Electronic Privacy Information Center v. US Department of Commerce and Bureau of the Census

On March 26, 2018, the Department of Commerce announced that a citizenship question would be added to the 2020 Census. The Electronic Privacy Information Center (EPIC) contends that, before this announcement was made, its members were entitled to a Privacy Impact Assessment by law. EPIC sued to enjoin the addition of the question on this basis, and now appeals the district court's denial of its motion for a preliminary injunction. Because EPIC lacks standing, we remand to the district court with instructions to dismiss.

I. Background

A. The E-Government Act

In 2002, Congress passed the E-Government Act to modernize and regulate the government's use of information technology. Pub. L. No. 107-347, 116 Stat. 2899 (codified at 44 U.S.C. § 3501 note) (hereinafter "E-Government Act"). The Act outlines eleven purposes. Nine involve improving government efficiency, organization, and decision-making. E-Government Act § 2(b). In addition to these predominantly agency-centric goals, however, the Act also aims to "provide increased opportunities for citizen participation in Government," and "[t]o make the Federal Government more transparent and accountable." §§ 2(b)(2), (9).

Section 208 of the Act contains privacy provisions. Its stated purpose is to "ensure sufficient protections for the privacy of personal information as agencies implement citizen-centered electronic Government." E-Government Act § 208(a). To effectuate this purpose, § 208 requires federal agencies to conduct, review, and, "if practicable," publish, a Privacy Impact Assessment (PIA) before "initiating a new collection of information" that involves personally identifiable information that will be "collected, maintained, or disseminated using information technology." § 208(b)(1)(A)-(B). A "collection of information" is defined as "obtaining, causing to be obtained, soliciting, or requiring the disclosure ... of facts or opinions" through "identical questions posed to ... ten or more persons." 44 U.S.C. § 3502 (3)(A). The word "initiating" is not defined by statute.

A PIA required by a new collection of information must address, at a minimum: what information will be collected, why it is being collected, how it will be used, how it will be secured, with whom it will be shared, whether a system of records is being created under the Privacy Act, and what "notice or opportunities for consent" will be provided to those impacted. E-Government Act § 208(b)(2)(B)(ii).

B. The Census

To apportion representatives among the several States, the Census Clause of the United States Constitution requires an "actual Enumeration" of the United States population. U.S. Const. art. I, § 2, cl. 3. The census occurs every ten years, "in such Manner as [Congress] shall by Law direct." Id. Pursuant to this command, Congress passed a series of census laws directing the Secretary of Commerce to conduct a decennial census and establishing the Census Bureau as an agency within the Department of Commerce. 13 U.S.C. §§ 2 , 141(a). These laws give the Secretary broad authority to "obtain such other census information as necessary." Id. § 141(a). The census has historically included a wide variety of demographic questions, often including questions about citizenship status. With few exceptions, a refusal to answer "any of the questions" on the census is a violation of law. 13 U.S.C. § 221 .

The Census Bureau operates at least six information technology (IT) systems that process, store, and disseminate personally identifiable information from census responses. The primary system used for the census is called "CEN08." This system shares information with five other systems: "CEN21," "CEN05," "CEN11," "CEN13," and "CEN18." The Bureau maintains a PIA for each system on a publicly-available website. Because the use of the systems changes regularly, the Bureau reviews and updates each assessment at least once per year.

C. The Challenge

On March 26, 2018, the Secretary of Commerce, Wilbur Ross, announced that a citizenship question would be added to the 2020 Census. A variety of legal challenges to the merits of that decision followed.

This case presents a narrow question: when does the addition of the citizenship question need to be addressed in a PIA? The parties agree that the E-Government Act requires the government to complete a PIA before "initiating a new collection of information." E-Government Act § 208(b)(1)(A)(ii). Their disagreement involves the meaning of the word "initiating." The Census Bureau believes that it does not initiate a collection of information until it solicits information from the public. If this is correct, then the Bureau is not required to produce PIAs until questionnaires are mailed out in 2020. The Government has consistently provided assurances, both before the district court and here on appeal, that the assessments will be completed "before it distributes any 2020 Decennial Census questionnaires." See, e.g. , Gov. Br. at 30. Indeed, the PIA updates have been in progress as this litigation proceeded, and an updated PIA addressing the citizenship question was published for one of the six relevant IT systems (CEN08) a few days before this Court heard oral argument. Notwithstanding these assurances and evidence of progress, EPIC, a public interest research center focused on privacy and civil liberties, challenges the Government's interpretation. In EPIC's view, the decision to add the question was the initiation of information collection. If this interpretation is correct, the completed PIAs were required before the decision to add the question was announced on March 26, 2018.

