Privacy Act claim is unripe; and (5) plaintiffs' allegations are insufficient to state a Privacy Act claim. To these arguments the court now turns.
I. Plaintiffs' ATSA Claim
In response to the events of September 11, 2001, Congress enacted the Aviation and Transportation Security Act, Pub. L. No. 107-71, 115 Stat. 597 (2001), which created TSA and a federal workforce to screen passengers and cargo at commercial airports. 49 U.S.C. § 114. Among other things, ATSA requires the Administrator to "enforce security related regulations and requirements" and "oversee the implementation, and ensure the adequacy, of security measures at airports." §§ 114(f)(7), (11). Plaintiffs claim defendants violated ATSA by "fail[ing] to maintain personnel data from loss consistent with security-related regulations" and by "fail[ing] to ensure the adequacy of security measures at airports resulting in the loss of personnel data." Compl. ¶¶ 45--46.
Defendants move to dismiss plaintiffs' ATSA claim, arguing that the statute does not provide a private cause of action, either express or implied. Plaintiffs admit that ATSA contains no express grant of a private cause of action, but contend that the court should find the act contains an implied cause of action because it "was enacted specifically to create a secure workforce of TSA screeners such as the Plaintiffs" and "protecting screeners' personnel data is vital to the protection of a secure workforce and security at the airports." Pls.' Opp'n to Defs.' Mot. Dismiss ("Opp'n") at 4. Plaintiffs further argue that "[t]here can be no doubt that the Plaintiffs . . . are within the zone of interests created by the ATSA" because "the main purpose of the ATSA was to create this federal, security screening workforce." Id. The court agrees with defendants and finds that ATSA does not provide plaintiffs with a cause of action.
"[P]rivate rights of action to enforce federal law must be created by Congress." Alexander v. Sandoval, 532 U.S. 275, 286 (2001) (citing Touche Ross & Co. v. Redington, 442 U.S. 560, 578 (1979)). "The judicial task is to interpret the statute Congress has passed to determine whether it displays an intent to create not just a private right but also a private remedy." Id. (citing Transamerica Mortgage Advisors, Inc. v. Lewis, 444 U.S. 11, 15 (1979)).The court's analysis "must begin with the language of the statute itself." Touche Ross & Co. v. Redington, 442 U.S. at 568. Absent statutory language that expressly grants a private right of action, the court must determine whether the statute contains an implied right of action. Anderson v. USAir, Inc., 818 F.2d 49, 54 (D.C. Cir. 1987). Four factors are relevant to discerning congressional intent to provide a private remedy:
(1) [W]hether the plaintiff is one of the class for whose benefit the statute was enacted;
(2) whether some indication exists of legislative intent, explicit or implicit, either to create or to deny a private remedy; (3) whether implying a private right of action is consistent with the underlying purposes of the legislative scheme; and (4) whether the cause of action is one traditionally relegated to state law, such that it would be inappropriate for the court to infer a cause of action based solely on federal law.
Tax Analysts v. IRS, 214 F.3d 179, 185-186 (D.C. Cir. 2000) (citing Cort v. Ash, 422 U.S. 66, 78 (1975)). Of the four factors, "the most important consideration is whether the legislature intended to create a private right of action." Dial-A-Car, Inc. v. Transportation, Inc., 132 F.3d 743, 744 (D.C. Cir. 1998).
As to the first factor, the court finds that Congress did not enact ATSA for the special benefit of TSA employees,*fn3 but rather ...