
548 F.3d 375 (2008)
Gary G. JACOBS, Plaintiff-Appellee,
v.
NATIONAL DRUG INTELLIGENCE CENTER, Defendant-Appellant.
No. 07-40776.
United States Court of Appeals, Fifth Circuit.
November 10, 2008.
*376 Drew D. Hansen (argued), Susman Godfrey, Seattle, WA, for Jacobs.
Robert D. Kamenshine (argued), Leonard Aaron Schaitman, Civ. Div., Anthony Alan Yang, Office of Sol. Gen., U.S. Dept. of Justice, Washington, DC, for Defendant-Appellant.
Before JOLLY, BARKSDALE and HAYNES, Circuit Judges.
RHESA HAWKINS BARKSDALE, Circuit Judge:
At issue in this appeal involving the Privacy Act of 1974, 5 U.S.C. § 552a, is whether, as our court held in Johnson v. Department of Treasury, Internal Revenue Service, 700 F.2d 971 (5th Cir.1983), the Privacy Act's "actual damages" remedy includes emotional-distress damages. Consistent with our binding precedent, id., the district court ruled that it does. The National Drug Intelligence Center (NDIC) urges: the Supreme Court's post-Johnson decisions, "holding that a court must strictly construe an ambiguous waiver [of sovereign immunity] in favor of the Government, have undermined Johnson" and now compel our court to limit "actual damages" to "out-of-pocket expenses". AFFIRMED.

I.
Gary G. Jacobs was the president and CEO of Laredo National Bank, which conducts business in the United States and Mexico. NDIC, a part of the United States Department of Justice, coordinates drug intelligence information for the Government. In the late 1990s, an NDIC "Executive Summary", containing references to Jacobs, was disclosed without authorization and subsequently disseminated by the media.
As a result, in May 2001, Jacobs filed this action under the Privacy Act. In December 2002, following a hearing, the district court granted summary judgment for NDIC. It determined, inter alia: the Executive Summary was not a "record" contained in a "system of records" for § 552a purposes; and, therefore, this action is not a Privacy Act matter. Transcript of Hearing on Motion to Dismiss at 32, Jacobs v. Nat'l Drug Intelligence Ctr., No. 5:01-CV-72 (S.D. Tex. 17 Dec. 2002).
Jacobs appealed and, in August 2005, our court reversed and remanded, holding: "Jacobs has raised a genuine issue of material fact as to the [Privacy Act's] applicability"; and, therefore, "the district court erred in granting ... NDIC's motion for summary judgment". Jacobs v. Nat'l Drug Intelligence Ctr., 423 F.3d 512, 517, 522 (5th Cir.2005).
On remand, in a November 2006 joint pretrial order, NDIC essentially conceded a Privacy Act violation. In that regard, the parties agreed, inter alia: the Executive Summary was a "record" contained in a "system of records"; that summary was disclosed without authorization; the disclosure was "intentional or willful"; and it had an adverse effect on Jacobs. See id. at 516 (listing the four elements for a Privacy Act disclosure violation).
Therefore, the primary issue before the district court was the extent of any damages suffered by Jacobs as a result of the disclosure. Jacobs sought: damages for emotional distress; costs; and attorneys' fees.
*377 During a December 2006 summary-judgment hearing, NDIC objected to the potential inclusion of emotional-distress damages in a Privacy Act-based award of actual damages, essentially raising the points that it now urges on appeal. The district court responded:
[E]ven when you read the other Supreme Court cases that have come since [Johnson], I think the Fifth Circuit indicated actual damages are actual damages. It is what it is. Surely Congress knew that when they passed this statute. And so, therefore, I don't see how we get around it. I mean, actual damages are traditionally viewed to include [emotional-distress damages]. Under the Privacy Act, that would probably be the main source of damage as far as any actual damages someone might have.... [I] frankly don't feel that this is a problem based on the Fifth Circuit case law and the subsequent Supreme Court case law. I don't think that they are in conflict .... [and] I don't think they clearly overrule what the Circuit has done [in Johnson].
Transcript of Hearing on Motion for Summary Judgment at 4, 8, Jacobs v. Nat'l Drug Intelligence Ctr., No. 5:01-CV-72 (S.D. Tex. 7 Dec. 2006) (referencing Johnson, 700 F.2d at 971). Accordingly, noting that it was bound by Johnson, the district court denied NDIC's motion for summary judgment. Id.
In June 2007, following a bench trial, the district court awarded Jacobs $100,000 for emotional-distress-based actual damages.