Eight months after Secretary Ross's announcement, EPIC filed a complaint in the district court. It alleged three counts against the Department of Commerce and the Bureau of the Census-two under the Administrative Procedure Act and one under the Declaratory Judgment Act. Count One alleges that the Secretary committed an unlawful act under 5 U.S.C. § 706 (2)(a) and (c) when he announced the decision to add the citizenship question before completing the PIAs. Similarly, Count Two alleges that the government unlawfully withheld agency action, in violation of 5 U.S.C. § 706 (1), by failing to timely complete and publish the PIAs. Count Three seeks a declaration of rights under 28 U.S.C. § 2201 (a). Among other requested relief, EPIC asks the court to: (1) set aside the decision to add the citizenship question; (2) order that the decision be revoked until the PIAs are completed and published; and (3) order the completion and publication of the PIAs.

On January 18, 2019, EPIC moved for a preliminary injunction. In the text of the proposed order submitted with its motion, EPIC asked that the Census Bureau be "enjoined from initiating any collection of citizenship status information." Pl.'s Mot. Prelim. Inj. Attach. 2 at 1 (emphasis added). This is curious, since EPIC's entire argument is that such collection has already been initiated. Nevertheless, the district court denied the motion because EPIC failed to show a likelihood of success on the merits or a likelihood of irreparable harm. EPIC v. U.S. Dep't of Commerce , 356 F. Supp. 3d 85 , 89, 95-97 (D.D.C. 2019). The district court held that EPIC was not likely to succeed on the merits because " initiating a new collection of information" requires more than a decision to collect information at some point in the future. Id. at 89-91 . The court agreed with the Government that collection did not begin until the first set of census questions was mailed out. Id. at 90 . The district court also concluded that EPIC was not likely to suffer irreparable harm since the collection of citizenship information-set to occur in 2020-was not imminent. Id. at 95-97 . EPIC timely appealed the denial of its motion.

II. Jurisdiction

We have the statutory jurisdiction to review the denial of a preliminary injunction under 28 U.S.C. § 1292 (a)(1). Before we review the merits of this appeal, however, we must consider whether federal courts have the constitutional power to decide this case in the first place. "Every federal appellate court has a special obligation to satisfy itself not only of its own jurisdiction, but also that of the lower courts in a cause under review ...." Arizonans for Official English v. Arizona , 520 U.S. 43 , 73, 117 S.Ct. 1055 , 137 L.Ed.2d 170 (1997) (internal quotations omitted). "When the lower federal court lacks jurisdiction, we have jurisdiction on appeal, not of the merits but merely for the purpose of correcting the error of the lower court in entertaining the suit." Steel Co. v. Citizens for a Better Env't , 523 U.S. 83 , 95, 118 S.Ct. 1003 , 140 L.Ed.2d 210 (1998) (internal quotations omitted).

"The Constitution limits our 'judicial Power' to 'Cases' and 'Controversies,' U.S. Const. art. III, § 2, cl. 1." West v. Lynch , 845 F.3d 1228 , 1230 (D.C. Cir. 2017) (citing Steel Co. , 523 U.S. at 102 , 118 S.Ct. 1003 ). "[T]here is no justiciable case or controversy unless the plaintiff has standing." Id. "To establish standing, the plaintiff must show (1) it has suffered a concrete and particularized injury (2) that is fairly traceable to the challenged action of the defendant and (3) that is likely to be redressed by a favorable decision, i.e., a decision granting the plaintiff the relief it seeks." EPIC v. Presidential Advisory Comm'n on Election Integrity (PACEI) , 878 F.3d 371 , 376-77 (D.C. Cir. 2017) (internal quotations omitted). EPIC is required to establish standing as to each claim, and each form of requested relief. See id. at 377 . Since the three counts in EPIC's complaint involve a repackaging of the same underlying grievance, we need not undertake a separate standing analysis as to each claim.

As an organization, EPIC can assert standing in one of two ways. It can assert standing on its own behalf, as an organization, or on behalf of its members, as associational standing. See Am. Soc. for Prevention of Cruelty to Animals v. Feld Entm't, Inc ., 659 F.3d 13 , 24 (D.C. Cir. 2011). As we will explain, EPIC's assertion of organizational standing is plainly foreclosed by precedent. Its assertion of associational standing also fails, because it has not identified a concrete injury suffered by one of its members.

