TATEL, Circuit Judge:

In this case, three federal prisoners allege that the Federal Bureau of Prisons maintained a secret file of photographs of inmates and their visitors in violation of several provisions of the Privacy Act, as well as the federal statute that created the Inmate Trust Fund. The district court granted summary judgment to the government on all counts. We affirm with respect to one of the Privacy Act claims. Because we find that genuine issues of material fact preclude summary judgment on all remaining claims, we reverse and remand for further proceedings consistent with this opinion.

I.

The Federal Bureau of Prisons (BOP) permits individual institutions to operate the "Inmate Photography Program," giving inmates the opportunity to have photographs taken with their visitors. Inmates pay a one dollar fee into the Inmate Trust Fund for each picture. The fund consists of money spent by inmates nationwide at prison commissaries and on other Trust Fund programs. The Fund pays for cameras, film, processing, and administrative costs associated with the Inmate Photography Program. BOP regulations allow prisons to offer inmates duplicate prints provided that doing so does not increase processing costs. Because developing services often offer free "double prints," most BOP institutions gave inmates (at the time of the events leading to this case) the second print.

Appellants, federal prison inmates Keith Maydak, Gregory Smith, and Paul Lee, noticed that several prisons were giving inmates only single photographs. An envelope obtained by Lee from a photo developer revealed that although BOP actually received double prints, inmates never received the second copy. At several of the institutions in which appellants were incarcerated, BOP officials acknowledged that they did in fact develop and keep duplicate photographs. For example, officials at the McKean and Ray Brook federal correctional institutions (FCI) explained that duplicates of inmate-purchased photographs were given to the Special Investigative Supervisor's (SIS) office, which reviewed them for "investigative or informative value." Roy Decl. ¶¶ 7, 9 (McKean); Cross Decl. ¶¶ 6, 8 (Ray Brook). Photos having such value were "added to, and retained in, active investigation case files"; remaining duplicates were "stored in a box for approximately six (6) months and then destroyed." Roy Decl. ¶ 9; accord Cross Decl. ¶¶ 8-9. At the Beckley and Cumberland federal correctional institutions, officials reviewed inmate-purchased photos for "gang-related activity." Painter Decl. ¶ 3 (Beckley); Alvarado Decl. ¶ 6 (Cumberland). At Beckley, "[i]f a photo showed gang-related activities, a scanned copy was made and displayed in the SIS office for a short period of time, then it was shredded." Painter Decl. ¶ 3. At Cumberland, such photographs were "scanned into the computer and maintained in the SIS Office." Alvarado Decl. ¶ 7. An official at the Lewisburg penitentiary declared that the institution never developed duplicate photographs. See Hoekman Decl. ¶ 4. Instead, SIS reviewed "the single `print' to ensure that no one in the photograph made an obscene gesture, and to ensure that nothing in the photograph pose[d] a threat to institution safety or security." Id. ¶ 6. In addition, Beckley and McKean officials acknowledged that on a few occasions, inmate trust funds had been used to develop duplicate prints that, instead of being given to inmates, were used or retained by BOP. See Clifton Decl. ¶ 3 (Beckley); Fitch Decl. ¶¶ 4-5 (McKean).

Proceeding pro se, appellants filed suit in the U.S. District Court for the District of Columbia alleging (among other things) that BOP's maintenance of what they call the "Secret Squirrel Photo File" violated the Privacy Act of 1974. See Pub.L. No. 93-579, § 3, 88 Stat. 1897 (1974) (codified at 5 U.S.C. § 552a (2000)). They also alleged that by using the second print for investigative purposes, BOP violated 31 U.S.C. § 1321 (2000), the statute that created the Inmate Trust Fund (formally known as the Commissary Fund). The district court initially dismissed the complaint for failure to state a claim. See Maydak v. United States, No. 97-2199 (D.D.C. Mar. 31, 1999). On appeal, this court vacated the dismissal of the Privacy Act and Inmate Trust Fund claims and remanded for further proceedings. See Maydak v. United States, No. 99-5187, 1999 WL 1006593, at *1 (D.C. Cir. Oct. 27, 1999). Acting on the basis of declarations submitted by BOP officials at several of the institutions at issue in this case — Beckley, Cumberland, Lewisburg, McKean, and Ray Brook — the district court on remand granted summary judgment to the government. See Maydak v. United States, No. 97-2199, slip op. at 11-12 (D.D.C. May 4, 2001) ( Maydak I); Maydak v. United States, No. 97-2199, slip op. at 4-5 (D.D.C. Mar. 22, 2002) ( Maydak II).

