ORDER AND JUDGMENT
PAUL J. KELLY, JR., Circuit Judge.
Rolf Erik Carlson used to have a security clearance through the Department of Energy (the Department). The Department's personnel security file on him is at the center of this case. After losing his clearance, Carlson asked the Department to add documents to the file and to investigate information already in the file. The Department refused. Carlson then sued under the Privacy Act of 1974, seeking damages and an order requiring the Department to comply with his requests. The district court dismissed the claims, and Carlson appeals. We have jurisdiction under 28 U.S.C. § 1291. We affirm.
Carlson lost his security clearance about a decade ago, and he later obtained a copy of his personnel security file from the Department. In his view, the file contained inaccurate and incomplete records, so he sought to amend it through four requests under the Privacy Act. Each of these four requests had two parts: one part asked the Department to add a document to his file; the other inquired whether the file was accurate or complete in light of the document he wished to add. For example, one request sought to add a document with information about a medical prescription and inquired whether a statement in his file from the prescribing doctor was accurate. The Department consolidated Carlson's four requests and denied them.
Carlson appealed to the Department's Office of Hearings and Appeals. Although the Office of Hearings and Appeals disagreed with the reasoning behind the initial denial, it nevertheless concluded that the denial was proper. In denying the appeal, it decided that the disputed information in the file was no longer relevant because there was not a pending investigation involving Carlson and that "the challenged information cannot unfairly result in a determination adverse to Dr. Carlson because Dr. Carlson would have an opportunity to refute the information if the security clearance investigation ever resumed." R. at 73.
Carlson then filed this lawsuit, alleging that the Department violated the Privacy Act by denying his requests. He sought damages and an order forcing the Department to amend and investigate his file. The district court dismissed the claims for damages under Federal Rule of Civil Procedure 12(b)(6) for failure to state a claim.
After Carlson filed an amended complaint, the Department moved to dismiss the remaining claim as moot. The Department submitted an affidavit declaring that the four documents that Carlson wished to add to his security file had actually been in the file since July 2015, the same month the Office of Hearings and Appeals denied his appeal.
Carlson challenges the dismissal of his claims for damages and for injunctive relief. Because he represents himself, we construe his filings liberally. See Hall v. Bellmon, 935 F.2d 1106, 1110 (10th Cir. 1991). We review de novo the dismissals under Rules 12(b)(1) and 12(b)(6). Smith v. Plati, 258 F.3d 1167, 1174 (10th Cir. 2001).
A. The Privacy Act
An agency that maintains a system of records must permit individuals to request amendments to records pertaining to them. 5 U.S.C. § 552a(d)(2). In response to such a request, the agency must either correct the challenged part of the record or inform the individual that it has refused the request.
The Privacy Act also authorizes damages in two scenarios, both requiring a showing that the agency acted intentionally or willfully. § 552a(g)(4). First, damages are available if the agency intentionally or willfully "fails to maintain any record concerning any individual with such accuracy, relevance, timeliness, and completeness as is necessary to assure fairness in any determination . . . that may be made on the basis of such record, and consequently a determination is made which is adverse to the individual." §§ 552a(g)(1)(C), (g)(4). Second, damages are available if the agency intentionally or willfully fails to comply with any other provision of § 552a or a rule promulgated under it "in such a way as to have an adverse effect on an individual." §§ 552a(g)(1)(D), (g)(4).
B. Carlson's Claims for Damages
"To survive a Rule 12(b)(6) motion to dismiss, a plaintiff's complaint must allege sufficient facts `to state a claim to relief that is plausible on its face.'" Strauss v. Angie's List, Inc., 951 F.3d 1263, 1266 (10th Cir. 2020) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)). A claim is facially plausible if the complaint pleads facts that allow a "court to draw the reasonable inference that the defendant is liable for the misconduct alleged." Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). "Threadbare recitals of the elements of a cause of action, supported by mere conclusory statements, do not suffice." Id. To evaluate a Rule 12(b)(6) motion, courts accept as true all well-pleaded factual allegations and view them in the light most favorable to the plaintiff. Smith v. United States, 561 F.3d 1090, 1098 (10th Cir. 2009).
The district court dismissed Carlson's claims for damages under Rule 12(b)(6), concluding that he failed to present facts alleging that the Department acted in an intentional or willful manner.
The district court's ruling was correct. Conduct qualifies as intentional or willful under the Privacy Act if it is "so patently egregious and unlawful that anyone undertaking the conduct should have known it unlawful," if it is "committed without grounds for believing it to be lawful," or if it flagrantly disregards "others' rights under the Act." Andrews v. Veterans Admin. of U.S., 838 F.2d 418, 425 (10th Cir. 1988) (internal quotation marks omitted). Carlson's complaint merely disputes the reasoning that the Department used to deny his requests; it does not allege facts that could show the Department willfully or intentionally violated the Privacy Act.
