FOIA/Privacy Act as “Adequate Remedy” Bars APA & Mandamus to Compel Unredacted Security-Clearance Files; EO 12,968 Creates No Enforceable Rights

Introduction

In Ryan Baugh v. CENTRAL INTELLIGENCE AGENCY (6th Cir. July 10, 2026), the Sixth Circuit addressed a recurrent records-disclosure strategy: when an applicant receives a security-clearance denial and a redacted investigative file, can the applicant bypass the Freedom of Information Act (FOIA) and the Privacy Act by suing under the Administrative Procedure Act (APA) and the Mandamus Act to compel production of an unredacted file—especially where Executive Order 12,968 and implementing guidance reference FOIA/Privacy Act disclosure standards?

Plaintiff-Appellant Ryan Baugh sought injunctive and mandamus relief compelling the CIA to provide unredacted investigative materials after the Agency denied his clearance based on past controlled-substance use. The district court dismissed for failure to state a claim, and the Sixth Circuit affirmed.

Summary of the Opinion

The court held that Baugh failed to state a claim under both the APA and the Mandamus Act because FOIA and the Privacy Act provide an “other adequate remedy in a court” for the exact relief he sought—production of non-exempt records. The court also emphasized that Executive Order 12,968 and the implementing guidance explicitly create no privately enforceable rights, defeating any attempt to use them as a hook for APA or mandamus relief.

Finally, the court upheld denial of jurisdictional discovery, explaining that jurisdiction at the pleading stage follows from the operative complaint, and discovery cannot be used as a fishing expedition to cure an otherwise claimless case.

Analysis

Precedents Cited

  • Baaghil v. Miller, 1 F.4th 427 (6th Cir. 2021): The panel relied on this decision for the Mandamus Act requirement that a plaintiff must have “no other adequate remedy.” This framed the mandamus analysis as parallel to APA adequacy principles.
  • Rimmer v. Holder, 700 F.3d 246 (6th Cir. 2012): This was the opinion’s central adequacy-of-remedy authority. It supplied both the governing standard (adequacy exists if a statute offers relief of the same genre, not necessarily identical in every respect) and the application: where FOIA/Privacy Act could yield an order to produce the same records, APA/mandamus claims are barred.
  • Bowen v. Massachusetts, 487 U.S. 879 (1988): Cited for the principle that plaintiffs may not use the APA to “duplicate existing procedures for review of agency action.” The court used Bowen to characterize Baugh’s suit as an impermissible end-run around FOIA/Privacy Act.
  • Cincinnati Enquirer v. U.S. Dep't of Justice, 45 F.4th 929 (6th Cir. 2022), and Hanley v. U.S. Dep't of Justice, 623 F.2d 1138 (6th Cir. 1980) (per curiam): Cited to confirm that FOIA and the Privacy Act themselves authorize injunctive relief for wrongful withholding—directly undermining any claim that APA/mandamus was needed to obtain production.
  • Vitarelli v. Seaton, 359 U.S. 535 (1959): The court acknowledged the doctrine that agencies can be bound by self-imposed procedures promising more than statutes require. But it distinguished Vitarelli because EO 12,968 and the cited guidance expressly disclaimed enforceable rights.
  • Tenn. Hosp. Ass'n v. Azar, 908 F.3d 1029 (6th Cir. 2018): Used to classify EO 12,968 (as applied here) as merely reminding parties of existing statutory duties, rather than creating new enforceable obligations.
  • Bard v. Brown County, 970 F.3d 738 (6th Cir. 2020): Applied to reject Baugh’s undeveloped argument that he could not sue under FOIA/Privacy Act until the CIA completed a clearance review. The court treated the point as forfeited due to lack of developed argumentation.
  • Haase v. Sessions, 893 F.2d 370 (D.C. Cir. 1990), and Dettmann v. U.S. Dep't of Justice, 802 F.2d 1472 (D.C. Cir. 1986): Cited for the proposition that FOIA/Privacy Act do not impose the kind of exhaustion requirement Baugh claimed based on the pendency of an agency review process.
  • Martinez v. Pompeo, 977 F.3d 457 (5th Cir. 2020) (per curiam): Used to reject the “too slow” theory of inadequacy. The court adopted the uniform view that a remedy is not inadequate merely because it is procedurally inconvenient.
  • Hohman v. Eadie, 894 F.3d 776 (6th Cir. 2018), and Michaels Bldg. Co. v. Ameritrust Co., 848 F.2d 674 (6th Cir. 1988): These decisions supplied the standard of review and limits for jurisdictional discovery, cautioning against fishing expeditions.
  • Lujan v. Defs. of Wildlife, 504 U.S. 555 (1992): Invoked to show the complaint pleaded the elements of Article III standing—injury, causation, and redressability—supporting jurisdiction without discovery.
  • Royal Canin U.S.A., Inc. v. Wullschleger, 604 U.S. 22 (2025): Quoted for the proposition that at the litigation stage presented, “jurisdiction follows from (and only from) the operative pleading,” reinforcing the denial of jurisdictional discovery.

Legal Reasoning

1) APA and Mandamus are unavailable when FOIA/Privacy Act can provide the same relief

The court treated Baugh’s requested relief as dispositive: he asked the court to compel disclosure of investigative material “to the extent” it is not exempt under FOIA and the Privacy Act. That framing made FOIA/Privacy Act not merely relevant but coextensive with the relief sought.