Appellants filed a notice of appeal, and we appointed Bruce V. Spiva as amicus curiae to present arguments on their behalf. We review the grant of summary judgment de novo, applying the same standards as the district court. Tao v. Freeh, 27 F.3d 635, 638 (D.C. Cir. 1994). Summary judgment may be granted only "where there are no genuine issues of material fact, and all inferences must be viewed in a light most favorable to the non-moving party." Id. (citing Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 250, 255, 106 S.Ct. 2505, 2511, 2513-14, 91 L.Ed.2d 202 (1986)). We consider appellants' Privacy Act claims in part II, their Trust Fund claim in part III, and several unrelated claims in an unpublished judgment issued herewith.

II.

"[I]n order to protect the privacy of individuals identified in information systems maintained by federal agencies," the Privacy Act regulates "the collection, maintenance, use, and dissemination of information by such agencies." Privacy Act, § 2(a)(5), 88 Stat. 1896. "The Act gives agencies detailed instructions for managing their records and provides for various sorts of civil relief to individuals aggrieved by failures on the Government's part to comply with the requirements." Doe v. Chao, ___ U.S. ___, ___, 124 S.Ct. 1204, 1207, 157 L.Ed.2d 1122 (2004).

The Privacy Act imposes a series of substantive and procedural obligations on federal agencies that maintain what is known as a "system of records." A system of records is "a group of any records under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual." 5 U.S.C. § 552a(a)(5). A "record" is "any item, collection, or grouping of information about an individual that is maintained by an agency . . . that contains his name, or the identifying number, symbol, or other identifying particular assigned to the individual, such as a finger or voice print or a photograph." Id. § 552a(a)(4). "Maintain" means "maintain, collect, use, or disseminate." Id. § 552a(a)(3).

Appellants claim that BOP's maintenance of the so-called Secret Squirrel Photo File violates Privacy Act subsections 552a, (e)(4), (e)(9), (e)(11), and (r). These provisions require agencies to establish rules of conduct for employees who develop or maintain systems of records and to report certain information regarding those systems. Appellants also allege that the photo file violates subsections 552a(e)(1), (e)(2), (e)(3), (e)(7), and (e)(10), which regulate the collection and maintenance of the records themselves.

The district court concluded that none of the cited Privacy Act provisions applied to BOP's photo file because the institutions at which appellants were incarcerated did not maintain the photographs in a system of records. As we explain below, however, under the law of this circuit, incorporation of a record into a system of records is not required to trigger subsection 552a(e)(7). With respect to the other alleged Privacy Act violations, we believe that contested issues of material fact as to whether BOP facilities actually maintained photographs in a system of records precluded summary judgment.

Subsection 552a(e)(7)

Subsection 552a(e)(7) provides that any agency maintaining a system of records shall "maintain no record describing how any individual exercises rights guaranteed by the First Amendment unless expressly authorized by statute or by the individual about whom the record is maintained or unless pertinent to and within the scope of an authorized law enforcement activity." 5 U.S.C. § 552a(e)(7). In Albright v. United States, 631 F.2d 915 (D.C. Cir. 1980), we held that an agency that maintains any system of records is prohibited from maintaining a record of an individual's First Amendment activity "even if [that record] is not subsequently incorporated into the agency's system of records." Id. at 916-17. "[T]he Act clearly prohibits even the mere collection of such a record, independent of the agency's maintenance, use, or dissemination" of the record thereafter. Id. at 918. To interpret the statute otherwise, we explained, would be "inconsistent with the plain meaning of the language of the Act." Id.

