I. Background

Asuncion worked as a civilian Electronic Duplicating System Technician for the DLA in Pearl Harbor, Hawaiʻi for 30 years. Asuncion alleges in his complaint that he developed post-traumatic stress disorder (“PTSD”) during his deployment in Iraq as a member of the National Guard. He alleges that his PTSD, among other impairments, made “it difficult and burdensome for [him] to complete his work tasks without a reasonable accommodation,” and that he was “a handicapped person within the meaning of the Rehabilitation Act.” After a series of incidents in which Asuncion made threatening statements in the workplace, the DLA indefinitely suspended Asuncion’s employment without pay on April 21, 2021, based on its determination that he should no longer be permitted to access classified and sensitive information. Asuncion argues the DLA violated the Rehabilitation Act because it “discriminated against [him] by claiming he was a direct threat and failed to provide meaningful and effective accommodations.”

ASUNCION V. HEGSETH 5

Asuncion filed an Equal Employment Opportunity (“EEO”) claim with the DLA’s Office of Equal Employment Opportunity and Diversity (“DLA’s EEO Office” or “Office”) in December 2019. He filed a formal complaint with the Office in December 2020. The agency did not receive a hard copy of the complaint until September 2021 because of the COVID-19 pandemic. The Office issued its final agency decision (“FAD”) regarding his complaint on November 4, 2022. The DLA Case Number assigned to the FAD was “DLAF-20-0424.” This case number appeared on the letter enclosing the FAD and on every page of the FAD. A different case number, “DLAF-21-0424,” also appeared once on the first page of the FAD. Asuncion alleged in his district court complaint, however, that the correct case number for his EEO claim was “DLAF-20-0424.” The government does not dispute that “DLAF-20-0424” was the correct case number. In the FAD, the DLA concluded that Asuncion “failed to establish that he was subjected to disparate treatment and harassment based on disability, or reprisal.” It notified Asuncion about his right to file a civil action “within 90 calendar days of receipt of the final Agency decision.” The DLA’s EEO Office transmits FADs using the Department of Defense’s Secure Access File Exchange (“DoD SAFE”). DoD SAFE allows the Office to send sensitive documents securely. To send a FAD through DoD SAFE, an EEO official “drop[s] off” the FAD into the DoD SAFE system. The system then sends an email to the EEO official and the specified recipients with a “Claim ID,” a “Claim Passcode,” and a link to the FAD. The EEO official also encrypts the FAD with a “passphrase” in the DoD SAFE system, which the official then sends to the recipients in a separate email. A recipient clicks on the link and enters the Claim ID, Claim Passcode, and passphrase into DoD SAFE in order to access the FAD. On November 8, 2022, EEO Complaints Manager Joseph S. Somerville III dropped off Asuncion’s FAD and a certificate of service into DoD SAFE, designating as recipients Asuncion and his attorney Shawn A. Luiz. The certificate of service stated: “For timeliness purposes, it shall be presumed that the parties received the foregoing DLA final agency decision dated November 4, 2022 for DLA Case Number DLAN-22-0051 within five (5) calendar days after it was mailed. I certify that the DLA final agency decision was mailed to the following parties on November 8, 2022.” (Underlining in original.) It is undisputed that the certificate of service contained the wrong case number. Asuncion’s FAD was assigned the case number DLAF-20- 0424, not DLAN-22-0051. (Italics added.) The certificate of service did not indicate the substance of the “final agency decision.” On November 8, Somerville received an email from DoD SAFE, confirming that Asuncion and Luiz received the Claim ID and Claim Passcode. Somerville separately emailed Asuncion and Luiz the passphrase necessary to decrypt the FAD. Under the subject line “Passphrase to DLAF-20-0420,” Somerville wrote: “The passphrase for your DoD Safe is DLAF-20-0420FAD.” (Italic added.) This, again, did not match the case number assigned to Asuncion’s FAD. (As noted above, that number was DLAF- 20-0424. (Italic added.)) Nor did it match the case number in the certificate of service, DLAN-22-0051.

