Electronic Privacy Information Center v. US Department of Commerce and Bureau of the Census , 928 F.3d 95 ( 2019 )

United States Court of Appeals
FOR THE DISTRICT OF COLUMBIA CIRCUIT
Argued May 8, 2019 Decided June 28, 2019
No. 19-5031
ELECTRONIC PRIVACY INFORMATION CENTER,
APPELLANT
v.
UNITED STATES DEPARTMENT OF COMMERCE AND BUREAU OF
THE CENSUS,
APPELLEES
Appeal from the United States District Court
for the District of Columbia
(No. 1:18-cv-02711)
John Davisson argued the cause for appellant. With him
on the briefs were Alan Butler and Marc Rotenberg.
Sarah Carroll, Attorney, U.S. Department of Justice,
argued the cause for appellees. With her on the brief was
Mark B. Stern, Attorney.
Before: HENDERSON and MILLETT, Circuit Judges, and
SENTELLE, Senior Circuit Judge.
2
Opinion for the Court filed by Senior Circuit Judge
SENTELLE.
SENTELLE, Senior Circuit Judge: On March 26, 2018, the
Department of Commerce announced that a citizenship
question would be added to the 2020 Census. The Electronic
Privacy Information Center (EPIC) contends that, before this
announcement was made, its members were entitled to a
Privacy Impact Assessment by law. EPIC sued to enjoin the
addition of the question on this basis, and now appeals the
district court’s denial of its motion for a preliminary
injunction. Because EPIC lacks standing, we remand to the
district court with instructions to dismiss.
I. Background
A. The E-Government Act
In 2002, Congress passed the E-Government Act to
modernize and regulate the government’s use of information
technology. Pub. L. No. 107-347, 116 Stat. 2899 (codified at
44 U.S.C. § 3501 note) (hereinafter “E-Government Act”).
The Act outlines eleven purposes. Nine involve improving
government efficiency, organization, and decision-making. E-
Government Act § 2(b). In addition to these predominantly
agency-centric goals, however, the Act also aims to “provide
increased opportunities for citizen participation in
Government,” and “[t]o make the Federal Government more
transparent and accountable.” §§ 2(b)(2), (9).
Section 208 of the Act contains privacy provisions. Its
stated purpose is to “ensure sufficient protections for the
privacy of personal information as agencies implement
citizen-centered electronic Government.” E-Government Act
§ 208(a). To effectuate this purpose, § 208 requires federal
3
agencies to conduct, review, and, “if practicable,” publish, a
Privacy Impact Assessment (PIA) before “initiating a new
collection of information” that involves personally
identifiable information that will be “collected, maintained, or
disseminated using information technology.” § 208(b)(1)(A)–
(B). A “collection of information” is defined as “obtaining,
causing to be obtained, soliciting, or requiring the
disclosure . . . of facts or opinions” through “identical
questions posed to . . . ten or more persons.” 44 U.S.C.
§ 3502(3)(A). The word “initiating” is not defined by statute.
A PIA required by a new collection of information must
address, at a minimum: what information will be collected,
why it is being collected, how it will be used, how it will be
secured, with whom it will be shared, whether a system of
records is being created under the Privacy Act, and what
“notice or opportunities for consent” will be provided to those
impacted. E-Government Act § 208(b)(2)(B)(ii).
B. The Census
To apportion representatives among the several States,
the Census Clause of the United States Constitution requires
an “actual Enumeration” of the United States population. U.S.
Const. art. I, § 2, cl. 3. The census occurs every ten years, “in
such Manner as [Congress] shall by Law direct.” Id. Pursuant
to this command, Congress passed a series of census laws
directing the Secretary of Commerce to conduct a decennial
census and establishing the Census Bureau as an agency
within the Department of Commerce. 13 U.S.C. §§ 2, 141(a).
These laws give the Secretary broad authority to “obtain such
other census information as necessary.” Id. § 141(a). The
census has historically included a wide variety of
demographic questions, often including questions about
citizenship status. With few exceptions, a refusal to answer
4
“any of the questions” on the census is a violation of law. 13
U.S.C. § 221.