Contrary to the district court's conclusion, then, whether appellants have a viable subsection 552a(e)(7) claim turns not on whether the photographs were maintained in a system of records, but on whether they "describ[e] how [an] individual exercises rights guaranteed by the First Amendment." 5 U.S.C. § 552a(e)(7). If they do, BOP should not have maintained the photographs "unless pertinent to and within the scope of an authorized law enforcement activity," as BOP does not claim that maintaining the photographs was "authorized by statute or by the individual about whom the record is maintained." Id.

We think it obvious that photographs of prisoners visiting with family, friends, and associates depict the exercise of associational rights protected by the First Amendment — provided, of course, that such rights survive incarceration. Although the very fact of incarceration necessarily curtails associational rights, see Overton v. Bazzetta, 539 U.S. 126, ___, 123 S.Ct. 2162, 2167, 156 L.Ed.2d 162 (2003), the Supreme Court has never held that inmates have no right to association. In Overton v. Bazzetta, the Court stated, "[w]e do not hold, and we do not imply, that any right to intimate association is altogether terminated by incarceration or is always irrelevant to claims made by prisoners." Id. Instead of "attempt[ing] to explore or define the asserted right of association . . . or determine the extent to which it survives incarceration," the Court implicitly assumed that the right existed and upheld prison regulations limiting that putative right as constitutionally justified under the circumstances. See id.; see also Pell v. Procunier, 417 U.S. 817, 822, 94 S.Ct. 2800, 2804, 41 L.Ed.2d 495 (1974). We too find it unnecessary to consider whether the photographs at issue in this case depict inmates exercising First Amendment rights because, at least in some respects, BOP has shown that its maintenance of the photographs was "pertinent to . . . an authorized law enforcement activity."

Although the Privacy Act does not define "law enforcement activity," we have interpreted the phrase broadly. See Nagel v. U.S. Dep't of Health, Educ. Welfare, 725 F.2d 1438, 1441 n. 3 (D.C. Cir. 1984) (indicating that the phrase includes an authorized criminal, intelligence, or administrative investigation); J. Roderick MacArthur Found. Lindblom v. FBI, 102 F.3d 600, 603 (D.C. Cir. 1996) (holding that valid law enforcement activities require neither an active investigation nor a "current law enforcement necessity"). Citing declarations of several prison officials, BOP argues that its actions fall within subsection 552a(e)(7)'s law enforcement exception because "the SIS office at the various institutions reviewed the photos for threats to institution safety or security, for any gang-related activity, for investigative or informative value, or for other conduct." Appellees' Br. at 30. Because BOP has responsibility for preserving prison security, we have no doubt that examining photographs for conduct that may threaten that security is pertinent to and within the scope of an authorized law enforcement activity. Nor have we any doubt that reviewing inmate photographs for gang-related activity and obscene conduct also falls within that exception.

If BOP were reviewing the photographs for these purposes only, we could easily affirm the grant of summary judgment with respect to subsection 552a(e)(7). Based on BOP's declarations, however, it appears that some prisons may have reviewed and collected the photographs for other purposes as well. According to officials from McKean and Ray Brook, those institutions reviewed photographs for "investigative or informative value." See Roy Decl. ¶ 9 (McKean); Cross Decl. ¶ 8 (Ray Brook). Neither official, however, explained what these terms mean. Does investigative value relate to suspected criminal activity? What is the limit to informative value? Although "authorized law enforcement activity" obviously has a broad meaning in the prison context, unless we require greater specificity BOP could easily evade subsection 552a(e)(7) simply by invoking a need to maintain records for generic investigative and informative purposes. We will therefore remand this issue for the district court to determine, on the basis of a fuller record, whether McKean's and Ray Brook's review of photographs was consistent with an "authorized law enforcement activity."

