Judge says CDC email policy likely violates federal law

A federal judge ruled Friday that the U.S. Centers for Disease Control and Prevention (CDC) has likely been breaking federal law by deleting former employees’ emails soon after they leave the agency.

The ruling was issued by District Judge Rudolph Contreras on a lawsuit filed by Trump-aligned conservative group America First Legal Foundation in April.

Contreras found that the CDC was following a records-retention policy that had not been approved by the National Archives and Records Administration (NARA) and allowed former low-level employee emails to be deleted within about three months of them leaving the agency.

“The court concludes that CDC’s policy and practice of disposing of former employees’ emails ninety days after the end of their employment is likely unlawful,” the 36-page-long opinion reads.

Contreras determined that the CDC and the Department of Health and Human Services (HHS) agreed to abide by the NARA protocol called Capstone, which requires senior officials’ emails to be kept permanently and low-level employee emails to be retained for three to seven years.

The CDC argued in the suit that it did not adopt the full protocol but rather chose to adopt it “in part.”

But Contreras found that the CDC committed to adopting the NARA policy in full noting that “there is nothing in the record that suggests NARA ever approved of an alternate records-disposal schedule.”

“The available evidence suggests that CDC did indeed commit to manage and dispose of its employees’ emails pursuant to the schedule established by GRS 6.1,” the opinion reads.

Under the ruling, the CDC has been ordered to stop deleting or otherwise destroying emails of lower-level employees for at least three years after they leave the agency for the time being.

Contreras also ordered the NARA to work with U.S. Attorney General Merrick Garland to recover and properly preserve prematurely deleted emails of former CDC employees.

A CDC spokesperson did not have immediate comment on the ruling and the HHS did not respond to a request for comment from The Hill.

America First Legal Foundation filed the April lawsuit after it requested records from the CDC last year in regard to the agency’s publication of a document called “LGBTQ Inclusivity in Schools: A Self-Assessment Tool.”

A CDC Freedom of Information Act (FOIA) analyst eventually identified three employees who had worked on publishing the document but that only one of those employees still worked at the agency, according to the opinion.

The FOIA analyst stressed that this was significant to America First Legal Foundation’s request because of the CDC’s practice of deleting former lower-level employees’ emails and email accounts within as little as 30 days after their departure from the agency.

As a result, the analyst told America First Legal Foundation that “potentially response emails belonging to the two former employees would have already been destroyed.”

America First Legal Foundation sent a letter describing the predicament to the HHS office of inspector general out of concern that the agency was “willfully disregarding” its “duties and obligations” under the Federal Records Act eventually challenging their record-keeping practices.