II.
NDIC urges the award of emotional-distress damages is improper, maintaining that actual damages awarded under the Privacy Act must be limited to out-of-pocket expenses. In doing so, it urges: "the Supreme Court's post-Johnson decisions on sovereign immunity, holding that a court must strictly construe an ambiguous waiver in favor of the Government, have undermined Johnson and now compel [our court] to hold that `actual damages' [are] limited to out-of-pocket expenses".
Interpretation of the Privacy Act is a question of law, reviewed de novo. E.g., Chevron Chem. Co. v. Oil, Chem. & Atomic Workers Local Union 4-447, 47 F.3d 139, 142 (5th Cir.1995). Additionally, as discussed in more detail infra, the crux of NDIC's claim is: the Privacy Act is a limited waiver of sovereign immunity; and emotional-distress damages fall outside the scope of that waiver. Claims of sovereign immunity are, likewise, reviewed de novo. E.g., Delta Commercial Fisheries Ass'n v. Gulf of Mexico Fishery Mgmt. Council, 364 F.3d 269, 273-74 (5th Cir.2004).
Our analysis begins with recognizingas did the district courtthat our court has held the Privacy Act's actual-damages remedy includes emotional-distress damages. In 1983, Johnson, 700 F.2d at 972, rejected the position that actual damages under the Privacy Act are limited to "damages for out-of-pocket expenses". Instead, our court held: "the term `actual damages' under the Privacy Act does indeed include damages for physical and mental injury ... as well as damages for out-of-pocket expenses." Id. (emphasis added). In its analysis, our court noted, inter alia, that seven years before the Privacy Act's enactment, "the Supreme Court ... indicated that the primary damage in `right to privacy' cases is mental distress". Id. at 977 (quoting Time, Inc. v. Hill, 385 U.S. 374, 386 n. 9, 87 S.Ct. 534, 17 L.Ed.2d 456 (1967)). Consistent with that, our court also noted the Supreme Court's stating in Gertz v. Robert Welch, Inc., 418 U.S. 323, 94 S.Ct. 2997, 41 L.Ed.2d 789 (1974): "Indeed, the more *378 customary types of actual harm inflicted by defamatory falsehood include impairment of reputation and standing in the community, personal humiliation, and mental anguish and suffering." Johnson, 700 F.2d at 983 (quoting Gertz, 418 U.S. at 350, 94 S.Ct. 2997).
It is a well-settled Fifth Circuit rule of orderliness that one panel of our court may not overturn another panel's decision, absent an intervening change in the law, such as by a statutory amendment, or the Supreme Court, or our en banc court. E.g., United States v. Simkanin, 420 F.3d 397, 420 n. 25 (5th Cir.2005). Indeed, even if a panel's interpretation of the law appears flawed, the rule of orderliness prevents a subsequent panel from declaring it void. Grabowski v. Jackson County Pub. Defenders Office, 47 F.3d 1386, 1400 n. 4 (5th Cir.1995) (Smith, J., concurring in part and dissenting in part), vacated for reh'g en banc, id. at 1403, district court judgment aff'd, 79 F.3d 478 (5th Cir.1996) (en banc).
Concerning our longstanding rule of orderliness, NDIC does not contend that Johnson has been expressly overruled. In other words, in that regard, there has been neither a controlling statutory amendment, nor a Supreme Court decision, nor an en banc decision by our court.
Along that line, Congress is presumed to be aware of court decisions construing statutes and may, of course, amend a statute as a result. E.g., Dole v. Petroleum Treaters, Inc., 876 F.2d 518, 522 (5th Cir.1989) (citing Lorillard v. Pons, 434 U.S. 575, 580, 98 S.Ct. 866, 55 L.Ed.2d 40 (1978)). It has not done so for the issue at hand, even though Johnson was decided over 25 years ago.
Moreover, a circuit split on this question has existed at least that long, but the Supreme Court has not resolved it. The Supreme Court's not having rendered a decision requiring us to re-address Johnson is supported by, inter alia, Doe v. Chao, 540 U.S. 614, 124 S.Ct. 1204, 157 L.Ed.2d 1122 (2004) (holding plaintiffs must prove some actual damages to qualify for the Privacy Act's minimum statutory award). In Chao, the Court stated it was not addressing the Privacy Act's definition of "actual damages". Id. at 626 n. 10, 124 S.Ct. 1204 (emphasis added). Then, the Court noted the circuits "are divided on the precise definition of actual damages"; cited our Johnson decision as an example of one definition of actual damages; and noted Johnson allowed, as actual damages, "adequately demonstrated mental anxiety even without any out-of-pocket loss". Id. at 627 n. 12, 124 S.Ct. 1204. Given the Supreme Court's using Johnson in Chao as an example of one view of actual damages under the Privacy Act, coupled with its expressly avoiding defining actual damages in Chao, there has obviously been no intervening change of law by the Supreme Court.
In the light of this, and conceding there has been no express intervening change, NDIC essentially contends: post-Johnson, Supreme Court cases have construed other statutory waivers of sovereign immunity narrowly; and, therefore, were Johnson to be re-decided today, our court's analysis of what damages are recoverable under the Privacy Act might reach a different outcome. See, e.g., In re Supreme Beef Processors, Inc., 468 F.3d 248, 253 (5th Cir.2006) (en banc) ("waivers of sovereign immunity should be narrowly construed in favor of the United States"). We need not decide, however, whether a present-day analysis of damages recoverable under the Privacy Act would differ from Johnson because, again, there is no intervening change in law to permit our doing so.


*379 III.
For the foregoing reasons, the judgment is AFFIRMED.