The Census Bureau operates at least six information
technology (IT) systems that process, store, and disseminate
personally identifiable information from census responses.
The primary system used for the census is called “CEN08.”
This system shares information with five other systems:
“CEN21,” “CEN05,” “CEN11,” “CEN13,” and “CEN18.”
The Bureau maintains a PIA for each system on a publicly-
available website. Because the use of the systems changes
regularly, the Bureau reviews and updates each assessment at
least once per year.
C. The Challenge
On March 26, 2018, the Secretary of Commerce, Wilbur
Ross, announced that a citizenship question would be added
to the 2020 Census. A variety of legal challenges to the merits
of that decision followed.
This case presents a narrow question: when does the
addition of the citizenship question need to be addressed in a
PIA? The parties agree that the E-Government Act requires
the government to complete a PIA before “initiating a new
collection of information.” E-Government Act
§ 208(b)(1)(A)(ii). Their disagreement involves the meaning
of the word “initiating.” The Census Bureau believes that it
does not initiate a collection of information until it solicits
information from the public. If this is correct, then the Bureau
is not required to produce PIAs until questionnaires are
mailed out in 2020. The Government has consistently
provided assurances, both before the district court and here on
appeal, that the assessments will be completed “before it
distributes any 2020 Decennial Census questionnaires.” See,
5
e.g., Gov. Br. at 30. Indeed, the PIA updates have been in
progress as this litigation proceeded, and an updated PIA
addressing the citizenship question was published for one of
the six relevant IT systems (CEN08) a few days before this
Court heard oral argument. Notwithstanding these assurances
and evidence of progress, EPIC, a public interest research
center focused on privacy and civil liberties, challenges the
Government’s interpretation. In EPIC’s view, the decision to
add the question was the initiation of information collection.
If this interpretation is correct, the completed PIAs were
required before the decision to add the question was
announced on March 26, 2018.
Eight months after Secretary Ross’s announcement, EPIC
filed a complaint in the district court. It alleged three counts
against the Department of Commerce and the Bureau of the
Census—two under the Administrative Procedure Act and
one under the Declaratory Judgment Act. Count One alleges
that the Secretary committed an unlawful act under 5 U.S.C.
§ 706(2)(a) and (c) when he announced the decision to add
the citizenship question before completing the PIAs.
Similarly, Count Two alleges that the government unlawfully
withheld agency action, in violation of 5 U.S.C. § 706(1), by
failing to timely complete and publish the PIAs. Count Three
seeks a declaration of rights under 28 U.S.C. § 2201(a).
Among other requested relief, EPIC asks the court to: (1) set
aside the decision to add the citizenship question; (2) order
that the decision be revoked until the PIAs are completed and
published; and (3) order the completion and publication of the
PIAs.
On January 18, 2019, EPIC moved for a preliminary
injunction. In the text of the proposed order submitted with its
motion, EPIC asked that the Census Bureau be “enjoined
from initiating any collection of citizenship status
6
information.” Pl.’s Mot. Prelim. Inj. Attach. 2 at 1 (emphasis
added). This is curious, since EPIC’s entire argument is that
such collection has already been initiated. Nevertheless, the
district court denied the motion because EPIC failed to show a
likelihood of success on the merits or a likelihood of
irreparable harm. EPIC v. U.S. Dep’t of Commerce, 356 F.
Supp. 3d 85, 89, 95–97 (D.D.C. 2019). The district court held
that EPIC was not likely to succeed on the merits because
“initiating a new collection of information” requires more
than a decision to collect information at some point in the
future. Id. at 89–91. The court agreed with the Government
that collection did not begin until the first set of census
questions was mailed out. Id. at 90. The district court also
concluded that EPIC was not likely to suffer irreparable harm
since the collection of citizenship information—set to occur in
2020—was not imminent. Id. at 95–97. EPIC timely appealed
the denial of its motion.