Indeed, Carlson himself does not argue that his complaint sufficiently supports his claims for damages. He instead argues that support for the claims can be found in a different document—a document he refers to as a "crime tip." Several months after filing his complaint, Carlson filed the crime tip along with an ex parte motion to file it under seal. The ex parte motion claimed that the crime tip had been submitted to the Department of Justice, but it expressly asked the district court to withhold the crime tip from the Department of Energy. The district court denied the motion, but for reasons unclear to us, the crime tip has apparently remained sealed in the district court, visible only to Carlson and the court.
To the extent Carlson contends that the district court should have considered allegations in the crime tip to assess the sufficiency of his complaint, we reject that argument. "Generally, the sufficiency of a complaint must rest on its contents alone." Gee v. Pacheco, 627 F.3d 1178, 1186 (10th Cir. 2010). This general rule has limited exceptions: a court may also consider documents the complaint incorporates by reference; documents referenced in the complaint and central to the claims, provided the parties do not dispute the documents' authenticity; and matters subject to judicial notice. Id. The crime tip does not fit any of these exceptions.
We do not consider Carlson's related argument that the district court should have granted his motion for relief from judgment under Federal Rule of Civil Procedure 60(b)(1), in which he argued that allegations in the crime tip showed that the Department intentionally or willfully violated the Privacy Act. Carlson's opening brief mentions in its statement of the case that the district court denied his Rule 60(b)(1) motion, but it does not challenge the court's analysis. Only in his reply brief does Carlson argue against the court's Rule 60(b)(1) order, and we will not consider arguments that first appear in his reply brief, see Wheeler v. Comm'r, 521 F.3d 1289, 1291 (10th Cir. 2008).
C. Carlson's Claim for Injunctive Relief
The district court dismissed Carlson's claim for injunctive relief, apparently believing that the only remaining relief he sought was an order forcing the Department to add the four new documents to his file. Because the documents had been added to the file, the court concluded, Carlson's claim was moot. But as Carlson argues, and the Department concedes, he requested additional relief—an order forcing the Department to investigate information in his file that may conflict with the four new documents. The court therefore erred when it found that Carlson had received all the remaining relief he sought.
The Department argues that we should nevertheless affirm the dismissal for a reason that the district court did not rely on. The Department's Privacy Act regulations allow an individual to request corrections or amendments to information about that individual in the Department's records. 10 C.F.R. § 1008.6(a)(3). But there are limits on inquiries about the accuracy or completeness of information in the records: "If the information is to be used by the [Department] in making a determination about the individual," a request for correction or amendment may include inquiries about "whether the information is as accurate, relevant, timely, or complete as is reasonably necessary to assure fairness in the determination." § 1008.6(a)(3)(ii). The Department argues that Carlson does not (indeed, cannot) claim that any information in his file "is to be used" in making a determination about him, because the only determination Carlson mentions occurred many years ago when he lost his security clearance. For that reason, the Department says, Carlson fails to state a claim that would allow the court to order the investigations he seeks.
We have discretion to affirm on any ground that the record sufficiently supports. Elkins v. Comfort, 392 F.3d 1159, 1162 (10th Cir. 2004). Several factors bear on whether we should exercise that discretion: whether the parties fully briefed and argued the issue here and in the district court, whether the parties had a fair opportunity to develop the factual record, and whether our decision would depend only on questions of law. Id. Carlson has addressed the Department's alternative argument in his reply brief, and he does not offer any reason why we should not address the argument in the first instance. In addition, the alternative argument does not involve any disputed facts and raises only a question of law. For these reasons, we exercise our discretion to address the argument.
The Department is correct that Carlson's amended complaint failed to state a claim that could entitle him to an order forcing the Department to investigate the accuracy or completeness of information in his file. An individual may only request accuracy or completeness inquiries about information that "is to be used" to make a determination about the individual. § 1008.6(a)(3)(ii). This provision plainly limits accuracy or completeness inquiries to information that will be used in an ongoing or future determination; it leaves no room for Carlson's argument that it authorizes such inquiries into information used only in a past determination. Carlson's amended complaint mentions only a determination that occurred many years ago, so he did not allege facts that could support a request for inquiries into the accuracy or completeness of information in his file. We therefore affirm the dismissal of his claim for injunctive relief.
The judgment is affirmed.