Other Privacy Act Subsections

Unlike subsections 552a, (e)(4), (e)(9), (e)(11), and (r), which impose obligations on the maintenance of systems of records, subsections (e)(1), (e)(2), (e)(3), and (e)(10) apply to the records themselves. These provisions state that:

Each agency that maintains a system of records shall —

(1) maintain in its records only such information . . . as is relevant and necessary to accomplish a purpose of the agency . . .;

(2) collect information to the greatest extent practicable directly from the subject individual . . .;

(3) inform each individual whom it asks to supply information . . . [of] the [agency's] authority . . .; the principal purpose . . . for which the information is intended to be used; the routine uses which may be made of the information . . .; [and] the effects . . . of not providing . . . the requested information; . . . [and]

(10) establish appropriate administrative, technical, and physical safeguards to insure the security and confidentiality of records. . . .

5 U.S.C. § 552a(e)(1)-(3), (10).

Amicus urges us to extend Albright to these subsections, arguing that like subsection 552a(e)(7), they apply to records not incorporated into a system of records. In considering this argument, we do not write on a clean slate, for the Office of Management and Budget has issued "Privacy Act Guidelines" to which we owe deference. See Henke v. U.S. Dep't of Commerce, 83 F.3d 1453, 1461 n. 12 (D.C. Cir. 1996) (giving the OMB Privacy Act Guidelines "the deference usually accorded interpretation of a statute by the agency charged with its administration" (quoting Albright, 631 F.2d at 920 n. 5)); see also Privacy Act, § 6 ("The Office of Management and Budget shall . . . develop guidelines and regulations for the use of agencies in implementing the provisions of section 552a. . . ."). According to those Guidelines, the requirements contained in the interrelated subsections (e)(1), (2), and (3), as well as (e)(10), are triggered only if the records are actually incorporated into a system of records. See Office of Management and Budget Privacy Act Implementation: Guidelines and Responsibilities, 40 Fed. Reg. 28,948, 28,960-66 (July 9, 1975). With respect to subsection 552a(e)(1), for example, the Guidelines instruct each agency to identify the specific legal provision that authorizes an agency activity " with respect to each system of records which it maintains or proposes to maintain." Id. at 28,960 (emphasis added). Agencies may not maintain merely "useful" information, but must "review the nature of the information which they maintain in their systems of records to assure that it is, in fact, `relevant and necessary.'" Id. (emphasis added). With respect to subsection 552a(e)(2), the Guidelines explain: "The practical effect of this provision is to require that information collected for inclusion in any system of records . . . should be obtained directly from the individual whenever practicable." Id. at 28,961 (emphasis added). The Guidelines' discussion of subsection 552a(e)(3) also assumes a system of records, see id. at 28,962, as does their discussion regarding subsection 552a(e)(10): administrative, technical, and physical safeguards must be "tailored to the requirements of each system of records," id. at 28,966 (emphasis added).

Reaching a different conclusion as to subsection 552a(e)(7), Albright focused on "Congress'[s] own special concern for the protection of First Amendment rights." 631 F.2d at 919. As Albright explains, the Privacy Act's legislative history reveals the "preferred status which the Committee intends managers of information technology to accord to information touching areas protected by the First Amendment [to] the Constitution." Id. (quoting S.REP. No. 93-1183, at 56 (1974), reprinted in 1974 U.S.C.C.A.N. 6916, 6971) (internal quotation marks omitted). Albright also discusses the virtual "flat prohibition" against collecting any record of an individual's First Amendment activity, observing that the "mere inquiry of government into an individual's exercise of First Amendment rights" can intrude on that individual's privacy even if the record is not incorporated in a system of records. Id. Albright's recognition of congressional concern for the "unwarranted collection of information as a distinct harm in and of itself" refers specifically to the legislative history regarding subsection 552a(e)(7). Id. (citing S.REP. No. 93-1183, at 57, reprinted in 1974 U.S.C.C.A.N. at 6971-72). Finally, Albright points out that the OMB Guidelines explain that subsection 552a(e)(7) "establishes an even more rigorous standard governing the maintenance of records regarding the exercise of First Amendment rights." 631 F.2d at 919 n. 5 (quoting 40 Fed.Reg. at 28,965) (internal quotation marks omitted).