ASUNCION V. HEGSETH 7

On November 11, Luiz replied to the November 8 email from Somerville, stating: “I could not access the file. Can you please resend in a different format?” Somerville responded on November 14: “The file expired, so I will have to resend it to you. Please pick-up the file as soon as you receive the notification.” That same day, Somerville repeated the process for transmitting the FAD through DoD SAFE. He dropped off the FAD and certificate of service into the DoD SAFE system, designating Asuncion and Luiz as recipients. Again, Somerville received a confirmation email that Asuncion and Luiz received the Claim ID and Claim Passcode. This time, Somerville sent two different passphrases. On November 14, Luiz received an email from Somerville stating: “The passphrase for the DoD Safe is DLAF-20- 0420FAD please pick this up within 48 hours.” (Italic added.) This was an incorrect passphrase. Almost an hour later, Luiz received a different email from Somerville. This one stated: “Good morning all, Please use the following passphrase to open up your DoD Safe file DLAF-20- 0424FAD.” (Italic added.) The second passphrase was correct, but Somerville did not state in his second email that he was sending a different and correct passphrase. Neither party disputes that Somerville sent these two different passphrases for the same DoD SAFE “drop-off.” Luiz responded to Somerville later that day, stating: “Sorry; I could not access the files still.” Almost two hours later, he emailed Somerville again, stating: “Sorry, I still cannot open the attachment.” Somerville did not respond to either email. On November 20, Luiz received an automatic email message from DoD SAFE reminding him that he had a “drop-off” that would expire in 24 hours. Luiz forwarded this email to Somerville on November 21 stating: “I cannot open it. Please mail via U.S. Mail.” Asuncion himself also tried to access the FAD through DoD SAFE in November. He stated in a sworn declaration that he “was unable to do so with [his] personal devices.” Asuncion explained that the DLA mailed “voluminous” copies of the record through the mail, and he did “not understand why the DLA did not just mail . . . a copy of the

FAD.”

On December 3, 2022, Luiz emailed Somerville and DLA’s EEO Office Deputy Director Kimberly R. Lewis. He wrote:

Please be advised I gave notice on Nov. 11, 14, 21, 2022, that I could not open the file for the Final Agency Decision in Rodolpho Asuncion v. DLA. It has been 3 weeks. Would someone please email me a FAD PDF that is not encrypted OR mail to me via U.S. MAIL a hard copy? Thank you.

(Emphasis in original.) Luiz forwarded a copy of this email to the DLA’s General Counsel the same day, requesting that the General Counsel email him a copy of the FAD. On December 5, Lewis emailed Luiz a decrypted PDF copy of the FAD. That same day, Luiz confirmed receipt of the FAD. He emailed Lewis the following:

I am confirming receipt of the FAD. Thank you for sending it in a format that is not encrypted on DODSafe which I can finally access.

ASUNCION V. HEGSETH 9

Please confirm my time to respond to the timelines triggered by the FAD starts from today, December 5, 2022. Will I receive a Certificate of Service indicating today’s date? Please let me know? I never received an email on Nov. 4, 2022. The first email giving notice of a DODSafe document was November 8, 2022. I sent the Nov. 11, 14, 21, 2022, notices to the email address [for Somerville]. I received more DODSafe notices (Nov. 14 and Nov. 20, 2022) but was still unable to open the documents each time. (Emphasis added.)

