Opinion
1:21-cv-02156 (TNM)
03-25-2022
ELECTRONIC PRIVACY INFORMATION CENTER, Plaintiff, v. UNITED STATES POSTAL SERVICE, et al., Defendants.
MEMORANDUM OPINION
TREVOR N. MCFADDEN, U.S.D.J.
The Electronic Privacy Information Center (EPIC) is a frequent litigant in this circuit. Here, EPIC on its own behalf and on behalf of its members sues the U.S. Postal Service (USPS) and its law enforcement component for failure to comply with the E-Government Act. USPS disputes EPIC's standing for these claims. Indeed, in EPIC's prior actions the D.C. Circuit has rejected some of the standing theories that EPIC advances now. For all other theories, the Court agrees with USPS that EPIC has not met its burden to show a cognizable injury in fact. The Court will therefore grant USPS's motion to dismiss the Complaint.
I.
Congress passed the E-Government Act to improve the Government's use of information technology “in a manner consistent with laws regarding protection of personal privacy, national security, . . . and other relevant laws.” Pub. L. No. 107-347, § 2(b)(11), 116 Stat. 2899, 2901 (2002) (Act), codified at 44 U.S.C. § 3501 note. Section 208 of the Act requires an agency to conduct, review, and, “if practicable, ” publish a privacy impact assessment (PIA). Id. § 208(b)(1)(B). The agency must take these steps before it collects “information in an identifiable form permitting the physical or online contacting of a specific individual, ” if the agency imposes the same reporting requirements on “10 or more persons.” Id. § 208(b)(1).
Since “at least 2018, ” USPS has operated a “surveillance program known as the Internet Covert Operations Program (iCOP).” Am. Compl. ¶ 21, ECF No. 13 (Compl.). This program facilitates the identification of individuals and organizations who use “the mail or USPS online tools” for illegal purposes. Id. Through the program, USPS monitors social media posts to “search for potential threats of violence, ” id. ¶ 33, and identifies the users of the most worrisome accounts, see Id. ¶¶ 30-31. For that identification, USPS relies on facial recognition software.
Particularly relevant here is Clearview AI, which provides “a database of over 3 million images scraped from Facebook and other social media sites.” Id. ¶ 24. When a user inputs a person's image, the software compares that image against others in the database. See Id. If there is a match, Clearview AI gives “links to the individual's personal information, social media profiles, and other related online material.” Id. Using iCOP, USPS has identified multiple individuals. See Id. ¶¶ 30, 34.
Enter EPIC, a nonprofit membership organization committed to “oversight and analysis of government data collection activities.” Id. ¶ 6. In May 2021, EPIC submitted a FOIA request seeking a PIA for the facial recognition and social media monitoring systems used by iCOP. See Id. ¶ 42. USPS conducted a search but found no PIA. See Id. ¶ 43. EPIC renewed its request but never received a response. See Id. ¶¶ 50-56.
EPIC then filed this suit, making three claims. Count I alleges “unlawful agency action” under the Administrative Procedure Act (APA) because USPS began using iCOP and its attendant tools without conducting a PIA as required by the E-Government Act. See Id. ¶¶ 58- 65. Similarly, Count II alleges “agency action unlawfully withheld” because USPS “failed to conduct and publish” a PIA. Id. ¶ 67. And Count III seeks a writ of mandamus compelling USPS “to conduct and publish” a PIA and, until then, to suspend iCOP and the use of its software. Id. ¶ 78.
EPIC attached to its Complaint declarations from two of its members. See Hartzog Decl. ECF No. 13-5; Gropper Decl., ECF No. 13-6. Both members say that their personal data, including their “name and/or image, ” “are likely contained in Clearview AI's database” because both members habitually use social media and did so while iCOP “[was] known to have used social media monitoring tools.” Hartzog Decl. ¶¶ 9-10; Gropper Decl. ¶¶ 9-10.
USPS moves to dismiss EPIC's Complaint, arguing that EPIC lacks standing and has failed to properly state a claim. See Defs.' Mot. to Dismiss, ECF No. 14-1 (MTD). That motion is now ripe for decision.
II.