A. Organizational Standing

"[A]n organization may establish Article III standing if it can show that the defendant's actions cause a concrete and demonstrable injury to the organization's activities that is more than simply a setback to the organization's abstract social interests." Feld Entm't , 659 F.3d at 25 (internal quotations omitted). This Court has previously considered and rejected EPIC's assertion of organizational standing with respect to § 208 of the E-Government Act. PACEI , 878 F.3d 371 . In PACEI , EPIC challenged the authority of the Presidential Advisory Commission on Election Integrity to collect voter information from each state without first publishing a PIA as required by § 208. 878 F.3d at 374 . The requested relief included: (1) an order requiring the PACEI to "promptly" publish a PIA and (2) an order enjoining its collection of voter data. Id. at 377, 380 . We held that EPIC did not have organizational standing to compel the publication of a PIA or to seek an injunction barring the collection of information. Id. at 378, 380 . On both counts, EPIC was unable to show how the failure to publish a PIA concretely injured its organizational interest. Id. at 379 . We held that § 208 did not confer an informational interest on EPIC as an organization, and any resources spent obtaining information that would otherwise have been in a PIA was a "self-inflicted budgetary choice that cannot qualify as an injury in fact." Id . The same reasoning applies to the present complaint. Thus, any assertion of organizational standing by EPIC under § 208 is foreclosed by our prior precedent.

B. Associational Standing

With organizational standing out of the question, we turn to EPIC's assertion of associational standing. An organization can assert associational standing on behalf of its members if: "(1) at least one of their members has standing to sue in her or his own right, (2) the interests the association seeks to protect are germane to its purpose, and (3) neither the claim asserted nor the relief requested requires the participation of an individual member in the lawsuit." Am. Library Ass'n v. FCC , 401 F.3d 489 , 492 (D.C. Cir. 2005).

We begin our analysis by observing that EPIC is a membership organization. Respondent contends that our precedent determines that EPIC is not, citing PACEI . It is true that when we issued our decision in PACEI , we noted that "as far as the record shows, [EPIC] has no traditional membership[.]" 878 F.3d at 380 . Since that decision issued, however, the nature of the organization has changed. In January 2018, EPIC amended its bylaws. The new bylaws require the organization to designate "members" who must be "distinguished experts in law, technology, and public policy." Members are eligible to sit on the Board of Directors. They also provide leadership to the organization and pay dues. We implicitly recognized that these changes were enough to turn EPIC into a membership organization when we conducted an associational standing analysis in EPIC v. FAA , 892 F.3d 1249 , 1253-55 (D.C. Cir. 2018). We expressly recognize it here.

Having established that EPIC is a membership organization, we can examine the first prong of the associational standing analysis. At this step, EPIC must show, for each of its claims, that at least one of its members has standing. See Am. Library Ass'n , 401 F.3d at 492 . By necessity, this requires at least one of EPIC's members to have suffered a "concrete and particularized" injury. See Lujan v. Defs. of Wildlife , 504 U.S. 555 , 560, 112 S.Ct. 2130 , 119 L.Ed.2d 351 (1992). EPIC avers that its members have suffered, or will suffer, both informational and privacy injuries. However, they have made no such showing.

1. Privacy Injury

EPIC asserts that its members will suffer a privacy injury if their citizenship status information is "unlawfully collected." EPIC argues that the act of collecting information without a PIA, by itself, constitutes an imminent, concrete, and particularized privacy injury. But "a bare procedural violation, divorced from any concrete harm, [does not] satisfy the injury-in-fact requirement of Article III." Spokeo, Inc. v. Robins , --- U.S. ----, 136 S. Ct. 1540 , 1549, 194 L.Ed.2d 635 (2016). Therefore, to plausibly show a privacy injury, EPIC must allege harm that is distinct from a simple failure to comply with the procedural requirements of § 208. In the privacy context, such harm would ordinarily stem from the disclosure of private information. Since EPIC has not shown how a delayed PIA would lead to a harmful disclosure, its privacy injury theory fails.