Luiz followed up on December 13, eight days later, with another email to Lewis:

Please be advised I am still awaiting a response to my email of December 5, 2022 (8 days ago) where I confirmed receipt of the FAD (it was sent in a format that was not encrypted on DODSafe which I could finally access). My unanswered questions were, “Please confirm my time to respond to the timelines triggered by the FAD starts from today, December 5, 2022. Will I receive a Certificate of Service indicating today’s date? Please let me know?” A response would be greatly appreciated. Thank you very much! (Emphasis added in first paragraph; emphasis in original in second paragraph.) On December 14, Lewis responded, “According to 29 CFR 1614 the time starts when you as the Attorney received the FAD. We will not issue a new [certificate of service] since we have proof you received the FAD via email. A copy will be placed in the complaint file.” Luiz responded the next day, “Thank you!” Once he received the FAD and learned of the adverse decision of the agency, Asuncion was able to decide whether to bring suit. Understanding Lewis’s response as confirming that he had not “received” the FAD until he received it by email on December 5, 2022, Luiz filed the complaint on March 3, 2023. This was 115 days after Somerville first dropped off the FAD into the DoD SAFE link on November 8, 2022, and 88 days after Luiz actually received the emailed copy of the decrypted FAD on December 5, 2022. The government moved to dismiss the complaint, or, in the alternative, for summary judgment. The government argued that Asuncion’s complaint was untimely because it was not filed within 90 days of receipt of the FAD. The district court agreed that Asuncion’s complaint was untimely, concluded that equitable tolling was not warranted, and granted summary judgment against Asuncion. Asuncion moved for reconsideration. The district court denied his motion. Asuncion’s timely appeal followed. We issued a focus order asking the parties to be prepared to explain at oral argument the incorrect number on the certificate of service, the discrepancies between the FAD case numbers, and the discrepancies between the DoD SAFE passphrases provided to Asuncion and Luiz.

ASUNCION V. HEGSETH 11

II. Standard of Review

We review de novo a district court’s order granting summary judgment based on the statute of limitations. Payan v. Aramark Mgmt. Servs. Ltd. P’ship, 495 F.3d 1119, 1121 (9th Cir. 2007). “[V]iewing the evidence in the light most favorable to the nonmoving party,” we must decide “whether the district court correctly applied the relevant substantive law and whether there are any genuine issues of material fact.” Lyons v. England, 307 F.3d 1092, 1103 (9th Cir. 2002) (quoting Balint v. Carson City, 180 F.3d 1047, 1050 (9th Cir. 1999) (en banc)).

III. Discussion

A. Timely Filing We first address whether Asuncion’s complaint was timely filed. Claims brought under the Rehabilitation Act are governed by the same “remedies, procedures, and rights” applicable to Title VII employment discrimination claims brought by federal employees against federal defendants. 29 U.S.C. § 794a(a)(1). Under Title VII, civil actions brought by federal employees must be brought “[w]ithin 90 days of receipt of notice of final [agency] action.” 42 U.S.C. § 2000e-16(c); see also 29 C.F.R. § 1614.407(a) (providing that civil actions must be brought “[w]ithin 90 days of receipt of the agency final action on an individual or class complaint”); 42 U.S.C. § 2000e-5(f)(1) (“If a charge filed with the [Equal Employment Opportunity] Commission . . . is dismissed . . . the Commission . . . shall so notify thehttps://www.law.cornell.edu/definitions/uscode.php?wid th=840&height=800&iframe=true&def_id=42-USC- 991716523-1546477204&term_occur=999&term_src= person aggrieved and within ninety days after the giving of such notice a civil action may be brought . . . .”). The 90- day period functions as a statute of limitations. Payan, 495 F.3d at 1121. Claimants can receive notice through their attorneys. Irwin v. Dep’t of Veterans Affs., 498 U.S. 89, 93 (1990). The parties disagree as to which email constituted “receipt of notice” of the agency’s final agency action and, thus, triggered the start of the 90-day period. Despite sending the wrong passphrase on November 8, the government argues that the period started on that date, when Asuncion and Luiz received the initial DoD SAFE email linking to the encrypted FAD. Asuncion argues that the period did not begin until December 5, when his attorney, Luiz, first received the decrypted copy of the FAD. For notices transmitted via traditional mail service, our case law on Title VII’s statute of limitations is clear and uncomplicated. “We measure the start of the limitations period from the date on which a right-to-sue notice letter arrived at the claimant’s address of record.” Payan, 495 F.3d at 1122; see also Scholar v. Pac. Bell, 963 F.2d 264, 267 (9th Cir. 1992) (explaining the claimant need not have the notice “in hand” for the 90-day period to begin). But as this appeal and others demonstrate, electronically transmitted notices present new complications, such as delays caused by encryption, not considered by our previous case law. For help in deciding this appeal, we look to recent decisions by our sister circuits. In Lax v. Mayorkas, 20 F.4th 1178 (7th Cir. 2021), the Seventh Circuit held that the Title VII statute of limitations began when employee Brian Lax received an email attaching a password-protected copy of his FAD. Id. at 1182. Lax had filed an EEO complaint against his employer, the Federal Emergency Management Agency (“FEMA”). Id. at 1180.