Under 5 U.S.C. § 704, the APA authorizes review only if “there is no other adequate remedy in a court.” Under the Mandamus Act, the Sixth Circuit similarly requires “no other adequate remedy.” Applying Rimmer v. Holder, the court concluded FOIA/Privacy Act suits could yield “relief identical” (production of non-exempt records), thus foreclosing APA and mandamus.

2) EO 12,968 and implementing guidance do not create enforceable rights—and here merely restate FOIA/Privacy Act standards

Baugh’s substantive theory was that EO 12,968 and internal guidance required fuller disclosure than he received. The court rejected the premise by pointing to the documents’ explicit disclaimers: they “create[] no procedural or substantive rights” enforceable against the United States. That language, in the panel’s view, avoided the Vitarelli v. Seaton scenario in which an agency becomes bound by extra-statutory promises.

The court further emphasized that EO 12,968 (as implemented here) ties disclosure to what would be released under FOIA/Privacy Act. In other words, the order and guidance do not add a free-standing disclosure entitlement; they incorporate existing statutory frameworks.

3) No showing that FOIA/Privacy Act claims must await completion of a security-clearance review

Baugh argued he could not sue under FOIA/Privacy Act until the CIA completed its review process. The court found the argument forfeited under Bard v. Brown County and unsupported by the statutes, citing Haase v. Sessions and Dettmann v. U.S. Dep't of Justice.

4) Delay does not make an otherwise adequate remedy inadequate

The court rejected the claim that FOIA/Privacy Act litigation takes too long to qualify as “adequate,” invoking Martinez v. Pompeo. It also noted the equitable posture: Baugh offered no reason he did not pursue FOIA/Privacy Act years earlier.

5) Jurisdictional discovery was properly denied

Baugh sought jurisdictional discovery based on the CIA’s litigation disclaimer that it did not confirm he named the proper defendant. The Sixth Circuit held there was no abuse of discretion in denying discovery, relying on Hohman v. Eadie and Michaels Bldg. Co. v. Ameritrust Co.. The complaint itself plausibly alleged standing under Lujan v. Defs. of Wildlife, and under Royal Canin U.S.A., Inc. v. Wullschleger, jurisdiction at that stage tracks the operative pleading rather than speculative doubts.

Impact

  • Channeling effect into FOIA/Privacy Act: Plaintiffs seeking unredacted investigative/security-clearance-related records in the Sixth Circuit should expect courts to treat FOIA and the Privacy Act as the exclusive (or at least “adequate”) judicial remedy for disclosure, barring parallel APA and mandamus claims aimed at the same production.
  • Limits on using Executive Order 12,968 as a cause-of-action substitute: The decision reinforces that EO 12,968’s disclosure language, when coupled with its no-rights disclaimer and incorporation of FOIA/Privacy Act, will not support judicially enforceable procedural claims via the APA or mandamus.
  • Procedural discipline: The opinion discourages litigants from recasting FOIA/Privacy Act disputes as APA/mandamus suits to avoid statutory pleading, exhaustion, venue, or timing requirements.
  • Jurisdictional discovery constrained: The court’s handling of the discovery request signals skepticism toward jurisdictional discovery demands that do not identify concrete jurisdictional defects and that appear designed to search for a viable defendant or claim.

Complex Concepts Simplified

  • “Other adequate remedy in a court” (APA § 704): You cannot use the APA to get judicial review if another statute already provides a meaningful way to obtain substantially the same relief. Here, FOIA/Privacy Act already allow a court to order production of wrongfully withheld records.
  • Mandamus (28 U.S.C. § 1361): An extraordinary remedy compelling a federal officer/agency to perform a clear, nondiscretionary duty. It is unavailable if ordinary statutory remedies (like FOIA/Privacy Act suits) could address the problem.
  • FOIA/Privacy Act injunction: Both statutes expressly authorize courts to order agencies to produce records when the agency unlawfully withholds them, subject to exemptions.
  • Executive Order “no-rights” disclaimer: Many executive orders state they do not create enforceable rights for private parties. Courts often treat that language as foreclosing private suits that try to enforce the order as if it were a statute or regulation.
  • Jurisdictional discovery: Limited discovery sometimes permitted to resolve disputed facts necessary to establish jurisdiction. It is not granted merely because a plaintiff has doubts or hopes discovery might reveal a better defendant or a new theory.
  • Standing (injury, causation, redressability): The constitutional minimum for federal jurisdiction. The court found these elements plausibly pleaded from the complaint itself, making discovery unnecessary at that stage.

Conclusion

The Sixth Circuit’s decision establishes a clear practical rule for records-disclosure disputes arising from security-clearance denials: when a plaintiff seeks production of non-exempt records, FOIA and the Privacy Act are an adequate judicial remedy, which bars duplicative APA and mandamus claims. The court also underscores that Executive Order 12,968 and related guidance—especially with express no-rights disclaimers—do not create privately enforceable procedural entitlements. Finally, the opinion reinforces disciplined limits on jurisdictional discovery where the operative complaint itself supports Article III jurisdiction.