II. Jurisdiction
We have the statutory jurisdiction to review the denial of
a preliminary injunction under 28 U.S.C. § 1292(a)(1). Before
we review the merits of this appeal, however, we must
consider whether federal courts have the constitutional power
to decide this case in the first place. “Every federal appellate
court has a special obligation to satisfy itself not only of its
own jurisdiction, but also that of the lower courts in a cause
under review . . . .” Arizonans for Official English v. Arizona,
520 U.S. 43, 73 (1997) (internal quotations omitted). “When
the lower federal court lacks jurisdiction, we have jurisdiction
on appeal, not of the merits but merely for the purpose of
correcting the error of the lower court in entertaining the
suit.” Steel Co. v. Citizens for a Better Env’t, 523 U.S. 83, 95
(1998) (internal quotations omitted).
7
“The Constitution limits our ‘judicial Power’ to ‘Cases’
and ‘Controversies,’ U.S. Const. art. III, § 2, cl. 1.” West v.
Lynch, 845 F.3d 1228, 1230 (D.C. Cir. 2017) (citing Steel
Co., 523 U.S. at 102). “[T]here is no justiciable case or
controversy unless the plaintiff has standing.” Id. “To
establish standing, the plaintiff must show (1) it has suffered a
concrete and particularized injury (2) that is fairly traceable to
the challenged action of the defendant and (3) that is likely to
be redressed by a favorable decision, i.e., a decision granting
the plaintiff the relief it seeks.” EPIC v. Presidential Advisory
Comm’n on Election Integrity (PACEI), 878 F.3d 371, 376–
77 (D.C. Cir. 2017) (internal quotations omitted). EPIC is
required to establish standing as to each claim, and each form
of requested relief. See id. at 377. Since the three counts in
EPIC’s complaint involve a repackaging of the same
underlying grievance, we need not undertake a separate
standing analysis as to each claim.
As an organization, EPIC can assert standing in one of
two ways. It can assert standing on its own behalf, as an
organization, or on behalf of its members, as associational
standing. See Am. Soc. for Prevention of Cruelty to Animals v.
Feld Entm’t, Inc., 659 F.3d 13, 24 (D.C. Cir. 2011). As we
will explain, EPIC’s assertion of organizational standing is
plainly foreclosed by precedent. Its assertion of associational
standing also fails, because it has not identified a concrete
injury suffered by one of its members.
A. Organizational Standing
“[A]n organization may establish Article III standing if it
can show that the defendant’s actions cause a concrete and
demonstrable injury to the organization’s activities that is
more than simply a setback to the organization’s abstract
social interests.” Feld Entm’t, 659 F.3d at 25 (internal
8
quotations omitted). This Court has previously considered and
rejected EPIC’s assertion of organizational standing with
respect to § 208 of the E-Government Act. PACEI, 878 F.3d
371. In PACEI, EPIC challenged the authority of the
Presidential Advisory Commission on Election Integrity to
collect voter information from each state without first
publishing a PIA as required by § 208. 878 F.3d at 374. The
requested relief included: (1) an order requiring the PACEI to
“promptly” publish a PIA and (2) an order enjoining its
collection of voter data. Id. at 377, 380. We held that EPIC
did not have organizational standing to compel the publication
of a PIA or to seek an injunction barring the collection of
information. Id. at 378, 380. On both counts, EPIC was
unable to show how the failure to publish a PIA concretely
injured its organizational interest. Id. at 379. We held that
§ 208 did not confer an informational interest on EPIC as an
organization, and any resources spent obtaining information
that would otherwise have been in a PIA was a “self-inflicted
budgetary choice that cannot qualify as an injury in fact.” Id.
The same reasoning applies to the present complaint. Thus,
any assertion of organizational standing by EPIC under § 208
is foreclosed by our prior precedent.