The Court begins and ends with standing. “[T]here is no justiciable case or controversy unless the plaintiff has standing.” West v. Lynch, 845 F.3d 1228, 1230 (D.C. Cir. 2017). As the party seeking federal jurisdiction, EPIC bears the burden to show standing. See Lujan v. Defs. of Wildlife, 504 U.S. 555, 560 (1992). EPIC “must show (1) it has suffered a concrete and particularized injury (2) that is fairly traceable to the challenged action of the defendant and (3) that is likely” redressable by a favorable decision from the Court. EPIC v. Pres. Advisory Comm'n on Election Integrity (EPIC I), 878 F.3d 371, 377 (D.C. Cir. 2017) (cleaned up).
When ruling on a motion to dismiss under Rule 12(b)(1), the Court “assume[s] the truth of all material factual allegations in the complaint and construe[s] the complaint liberally, granting [the] plaintiff the benefit of all inferences that can be derived from the facts alleged.” Am. Nat'l Ins. Co. v. FDIC, 642 F.3d 1137, 1139 (D.C. Cir. 2011) (cleaned up). The Court “may consider materials outside the pleadings in deciding whether to grant a motion to dismiss for lack of jurisdiction.” Cal. Cattlemen's Ass'n v. U.S. Fish and Wildlife Serv., 315 F.Supp.3d 282, 285 (D.D.C. 2018) (cleaned up). And the Court treats any documents attached to the Complaint-like the declarations from EPIC's members-“as if they are part of the complaint.” In re Cheney, 406 F.3d 723, 729 (D.C. Cir. 2005).
III.
EPIC argues that it has standing on two bases-organizational standing on its own behalf and associational standing on behalf of its members. The Court takes those in turn.
A.
EPIC can assert standing on its own behalf “if the defendant's actions cause a concrete and demonstrable injury to [EPIC's] activities that is more than simply a setback to the organization's abstract social interests.” ASPCA v. Feld Entm't, Inc., 659 F.3d 13, 25 (D.C. Cir. 2011) (cleaned up). EPIC argues that it has suffered an informational injury because USPS's failure to publish a PIA “unlawfully denied [ ] EPIC access to information” otherwise required by statute. Compl. ¶ 70, 75. For that informational gap to constitute an injury in fact, EPIC must allege that “(1) it has been deprived of information that, on its interpretation, a statute requires the government or a third party to disclose to it, and (2) it suffers, by being denied access to that information, the type of harm Congress sought to prevent by requiring disclosure.” Friends of Animals v. Jewell, 828 F.3d 989, 992 (D.C. Cir. 2016).
As a frequent filer in this circuit, EPIC is blessed and cursed with robust caselaw, some of which is directly relevant to its current arguments. The D.C. Circuit has twice rejected EPIC's argument that failure to publish a PIA creates an informational injury sufficient for standing. See EPIC v. Dep't of Commerce (EPIC II), 928 F.3d 95, 101 (D.C. Cir. 2019); EPIC I, 878 F.3d at 378. The third time is not the charm.
Start with the most obvious. In EPIC I, the D.C. Circuit held that § 208 of the E-Government Act “is intended to protect individuals.” 878 F.3d at 378 (emphasis in original). Because EPIC was not-and still is not-an individual, it is “not the type of plaintiff [ ] Congress had in mind.” Id. EPIC thus fails the second prong of the informational standing test. More, in EPIC II, the Circuit held that “the lack of information itself is not the harm that Congress sought to prevent through § 208.” 928 F.3d at 103. Instead, the statute prevented against “harm to individual privacy.” Id. at 104. Thus, an asserted informational injury under § 208 “cannot satisfy the second step” of the test for an informational injury in fact. Id.
For these reasons already propounded to EPIC by the D.C. Circuit, the Court finds that EPIC's alleged informational injury from the lack of a PIA does not confer organizational standing.
There is an old chestnut that insanity is doing the same thing over and over again and expecting a different result. And at law, an attorney who repeatedly raises arguments that have been squarely rejected in binding precedent risks sanctions. See, e.g., McLaughlin v. Bradlee, 803 F.2d 1197, 1205 (D.C. Cir. 1986). The Court reminds EPIC's attorneys to scrupulously adhere to their Rule 11 obligations in future cases.
B.
The Court turns next to EPIC's assertion of associational standing. EPIC has associational standing to sue on behalf of its members if, among other things, “at least one of [EPIC's] members has standing to sue in her or his own right[.]” EPIC II, 928 F.3d at 101.
EPIC says that its members have suffered informational and privacy injuries. See Pl.'s Opp'n to MTD at 13, 16, ECF No. 15 (Opp'n).