ASUNCION V. HEGSETH 13

EEO transmitted its decision to Lax via email, attaching a password-protected copy of the FAD, a “Notice of Appeal Rights,” a privacy statement, and a certificate of service. Id. at 1180–81. One minute later, EEO sent the password in a separate email. Id. at 1181. Lax read the emails that day, but he claimed he was unable to open the attached FAD until the next day because of technical errors on his work-issued phone. Id. Lax filed suit 91 days after he received the email with his FAD attached, but 90 days after he read the FAD. Id. The Seventh Circuit rejected Lax’s argument that the 90 days began to run when he opened and read the attached FAD. Id. at 1182. Even though Lax contended he was “unable—rather than simply unwilling—to read the [FAD] on the day he received it,” the court reasoned that “under the present set of circumstances, this distinction does not warrant a different result.” Id. The Seventh Circuit explained that Lax “knew at that time (without needing to open the attachment) that what he had received was the [FAD].” Id. at 1183. The Eighth Circuit recently considered and extended Lax in McDonald v. St. Louis University, 109 F.4th 1068 (8th Cir. 2024). In McDonald, employee Rachel McDonald filed a discrimination charge with the Equal Employment Opportunity Commission (“EEOC”) against her employer. Id. at 1070. After making its final decision not to bring suit itself, the EEOC emailed McDonald’s lawyer on May 10, 2022, notifying the lawyer that “a new document” had been added to McDonald’s case file on the EEOC’s online portal. Id. The email contained a hyperlink that led to McDonald’s right-to-sue notice. Id. The lawyer read the email but could not access the notice because he had lost his password for the portal. Id. The EEOC sent a “REMINDER” email on May 18. Id. Without the password, however, the lawyer still could not access the portal. Id. On June 21, McDonald’s lawyer emailed the EEOC asking for the right-to-sue letter. Id. The EEO emailed the right-to-sue letter as an attachment on June 28. Id. McDonald filed her complaint on September 23—137 days after May 10, and 87 days after June 28. Id. The court held that the 90-day period began to run on May 10, when the EEOC first emailed McDonald’s lawyer the hyperlink to her right-to-sue letter in the portal. Id. at 1071. “That her lawyer never read the right-to-sue letter until the EEOC emailed it as an attachment . . . ‘does not save her claims from being time-barred.’” Id. (quoting Williams v. Thomson Corp., 383 F.3d 789, 790–91 (8th Cir. 2004)). The court declined to apply equitable tolling, writing, “[w]e do not think the record shows that her lawyer did much to get the password.” Id. Even more recently, the Seventh Circuit extended Lax in Kinder v. Marion County Prosecutor’s Office, 132 F.4th 1005 (7th Cir. 2025). The employee, Susan Kinder, filed a discrimination claim against her employer with the EEOC. Id. at 1007. On April 28, 2022, the EEOC uploaded her right-to-sue letter to the EEOC’s online portal. Id. Kinder’s lawyer received an email from the EEOC that same day informing him that a “new document” had been added to the portal. Id. The lawyer was unable to access the document, and he called the EEOC multiple times for help. Id. The EEOC emailed him on June 15, explaining that Kinder’s “charge was closed” and that he had to view the notice on the portal. Id. Again, Kinder’s lawyer could not access the letter on the portal and asked the EEOC to send him the letter. Id. Eventually, the EEOC emailed the letter to Kinder’s lawyer. Id. The Seventh Circuit held that the 90- day period began when Kinder had notice of the agency’s final decision, not when Kinder was able to read the right-