In contrast, none of the other subsections that appellants invoke involves First Amendment concerns. Moreover, if these other 552a(e) subsections trigger Privacy Act requirements even when the records at issue are not maintained in a system of records, agencies may be liable for Privacy Act violations simply by collecting records that they immediately discard after finding the records neither relevant nor necessary. Cf. Henke, 83 F.3d at 1461 (expressing concern that if retrieval capability creates a system of records, an agency may be "found retrospectively to be maintaining a system of records it did not even know existed, simply by dint of a potential use it neither engaged in nor contemplated"). So at least in comparison to the other subsections at issue, subsection 552a(e)(7) proves the exception rather than the rule.

Contrary to the government's argument, however, the fact that these other subsections apply only when records are maintained in a system of records does not end our task, for we believe that a genuine issue of material fact remains as to whether BOP's photo file in fact constitutes a system of records. Recall that a system of records is "a group of any records . . . from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual." 5 U.S.C. § 552a(a)(5) (emphasis added). The term "record" includes "any item . . . about an individual . . . that contains his name, or the identifying number, symbol, or other identifying particular assigned to the individual, such as a finger or voice print or a photograph." Id. § 552a(a)(4) (emphasis added). Under the Act's plain language, then, a "system of records" may be a group of any records retrieved by an identifying particular such as a photograph. In other words, the personal identifier may be the photograph itself.

In asserting that the prisons at issue here maintained no such system of records, BOP officials failed to appreciate this point. They assumed that because the photographs were organized neither by name nor individually assigned number, they were not organized by personal identifier. For instance, the McKean SIS declared that duplicate photos with "investigative or informative value" were retained in investigation case files and other duplicates were "stored in a box for approximately six (6) months and then destroyed." Roy Decl. ¶ 9. Yet the SIS also claimed that "[n]one of the photographs . . . reviewed by the SIS office . . . [were] retrievable by an individual inmate as they [were] not filed by any personal identifier." Id. ¶ 10. As amicus quite properly asks, "What purpose would it serve to keep photographs that BOP investigators have purportedly determined have some significant importance to the security of the institution in a filing system from which they could not be retrieved by individual?" Amicus Br. at 12 n. 4. "Presumably," amicus points out, "one of the primary reasons for keeping such a system is to enable the SIS to track and prevent unlawful activities by individuals whose photographs provide valuable information to do that." Id. Nor is it clear from the record why McKean officials retained for six months duplicate photographs having no investigative value. Although practices vary by prison, the Ray Brook declaration, which is very similar to the McKean declaration, suggests one such purpose: "to identify possible associates or accomplices of an inmate suspected of, or charged with, committing prohibited acts at FCI Ray Brook." Cross Decl. ¶ 9. This indicates that the duplicate photographs stored in a box were retrievable by personal identifier — the photograph itself — for how else could SIS staff have identified a particular inmate's associates or accomplices if not by the photograph?

The government argues that even if the photographs were retrievable by personal identifier, the photograph file would not constitute a system of records if the photos were not actually retrieved by personal identifier. The government is correct. In Henke, we held that "retrieval capability is not sufficient to create a system of records"; the agency must in practice retrieve information by personal identifier. 83 F.3d at 1460-61. Although incidental or ad hoc retrieval by personal identifier does not convert a group of records into a system of records, where an agency compiles information about individuals for investigatory purposes, "Privacy Act concerns are at their zenith, and if there is evidence of even a few retrievals of information keyed to [personal identifiers], it may well be the case that the agency is maintaining a system of records." Id. at 1461.