Disclosure of individual census responses to third parties is prohibited by law. 13 U.S.C. § 9 . A census response may not be used for "any purpose other than the statistical purposes for which it is supplied" and only "sworn officers and employees of the Department [of Commerce] or [Census] [B]ureau" may examine individual reports. Id. § 9(a)(1), (3). Responses are not even admissible as evidence in court in most circumstances. Id. § 9(a). We agree with the Southern District of New York that "it is pure speculation to suggest that the Census Bureau will not comply with its legal obligations to ensure the privacy of respondents' data or that those legal obligations will be amended." New York v. U.S. Dep't of Commerce , 351 F. Supp. 3d 502 , 619 (S.D.N.Y. 2019). More specifically, EPIC has not convinced us that a delay in receiving a PIA will make the Census Bureau any less likely to comply with these laws. Speculation, we have said before, "is ordinarily fatal to standing." PACEI , 878 F.3d at 379 (citing DaimlerChrysler Corp. v. Cuno , 547 U.S. 332 , 344, 126 S.Ct. 1854 , 164 L.Ed.2d 589 (2006) ). Therefore, to the extent that EPIC relies on the potential disclosure of their citizenship status to third parties as the source of injury, we reject the theory as a "speculative chain of possibilities" that cannot establish an injury. Accord Clapper v. Amnesty Int'l USA, 568 U.S. 398 , 414, 133 S.Ct. 1138 , 185 L.Ed.2d 264 (2013).

For the first time on appeal, EPIC also suggests that its members have a constitutional privacy interest in keeping their citizenship status private from the government itself. EPIC cites Whalen v. Roe and Nixon v. Administrator of General Services for the proposition that its members have an interest in "avoiding disclosure of personal matters" and that "informational privacy is 'implicit in the concept of ordered liberty.' " Appellant Reply Br. at 10 (citing Whalen, 429 U.S. 589 , 599 n.23, 97 S.Ct. 869 , 51 L.Ed.2d 64 (1977) ; Nixon , 433 U.S. 425 , 455, 97 S.Ct. 2777 , 53 L.Ed.2d 867 (1977) ). We have previously expressed "grave doubts as to the existence of a constitutional right of privacy in the nondisclosure of personal information," at least "where the information is collected by the government but not disseminated publicly." Am. Fed'n of Gov't Employees v. HUD , 118 F.3d 786 , 791, 794 (D.C. Cir. 1997). These doubts are particularly acute where the information in question is as deeply entwined with national sovereignty and governance as citizenship status.

We need not resolve this issue today, however, because EPIC has not squarely challenged the merits or constitutionality of the citizenship question in this case. Rather, they challenge the procedural propriety of the government's collection of this information in the absence of a timely PIA. The narrow question before the Court-a question about the timing of PIAs-is completely "[dis]connected" from the broader question of whether a citizenship question on the census is constitutionally permissible. Accord Sugar Cane Growers Co-op. of Fla. v. Veneman , 289 F.3d 89 , 94-95 (D.C. Cir. 2002). Therefore, for the purposes of this litigation, the existence or scope of a right to informational privacy with respect to citizenship status is not relevant. EPIC has not shown that the timing for publishing PIAs is plausibly connected to the government's collection of private information that it would not otherwise collect. Especially because, as previously noted (page 98-99, supra ), the principal purpose of the impact assessment is not to deter collection in the first place, but instead to improve upon an agency's storage and sharing practices.

In short, EPIC has failed to show that its members have suffered, or imminently will suffer, a privacy injury as a result of a delayed PIA.

2. Informational Injury

Having concluded that EPIC's members have not suffered a privacy injury, we turn to the contention that they have suffered an informational injury. To show an informational injury, a plaintiff must show: "(1) it has been deprived of information that, on its interpretation, a statute requires the government or a third party to disclose to it, and (2) it suffers, by being denied access to that information, the type of harm Congress sought to prevent by requiring disclosure." Friends of Animals v. Jewell, 828 F.3d 989 , 992 (D.C. Cir. 2016). Mirroring our analysis in PACEI , we do not consider whether EPIC satisfies the first prong of the analysis, because EPIC's members cannot satisfy the second. See PACEI, 878 F.3d at 378 .

Even if § 208 requires the disclosure of PIAs to EPIC's members, the organization cannot show that those members have suffered the "type of harm Congress sought to prevent by requiring disclosure." See Jewell, 828 F.3d at 992 . In PACEI , this Court considered what type of harm § 208 of the E-Government Act was designed to prevent. We held that § 208 "is directed at individual privacy " and protects individuals "by requiring an agency to fully consider their privacy before collecting their personal information." PACEI , 878 F.3d at 378 (emphasis in original). We read this holding to reject the possibility that § 208 can support an informational injury theory, at least in the absence of a colorable privacy harm of the type that Congress sought to prevent through the E-Government Act.