ASUNCION V. HEGSETH 15

to-sue letter. Id. at 1009. Because there was no dispute that the June 15 email informed her lawyer that a right-to-sue letter was available in the portal, the court measured the 90- day period from June 15. Id. Finally, the First Circuit recently addressed a case similar to the case before us. García-Gesualdo v. Honeywell Aerospace of P.R., Inc., 135 F.4th 10 (1st Cir. 2025). The employee, Leika Joanna García-Gesualdo, filed a charge against her employer with the EEOC. Id. at 13. After considering the charge, the EEOC emailed García- Gesualdo’s lawyer on March 29 with the subject line “Document Added to [García-Gesualdo’s] EEOC Charge.” Id. The body of the email stated that a “new document” had been added to García-Gesualdo’s case file on the EEOC Public Portal and contained a hyperlink that led to the portal. Id. Neither the subject line nor the body of the email described the substance of the “new document.” Id. On April 6, the EEOC sent García-Gesualdo’s lawyer a second email with the subject line “REMINDER: Important Document Available for [García-Gesualdo’s] EEOC Charge.” Id. The body of the email stated that the “EEOC has made a decision regarding [García-Gesualdo’s] charge” and directed her lawyer to “review the decision” on the EEOC Public Portal. Id. The second email also contained a hyperlink to the portal. Id. García-Gesualdo’s lawyer was not able to access the document because the EEOC Public Portal was not functioning properly. Id. at 14 (noting that the EEOC acknowledged that the problem with the portal was a “known issue”). García-Gesualdo’s lawyer did not access the right-to-sue letter until April 11 when the EEOC emailed him a PDF copy. Id. The First Circuit held that neither the March 29 email nor the April 6 email provided sufficient information to constitute notice of García-Gesualdo’s right to sue. Id. at 16–17. The court concluded, “[I]n order for an email that does not attach the right-to-sue letter itself to provide notice, it must ‘indicate[ ] without ambiguity’ that the EEOC has reached a final decision and that the claimant has ninety days to bring suit if they so wish.” Id. at 18. The March 29 email did not provide notice because it “merely note[d] the existence of a ‘new’ document without attaching the new document to the email” and did not contain sufficient information about the existence of a final decision. Id. Although the April 6 email indicated that the EEOC “made a decision” and instructed García-Gesualdo to view an “important document” on the EEOC Public Portal, it did not provide notice because there are other important EEOC decisions unrelated to the termination of EEOC processes and commencement of the 90-day filing period. Id. The court explained that “[a]lthough we agree that providing a link (as opposed to an attachment) via email could be sufficient to provide notice, as we have explained, the transmitting email must also provide information with respect to the link that would satisfy the notice requirement.” Id. at 19. We are persuaded by the First Circuit’s reasoning in García-Gesualdo and find that the facts in that case are more similar to Asuncion’s circumstances than those in the Seventh and Eighth Circuit cases. The certificate of service in this case stated that the inaccessible document was a “final agency decision” without indicating what that decision was or that Asuncion had 90 days to file suit. Despite his repeated attempts, Asuncion’s lawyer was unable to access the FAD because of errors made by the DLA, just as García- Gesualdo’s lawyer was unable to access the EEOC Public Portal because of technical issues with the portal.