B. Associational Standing
With organizational standing out of the question, we turn
to EPIC’s assertion of associational standing. An organization
can assert associational standing on behalf of its members if:
“(1) at least one of their members has standing to sue in her or
his own right, (2) the interests the association seeks to protect
are germane to its purpose, and (3) neither the claim asserted
nor the relief requested requires the participation of an
individual member in the lawsuit.” Am. Library Ass’n v. FCC,
401 F.3d 489, 492 (D.C. Cir. 2005).
9
We begin our analysis by observing that EPIC is a
membership organization. Respondent contends that our
precedent determines that EPIC is not, citing PACEI. It is true
that when we issued our decision in PACEI, we noted that “as
far as the record shows, [EPIC] has no traditional
membership[.]” 878 F.3d at 380. Since that decision issued,
however, the nature of the organization has changed. In
January 2018, EPIC amended its bylaws. The new bylaws
require the organization to designate “members” who must be
“distinguished experts in law, technology, and public policy.”
Members are eligible to sit on the Board of Directors. They
also provide leadership to the organization and pay dues. We
implicitly recognized that these changes were enough to turn
EPIC into a membership organization when we conducted an
associational standing analysis in EPIC v. FAA, 892 F.3d
1249, 1253-55 (D.C. Cir. 2018). We expressly recognize it
here.
Having established that EPIC is a membership
organization, we can examine the first prong of the
associational standing analysis. At this step, EPIC must show,
for each of its claims, that at least one of its members has
standing. See Am. Library Ass’n, 401 F.3d at 492. By
necessity, this requires at least one of EPIC’s members to
have suffered a “concrete and particularized” injury. See
Lujan v. Defs. of Wildlife, 504 U.S. 555, 560 (1992). EPIC
avers that its members have suffered, or will suffer, both
informational and privacy injuries. However, they have made
no such showing.
10
1. Privacy Injury
EPIC asserts that its members will suffer a privacy injury
if their citizenship status information is “unlawfully
collected.” EPIC argues that the act of collecting information
without a PIA, by itself, constitutes an imminent, concrete,
and particularized privacy injury. But “a bare procedural
violation, divorced from any concrete harm, [does not] satisfy
the injury-in-fact requirement of Article III.” Spokeo, Inc. v.
Robins, 136 S. Ct. 1540, 1549 (2016). Therefore, to plausibly
show a privacy injury, EPIC must allege harm that is distinct
from a simple failure to comply with the procedural
requirements of § 208. In the privacy context, such harm
would ordinarily stem from the disclosure of private
information. Since EPIC has not shown how a delayed PIA
would lead to a harmful disclosure, its privacy injury theory
fails.
Disclosure of individual census responses to third parties
is prohibited by law. 13 U.S.C. § 9. A census response may
not be used for “any purpose other than the statistical
purposes for which it is supplied” and only “sworn officers
and employees of the Department [of Commerce] or [Census]
[B]ureau” may examine individual reports. Id. § 9(a)(1), (3).
Responses are not even admissible as evidence in court in
most circumstances. Id. § 9(a). We agree with the Southern
District of New York that “it is pure speculation to suggest
that the Census Bureau will not comply with its legal
obligations to ensure the privacy of respondents’ data or that
those legal obligations will be amended.” New York v. U.S.
Dep’t of Commerce, 351 F. Supp. 3d 502, 619 (S.D.N.Y.
2019). More specifically, EPIC has not convinced us that a
delay in receiving a PIA will make the Census Bureau any
less likely to comply with these laws. Speculation, we have
said before, “is ordinarily fatal to standing.” PACEI, 878 F.3d
11
at 379 (citing DaimlerChrysler Corp. v. Cuno, 547 U.S. 332,
344 (2006)). Therefore, to the extent that EPIC relies on the
potential disclosure of their citizenship status to third parties
as the source of injury, we reject the theory as a “speculative
chain of possibilities” that cannot establish an injury. Accord
Clapper v. Amnesty Int’l USA, 568 U.S. 398, 414 (2013).
For the first time on appeal, EPIC also suggests that its
members have a constitutional privacy interest in keeping
their citizenship status private from the government itself.