On the record before us, it seems clear that at least one institution, Ray Brook, retrieved photographs by personal identifier. With respect to the other institutions, because the declarations rested on a flawed understanding of personal identifier, they cannot support the grant of summary judgment. We will thus remand for the district court to determine whether the prisons' compilation of photos constitutes a system of records. In considering this issue, the district court should take into account "the entirety of the situation, including the agency's function, the purpose for which the information was gathered, and the agency's actual retrieval practices and policies." Id.

In reaching this conclusion, we recognize that the district court did not consider the Ray Brook declaration. According to the district court, appellants lacked standing to challenge alleged Privacy Act violations at Ray Brook because it was "undisputed that Ray Brook did not retain photographs of any of the [appellants]." Maydak I, No. 97-2199, slip op. at 7 n. 4. We think the record is not so clear. Ray Brook's Special Investigative Supervisor declared: "I am aware of no inmate purchased photographs of [appellants] being maintained in any SIS file at FCI Ray Brook." Cross Decl. ¶ 10 (emphasis added). As amicus points out, that declaration was executed in February 2001, and the key statement is phrased in the present tense. Under Ray Brook's practice, any photographs of appellants taken more than six months earlier would not have been maintained at the time of the declaration. Moreover, because Ray Brook retained the "duplicate copy of the inmate purchased photographs," it would not have maintained the actual "inmate purchased photographs" in any SIS file. Thus, the declaration cannot support a finding that Ray Brook never maintained, collected, or used photographs of appellants. On remand, the district court will need to consider the Privacy Act claims related to Ray Brook.

Other Privacy Act Considerations

We conclude with a few loose ends. First, the district court disposed of appellants' subsection 552a(b) claim on grounds unrelated to whether BOP maintained a system of records. Although that subsection prohibits agencies from disclosing records to any person or to another agency "except pursuant to a written request by, or with the prior written consent of, the individual to whom the record pertains," 5 U.S.C. § 552a(b), it expressly permits disclosure of records to agency employees "who have a need for the record in the performance of their duties," id. § 552a(b)(1). Because appellants offer no reason to think that there is anything inappropriate about disclosing photographs to BOP officials so that they can decide whether to release them to inmates, we will affirm the grant of summary judgment on this issue.

Second, BOP argues that even if appellants have viable Privacy Act claims, they may not obtain damages because they have failed to show that any violations were "intentional or willful." See 5 U.S.C. § 552a(g)(4) (establishing that in a suit against an agency for failure to comply with specified Privacy Act provisions, the court must determine that the agency behaved intentionally or willfully before awarding damages). Because this issue is a question of fact entirely undeveloped in the record, however, it provides no basis for summary judgment at this time. Moreover, should the question of damages arise on remand, that issue will be controlled by Doe v. Chao, in which the Supreme Court held (following oral argument in this case) that plaintiffs seeking monetary relief under the Privacy Act must show actual damages. See 124 S.Ct. at 1212.

Finally, the record sheds little light on whether the district court properly declined to consider asserted Privacy Act violations at the Cumberland and Allenwood facilities. The district court found that Maydak was the only appellant confined at Cumberland and that because Cumberland officials claim that they never maintained photographs of Maydak, he had no standing to challenge the alleged Privacy Act violations there. Maydak I, No. 97-2199, slip op. at 7 n. 4. In their opposition to the government's motion for summary judgment and in their brief to this court, however, appellants allege that Lee also was incarcerated at Cumberland, see Appellants' Br. at 30 (citing Lee Decl. ¶ 17), though it is not at all clear whether he was at Cumberland at times relevant to this litigation. With respect to Allenwood, the district court found that appellants lacked standing because "none . . . appear[s] to have been confined [there] before the filing of the lawsuit or the amended complaint." Maydak I, No. 97-2199, slip op. at 7 n. 4. Yet the amended complaint appears to show an Allenwood address for Lee. We will leave these two issues for the district court to sort out on remand.

III.