ASUNCION V. HEGSETH 17

Asuncion’s lawyer did not receive an accessible copy of the FAD until the DLA emailed him the decrypted copy on December 5. Under similar circumstances, the First Circuit concluded that García-Gesualdo’s lawyer received notice of the FAD only when the EEOC emailed an accessible copy of the right-to-sue letter. We hold that the 90-day limitation period did not begin until Luiz could realistically be held responsible for having access to the FAD and learning what the agency had decided. As recounted above, the agency made numerous errors when transmitting the passphrase necessary to decrypt the FAD. On November 8, Somerville mistakenly sent a passphrase that did not match Asuncion’s case number. On November 14, Somerville again sent the same incorrect passphrase. Almost an hour later, Somerville sent a second email—this time with a passphrase that matched the case number, but without explaining that he was now sending a different passphrase. The difference between the two passphrases was a single digit in a multi-number, multi-letter passphrase. When Luiz emailed Somerville twice later that day, stating that he still could not open the attachment, Somerville did not respond. At oral argument, the government conceded that it could not say with certainty whether the DLA ever sent the correct passphrase to Luiz’s client, Asuncion. Under the circumstances, we hold that Luiz did not have effective notice of the nature of the agency’s final decision until December 5, the day he received by email a decrypted copy of that decision. He filed suit in the district court within 90 days of receiving the accessible FAD. Thus, his complaint was timely. B. Equitable Tolling Alternatively, we hold that Asuncion is entitled to equitable tolling. Equitable relief is given “only sparingly” and does not apply to “garden variety claim[s] of excusable neglect.” Irwin, 498 U.S. at 96 (considering cases involving private litigants and noting that “it is evident that no more favorable tolling doctrine may be employed against the Government”). Equitable tolling is appropriate where a claimant “has been induced or tricked by his adversary’s misconduct into allowing the filing deadline to pass.” Id. “A statute of limitations is subject to the doctrine of equitable tolling.” Scholar, 963 F.2d at 267. “[A] litigant is entitled to equitable tolling of a statute of limitations only if the litigant establishes two elements: ‘(1) that he has been pursuing his rights diligently, and (2) that some extraordinary circumstance stood in his way and prevented timely filing.’” Menominee Indian Tribe of Wis. v. United States, 577 U.S. 250, 255 (2016) (quoting Holland v. Florida, 560 U.S. 631, 649 (2010)). We hold that Asuncion meets both elements here. We conclude that Asuncion is entitled to equitable tolling because Luiz was diligent in trying to gain access to the agency’s decision and extraordinary circumstances prevented him from succeeding. He emailed Somerville on November 11, 14, and 21 to explain that he could not access the encrypted FAD. He asked Somerville to resend the FAD “in a different format ” or “via U.S. Mail.” But except for sending two links on the morning of November 14—the first of which was incorrect—Somerville ignored Luiz’s requests. Indeed, he ignored two requests from Luiz later that very day. It was only when Luiz emailed both Lewis and Somerville on December 3 that the DLA finally sent a decrypted FAD two days later.

ASUNCION V. HEGSETH 19

Luiz also made an effort to clarify the date when the limitations period began. He emailed Lewis to confirm “the timelines triggered by the FAD starts from . . . December 5, 2022.” Lewis responded: “According to 29 CFR 1614 the time starts when you as the Attorney received the FAD. We will not issue a new [certificate of service] since we have proof you received the FAD via email.” Not unreasonably, Luiz understood Lewis’s statement to mean that the DLA would not issue a new certificate of service because it had proof he received the FAD on December 5, and that the 90- day period started on December 5. On this record, Luiz therefore demonstrated sufficient diligence to qualify for equitable tolling. Applying equitable tolling, Asuncion’s statute of limitations period did not begin to run until he received the decrypted copy of the FAD on December 5. Because he filed his complaint 88 days later, the complaint was timely filed.

IV. Conclusion

For the foregoing reasons, we reverse the district court’s grant of summary judgment. We remand to allow the district court to address the merits of Asuncion’s Rehabilitation Act claim.

REVERSED AND REMANDED.