EPIC cites Whalen v. Roe and Nixon v. Administrator of
General Services for the proposition that its members have an
interest in “avoiding disclosure of personal matters” and that
“informational privacy is ‘implicit in the concept of ordered
liberty.’” Appellant Reply Br. at 10 (citing Whalen, 429 U.S.
589, 599 n.23 (1977); Nixon, 433 U.S. 425, 455 (1977)). We
have previously expressed “grave doubts as to the existence
of a constitutional right of privacy in the nondisclosure of
personal information,” at least “where the information is
collected by the government but not disseminated publicly.”
Am. Fed’n of Gov’t Employees v. HUD, 118 F.3d 786, 791,
794 (D.C. Cir. 1997). These doubts are particularly acute
where the information in question is as deeply entwined with
national sovereignty and governance as citizenship status.
We need not resolve this issue today, however, because
EPIC has not squarely challenged the merits or
constitutionality of the citizenship question in this case.
Rather, they challenge the procedural propriety of the
government’s collection of this information in the absence of
a timely PIA. The narrow question before the Court—a
question about the timing of PIAs—is completely
“[dis]connected” from the broader question of whether a
citizenship question on the census is constitutionally
permissible. Accord Sugar Cane Growers Co-op. of Fla. v.
12
Veneman, 289 F.3d 89, 94–95 (D.C. Cir. 2002). Therefore, for
the purposes of this litigation, the existence or scope of a right
to informational privacy with respect to citizenship status is
not relevant. EPIC has not shown that the timing for
publishing PIAs is plausibly connected to the government’s
collection of private information that it would not otherwise
collect. Especially because, as previously noted (page 2,
supra), the principal purpose of the impact assessment is not
to deter collection in the first place, but instead to improve
upon an agency’s storage and sharing practices.
In short, EPIC has failed to show that its members have
suffered, or imminently will suffer, a privacy injury as a result
of a delayed PIA.
2. Informational Injury
Having concluded that EPIC’s members have not
suffered a privacy injury, we turn to the contention that they
have suffered an informational injury. To show an
informational injury, a plaintiff must show: “(1) it has been
deprived of information that, on its interpretation, a statute
requires the government or a third party to disclose to it, and
(2) it suffers, by being denied access to that information, the
type of harm Congress sought to prevent by requiring
disclosure.” Friends of Animals v. Jewell, 828 F.3d 989, 992
(D.C. Cir. 2016). Mirroring our analysis in PACEI, we do not
consider whether EPIC satisfies the first prong of the analysis,
because EPIC’s members cannot satisfy the second. See
PACEI, 878 F.3d at 378.
Even if § 208 requires the disclosure of PIAs to EPIC’s
members, the organization cannot show that those members
have suffered the “type of harm Congress sought to prevent
by requiring disclosure.” See Jewell, 828 F.3d at 992. In
13
PACEI, this Court considered what type of harm § 208 of the
E-Government Act was designed to prevent. We held that
§ 208 “is directed at individual privacy” and protects
individuals “by requiring an agency to fully consider their
privacy before collecting their personal information.” PACEI,
878 F.3d at 378 (emphasis in original). We read this holding
to reject the possibility that § 208 can support an
informational injury theory, at least in the absence of a
colorable privacy harm of the type that Congress sought to
prevent through the E-Government Act.
Section 208 was not designed to vest a general right to
information in the public. Rather, the statute was designed to
protect individual privacy by focusing agency analysis and
improving internal agency decision-making. In this respect,
§ 208 is fundamentally different from statutes like the
Freedom of Information Act (FOIA) where the harm
Congress sought to prevent was a lack of information itself.
Unlike § 208, FOIA was designed to grant enforceable rights
to information in the general public. The “broad mandate of
the FOIA is to provide for open disclosure of public
information” and to allow citizens “to be informed about what
their government is up to.” Baldrige v. Shapiro, 455 U.S. 345,
352 (1982); DOJ v. Reporters Comm. for Freedom of Press,
489 U.S. 749, 773 (1989) (internal quotations omitted). These
purposes stand in contrast with the stated agency-centric
purpose of § 208 to “ensure sufficient protections for the
privacy of personal information as agencies implement
citizen-centered electronic Government.” E-Government Act
§ 208(a) (emphasis added).
