For a number of years, it has been clear that data collectors face a patchwork of privacy regulations that may give rise to contradictory obligations [1]. A recent case involving the disclosure of private information of student loan borrowers provides one of the first examples of how courts may deal with situations where a data collector has competing obligations related to the same private data.
As a servicer of federal student loans, the Pennsylvania Higher Education Assistance Agency (“PHEAA”) found itself torn between the Connecticut Department of Banking (“Department of Banking”), its state regulator and the United States Department of Education (“Department of Education), its federal regulator and the agency that hired it to service the loans.
Caught Between A Rock And Hard Place…
In what the PHEAA refers to as finding itself “between a rock and a hard place,” the Department of Banking demanded that PHEAA produce all records containing private information of Connecticut residents with federal student loans serviced by the PHEAA. On the other hand, the Department of Education expressly prohibited PHEAA from releasing those same records to the Department of Banking. Consequently, the PHEAA faced the difficult question of whether federal law preempted the conflicting Connecticut law under which the Department of Banking threatened to revoke PHEAA license. Simply, PHEAA was damned if they released the information and damned if they did not release the information.
Questions Related To Preemption Between State And Federal Laws
In addition to its federal guidelines, the PHEAA also serviced student loans under a license issued by the Department of Banking to service student loans in Connecticut. To maintain its license, the PHEAA had to follow Connecticut state law. At some point, PHEAA received a letter from the Department of Banking demanding a review of information related to certain student loans serviced by PHEAA. As part of this review, the Department of Banking requested various documents including a “Student Loan Servicer Management Questionnaire and Information Request” seeking “borrower-specific information, including borrower complaints.” After going back and forth with PHEAA and the Department of Education, the Department of Banking sent PHEAA a letter stating PHEAA’s failure to produce the requested documents “constitute[s] grounds to revoke PHEAA’s student loan servicer license in Connecticut…”
On the federal side, the Department of Education contracts with third-party servicers – like PHEAA – to service “Direct Loans” the Department of Education issues. The Department of Education works to regulate loan servicers through contracts requiring compliance “with federal and Education records management policies, including those policies associated with the safeguarding of records covered by the Privacy Act of 1974.” Upon hearing of the Department of Banking request, the Department of Education provided “an express directive that PHEAA was prohibited under federal law from releasing any data or documentation” that was requested by the Department of Banking.
In response to this overlap in competing laws, the Federal District Court for the Eastern District of Pennsylvania stated the initial question as “What to do?” PHEAA filed an interpleader action entitled Pennsylvania Higher Education Assistance Agency v. Perez, No. 3:18-cv-1114 (MPS) (Sept. 13, 2019). More particularly, PHEAA requested the District Court “to require [the Department of Banking and the Department of Education] to fight out between themselves the issue whether federal law preempts the [Department of Banking’s] document demand—and a declaratory judgment on the preemption issue.” More particularly, PHEAA filed this action seeking interpleader relief under Federal Rule of Civil Procedure 22 and, in the alternative, declaratory relief to determine if the competing state and federal laws preempted each other.
“What To Do?”
The Department of Education filed a motion to dismiss all claims against it. The District Court granted in part (dismissing the interpleader claim) and denied in part the Department of Education’s motion to dismiss (the joinder claims) in what presented a complex procedural analysis despite what seemingly appeared to be a simple question as to what PHEAA should do.
No Answer Under Inter-pleaded Statute
Under the first count in its complaint, the PHEAA seeks relief under Federal Rule of Civil Procedure 22 which provides “Persons with claims that may expose a plaintiff to double or multiple liability may be joined as defendants and required to interplead.” Here, the District Court held Fed. R. Civ. P. provides no relief to the PHEAA because:
“PHEAA faces conflicting demands not from a single obligation, but from multiple obligations. Interpleader is not appropriate where a party “has inconsistent duties to separate parties under two separate, but related, agreements, and may have breached one agreement by complying with duties under the other.”
Based on this reasoning the District Court granted the Department of Education’s motion to dismiss.
An Answer Under The Joinder Statute
The District Court did not leave the PHEAA without any remedy when it found “joinder under Rule 19 [2] provides PHEAA another avenue through which it can obtain the core relief it seeks.” In particular, the District Court found the PHEAA may get the answer it needed through Federal Rule of Civil Procedure 19 which addresses compulsory party joinder in federal district courts. Fed. R. Civ. P. 19 states in relevant part that a party must be joined if “in that person’s absence, the court cannot accord complete relief among existing parties.” First, the District Court found the Department of Education should be joined because it sent “various communications about it directly to PHEAA” concerning the disclosure of information sought by the Department of Banking.” This made it clear that the Department of Education had an interest in the outcome of this litigation.
Next, the District Court held the Department of Education should be joined in order to avoid a situation where “PHEAA [was] subject to a substantial risk of incurring double, multiple, or otherwise inconsistent obligations.” On this point the District Court offered the following reasoning:
…If the state laws under which the [Department of Banking] is seeking documents from PHEAA are found not to be preempted and the Federal Defendants are not made parties, then they may choose to ignore this Court’s judgment on the preemption issue. There would be no obstacle to their bringing a breach-of-contract claim against PHEAA or terminating their contract with PHEAA on the ground that PHEAA had violated federal law by complying with the [Department of Banking’s] document request. If they took these steps, they would put PHEAA “between the proverbial rock and a hard place,” forcing PHEAA to choose between complying with state law in accordance with a non-preemption determination made by this Court and complying with the inconsistent obligation set out in its contract with Education (and possibly an inconsistent judgment in litigation initiated by Education). If they are joined as defendants under Rule 19 [2], then, while a judgment by this Court of non-preemption could not order them to perform, or refrain from performing, any acts, it would bind them for purposes of res judicata, preclude them from bringing a collateral challenge to the judgment, and furnish a preclusion defense to PHEAA in any lawsuit by [the Department of Education] to terminate the contract. Disposing of the action in the Federal Defendants’ absence may thus leave PHEAA subject to a substantial risk of incurring inconsistent obligations.
Based on this reasoning, the District Court denied the Department of Education’s motion to dismiss thereby allowing the PHEAA’s case to proceed beyond the early pleadings stage.
The Development Of This Case Will Provide Insight To Data Collectors
After sifting through the complex procedural issues, the central question before the District Court is what does a data collector do when it faces contradicting state and federal regulations? This problem presented by inconsistent laws will undoubtedly increase as more federal, state, local and industry standards develop regulating the same information held by data collectors. Consequently, the legislators will need to harmonize the laws before the laws are adopted or the courts will need to harmonize the laws after they have been adopted if data collectors face inconsistent guidelines.
Of course, we will continue to monitor this case to see how the court decides the preemption issues.
For more information, contact Tressler attorney Todd Rowe [3] at trowe@tresslerllp.com [4].