This brings us to appellants' trust fund claim. Section 1321(b)(1) requires BOP to operate the Inmate Trust Fund "in compliance with the terms of the trust." 31 U.S.C. § 1321(b)(1). As the Sixth Circuit has explained, trust funds may be used "for any purpose accruing to the benefit of the inmate body, as a whole, such as amusements, education, library, or general welfare work." Washington v. Reno, 35 F.3d 1093, 1096 (6th Cir. 1994) (quoting Department of Justice Circular 2244, Rules Governing the Control of Prisoners['] Funds at the Several Penal and Correctional Institutions (1932)) (internal quotation marks omitted); see also Federal Bureau of Prisons, U.S. Department of Justice, Program Statement 4500.04: Trust Fund/Warehouse/Laundry Manual, ch. 4504 (1999). BOP may not use trust fund proceeds to fund security programs because doing so would deplete funds intended for the benefit of inmates. Washington, 35 F.3d at 1102. But see 18 U.S.C. § 4043 note (2000) (giving BOP permission to use the Inmate Trust Fund for specified Inmate Telephone System expenditures, even if security-related).

Appellants claim that BOP violated 31 U.S.C. § 1321 by using trust fund monies to obtain second sets of prints for investigative purposes. According to the district court, it was undisputed that spending funds in this manner would violate section 1321. Maydak I, No. 97-2199, slip. op. at 10; see also Guynup Decl. ¶ 6 ("Using Inmate Trust Fund mon[ies] to pay for additional prints for security reasons is prohibited by Federal Bureau of Prisons policy."). The Bureau admitted misusing the Trust Fund in three instances at two prisons, but claimed it subsequently reimbursed the Fund. According to a Beckley official, although staff believed that duplicate prints were free, they later discovered (in response to inmate inquiries) that the photo developer charged one dollar per roll for the second set of prints. The prison then reimbursed the Fund one dollar for each such roll. Clifton Decl. ¶ 3. At McKean, the Acting Controller admitted that money from the Inmate Trust Fund was used to purchase duplicate prints on two occasions, but explained that those precise amounts had been reimbursed. Fitch Decl. ¶¶ 4-5. Satisfied that BOP had fully reimbursed the Fund, the district court declined to allow discovery on an "unsubstantiated claim of widespread misuse," and granted summary judgment to BOP. Maydak II, No. 97-2199, slip op. at 4. We cannot agree with the district court's resolution of this issue.

To begin with, having acknowledged that BOP misused the Trust Fund in two of some six institutions in which appellants were incarcerated, the district court appeared to draw — improperly at the summary judgment stage — an inference in the government's favor by "assum[ing]" that all prisons were complying with BOP policy prohibiting the use of trust funds for duplicate prints. Maydak II, No. 97-2199, slip op. at 3. The court also seems to have assumed that Beckley and McKean had fully compensated the Fund by reimbursing one dollar per roll for the duplicate photographs and that no trust funds were implicated in those institutions where the Inmate Trust Fund was not charged for the second set of prints. But as appellants and amicus rightly point out, duplicate prints can be obtained only by paying the full cost of purchasing and developing the film — costs wholly charged to the Fund. Simply reimbursing extra amounts paid for second sets of prints does not reflect their actual value. Likewise, they argue, acquiring duplicate prints for investigative purposes, even for free, constitutes an improper use of the Fund "because the print is not in reality `free,' but a promotional offer which belongs to the inmates who have paid for the print out of inmate trust funds." Amicus Br. at 20. When two people benefit from a "buy one, get one free" promotion, neither may claim his item is the one free of charge. We will thus remand for the district court to determine the proper reimbursement amount and to consider appellants' claim that the Trust Fund was misused at other institutions.

IV.

We have considered appellants' remaining claims relating to the inmate photograph file and found them to be without merit. The grant of summary judgment for the government with respect to the Privacy Act § 552a(b) claim is affirmed. In all other respects, the judgment of the district court is reversed, and the case is remanded for further proceedings consistent with this opinion.

So ordered.