Because the lack of information itself is not the harm that
Congress sought to prevent through § 208, EPIC must show
how the lack of a timely PIA caused its members to suffer the
kind of harm that Congress did intend to prevent: harm to
14
individual privacy. See PACEI, 878 F.3d at 378. As discussed
in Part II.B.1, however, EPIC cannot allege an imminent
privacy harm without assuming the independent violation of
other laws by the Census Bureau. This is too speculative to
support standing. For this reason, we hold that EPIC cannot
satisfy the second step of the Jewell analysis, and cannot
show an informational injury, just as it cannot show a privacy
injury.
C. Disposition
Because we conclude that EPIC has failed, as a matter of
law, to show that any of its members have suffered a concrete
privacy or informational injury, we lack jurisdiction to
proceed and must remand the case for dismissal. Indeed, we
retain jurisdiction only “for the purpose of correcting the error
of the lower court in entertaining the suit.” Steel Co., 523 U.S.
at 95.
We take a moment to explain why we have sometimes
affirmed the denial of a preliminary injunction based on a
standing-related defect, but do not do so here. One showing a
plaintiff must make to obtain a preliminary injunction is “a
substantial likelihood of success on the merits.” Food &
Water Watch, Inc. v. Vilsack, 808 F.3d 905, 913 (D.C. Cir.
2015). “[T]he ‘merits’ on which plaintiff must show a
likelihood of success encompass not only substantive theories
but also establishment of jurisdiction.” Id. (quoting Obama v.
Klayman, 800 F.3d 559, 565 (D.C. Cir. 2015) (Williams, J.,
concurring)). In determining whether the plaintiff has “a
substantial likelihood of success on the merits,” then, we have
considered whether the plaintiff has a “substantial likelihood
of standing”—that is, whether the plaintiff is likely to be able
to demonstrate standing at the summary judgment stage. See
id. at 912 (standing must be evaluated “under the heightened
15
standard for evaluating a motion for summary judgment” in
“determining whether or not to grant the motion for
preliminary injunction”); see also Bennett v. Spear, 520 U.S.
154, 167–68 (1997) (“[E]ach element of Article III standing
‘must be supported in the same way as any other matter on
which the plaintiff bears the burden of proof, i.e., with the
same manner and degree of evidence required at the
successive stages of litigation.’. . . [A] plaintiff must ‘set
forth’ by affidavit or other evidence ‘specific facts’ to survive
a motion for summary judgment.” (first quoting Lujan v.
Defenders of Wildlife, 504 U.S. 555, 561 (1992), and then
quoting Fed. R. Civ. P. 56(e) (1987))). “[A]n inability to
establish a substantial likelihood of standing requires denial of
the motion for preliminary injunction, not dismissal of the
case.” Food & Water Watch, 808 F.3d at 913. Thus, in cases
where we have found that a plaintiff had not established a
“substantial likelihood of standing,” we have affirmed the
denial of a preliminary injunction. See, e.g., PACEI, 878 F.3d
at 377, 380.
Notwithstanding these cases, if, in reviewing the denial
of a preliminary injunction, we determine that a litigant
cannot establish standing as a matter of law, the proper course
is to remand the case for dismissal. See Crow Creek Sioux
Tribe v. Brownlee, 331 F.3d 912, 918 (D.C. Cir. 2003). Here,
we find that EPIC lacks standing as a matter of law. As a
result, our only remaining constitutional duty is to “correct[]
the error of the lower court in entertaining the suit.” See Steel
Co., 523 U.S. at 95.
III. Conclusion
Because EPIC lacks standing, we vacate the district
court’s denial of the preliminary injunction and remand for
the purpose of dismissal.
So ordered.