Section 208 was not designed to vest a general right to information in the public. Rather, the statute was designed to protect individual privacy by focusing agency analysis and improving internal agency decision-making. In this respect, § 208 is fundamentally different from statutes like the Freedom of Information Act (FOIA) where the harm Congress sought to prevent was a lack of information itself. Unlike § 208, FOIA was designed to grant enforceable rights to information in the general public. The "broad mandate of the FOIA is to provide for open disclosure of public information" and to allow citizens "to be informed about what their government is up to." Baldrige v. Shapiro , 455 U.S. 345 , 352, 102 S.Ct. 1103 , 71 L.Ed.2d 199 (1982) ; DOJ v. Reporters Comm. for Freedom of Press , 489 U.S. 749 , 773, 109 S.Ct. 1468 , 103 L.Ed.2d 774 (1989) (internal quotations omitted). These purposes stand in contrast with the stated agency-centric purpose of § 208 to "ensure sufficient protections for the privacy of personal information as agencies implement citizen-centered electronic Government." E-Government Act § 208(a) (emphasis added).

Because the lack of information itself is not the harm that Congress sought to prevent through § 208, EPIC must show how the lack of a timely PIA caused its members to suffer the kind of harm that Congress did intend to prevent: harm to individual privacy. See PACEI, 878 F.3d at 378 . As discussed in Part II.B.1, however, EPIC cannot allege an imminent privacy harm without assuming the independent violation of other laws by the Census Bureau. This is too speculative to support standing. For this reason, we hold that EPIC cannot satisfy the second step of the Jewell analysis, and cannot show an informational injury, just as it cannot show a privacy injury.

C. Disposition

Because we conclude that EPIC has failed, as a matter of law, to show that any of its members have suffered a concrete privacy or informational injury, we lack jurisdiction to proceed and must remand the case for dismissal. Indeed, we retain jurisdiction only "for the purpose of correcting the error of the lower court in entertaining the suit." Steel Co. , 523 U.S. at 95 , 118 S.Ct. 1003 .

We take a moment to explain why we have sometimes affirmed the denial of a preliminary injunction based on a standing-related defect, but do not do so here. One showing a plaintiff must make to obtain a preliminary injunction is "a substantial likelihood of success on the merits." Food & Water Watch, Inc. v. Vilsack , 808 F.3d 905 , 913 (D.C. Cir. 2015). "[T]he 'merits' on which plaintiff must show a likelihood of success encompass not only substantive theories but also establishment of jurisdiction." Id. (quoting Obama v. Klayman , 800 F.3d 559 , 565 (D.C. Cir. 2015) (Williams, J., concurring)). In determining whether the plaintiff has "a substantial likelihood of success on the merits," then, we have considered whether the plaintiff has a "substantial likelihood of standing"-that is, whether the plaintiff is likely to be able to demonstrate standing at the summary judgment stage. See id. at 912 (standing must be evaluated "under the heightened standard for evaluating a motion for summary judgment" in "determining whether or not to grant the motion for preliminary injunction"); see also Bennett v. Spear , 520 U.S. 154 , 167-68, 117 S.Ct. 1154 , 137 L.Ed.2d 281 (1997) ("[E]ach element of Article III standing 'must be supported in the same way as any other matter on which the plaintiff bears the burden of proof, i.e. , with the same manner and degree of evidence required at the successive stages of litigation.'... [A] plaintiff must 'set forth' by affidavit or other evidence 'specific facts' to survive a motion for summary judgment." (first quoting Lujan v. Defenders of Wildlife , 504 U.S. 555 , 561, 112 S.Ct. 2130 , 119 L.Ed.2d 351 (1992), and then quoting Fed. R. Civ. P. 56(e) (1987))). "[A]n inability to establish a substantial likelihood of standing requires denial of the motion for preliminary injunction, not dismissal of the case." Food & Water Watch , 808 F.3d at 913 . Thus, in cases where we have found that a plaintiff had not established a "substantial likelihood of standing," we have affirmed the denial of a preliminary injunction. See, e.g. , PACEI , 878 F.3d at 377, 380 .

Notwithstanding these cases, if, in reviewing the denial of a preliminary injunction, we determine that a litigant cannot establish standing as a matter of law , the proper course is to remand the case for dismissal. See Crow Creek Sioux Tribe v. Brownlee , 331 F.3d 912 , 918 (D.C. Cir. 2003). Here, we find that EPIC lacks standing as a matter of law. As a result, our only remaining constitutional duty is to "correct[ ] the error of the lower court in entertaining the suit." See Steel Co. , 523 U.S. at 95 , 118 S.Ct. 1003 .

III. Conclusion

Because EPIC lacks standing, we vacate the district court's denial of the preliminary injunction and remand for the purpose of dismissal.

So ordered.