All page citations refer to the pagination generated by the Court's CM/ECF system.
1.
The Court applies the same two-pronged test to EPIC's claim that its members have suffered an informational injury. See EPIC II, 928 F.3d at 103. And EPIC makes the same arguments that it made for itself. So some of the Court's analysis of organizational standing also applies here. True, EPIC's members are individuals. But they still assert an informational injury, which the D.C. Circuit explained is not the “harm Congress sought to prevent through § 208.” Id. Thus, EPIC's members fail the second step of the test for an informational injury in fact.
EPIC's members also fail the first step. Section 208 does not on its face “require” disclosure of a PIA. Jewell, 828 F.3d at 992. Instead, the statute mandates disclosure “if practicable.” Act § 208(b)(1)(B)(iii). EPIC creatively responds that because Section 208 requires an agency to “conduct” a PIA, any PIA becomes an agency record disclosable under FOIA, thus meeting the first step of the informational injury test. See Opp'n at 15.
But EPIC misunderstands FOIA, which “does not require the disclosure of any specific information to anyone[.]” Pub. Citizen Health Rsrch. Grp. v. Pizzella, 513 F.Supp.3d 10, 20 (D.D.C. 2021). FOIA instead requires “access to records when a request has been made and [FOIA] exemptions are inapplicable.” Id. And as this Court has noted, FOIA also “does not require the government to create documents.” Jud. Watch, Inc. v. ODNI, No. 1:17-cv-508 (TNM), 2018 WL 1440186 at *3 (D.D.C. Mar. 22, 2018); accord SafeCard Servs., Inc. v. SEC, 926 F.2d 1197, 1201 (D.C. Cir. 1991) (noting that FOIA does not require agencies to “recreate or to reacquire a document that it no longer has”). FOIA thus would not mandate disclosure of information in PIAs that do not exist. Indeed, if FOIA clears the first step for informational standing, a plaintiff would always meet that step. Such a holding “would all but eviscerate the requirement.” Pub. Citizen, 513 F.Supp.3d at 20. Waterkeeper Alliance v. EPA, 853 F.3d 527 (D.C. Cir. 2017), is not to the contrary. There, organizations challenged a final EPA rule that exempted certain entities from a reporting requirement in the Comprehensive Environmental Response, Compensation, and Liability Act (CERCLA). See Id. at 532. CERCLA contains no disclosure requirement. See Id. at 533. So the EPA argued that the organizations lacked standing because the CERCLA exemption did not deprive them of any information. See Id. The D.C. Circuit disagreed, however, because another statute, the Emergency Planning and Community Right-to-Know Act (EPCRA), required public disclosure of events when those events also merited a report to the EPA under CERCLA. See Id. In other words, EPCRA's disclosure mandates were “piggybacked on the CERCLA mandates in one form or another.” Id. Thus, exemptions from CERCLA reporting requirements “had the automatic effect of cutting back on EPCRA reporting and disclosure requirements[, ]” a mechanism that deprived the organizations of information otherwise required for disclosure. Id. at 534.
The E-Government Act and FOIA share none of the “complex interplay” present between the two statutes in Waterkeeper. Id. at 533. That FOIA and the E-Government Act “seek to achieve the same goal of public disclosure” does not matter. Opp'n at 16. Nothing in FOIA is “expressly tied” to the E-Government Act, or vice versa. Waterkeeper, 853 F.3d at 533. The “closer, direct connection” between CERCLA and EPCRA in Waterkeeper is thus “utterly lacking” here. Jud. Watch, 2018 WL 1440186, at *3.
The Court holds that EPIC has not asserted on behalf of its members an informational injury in fact.
And even if EPIC has, that injury is not redressable. Section 208 requires disclosure of a PIA only when “practicable.” Thus, if the Court granted EPIC's request and ordered USPS to follow § 208, that provision does not require publication of the PIA. Without guaranteed disclosure of the information allegedly withheld, EPIC cannot redress its informational injury. See Lawyers' Comm. for 9/11 Inquiry, Inc. v. Wray, 848 Fed.Appx. 428, 430 (D.C. Cir. 2021) (denying standing for informational injury when statute “stop[ped] short of imposing” a public disclosure requirement).
2.
EPIC next argues that its members have suffered injuries to their privacy. See Opp'n at 16-18. For support, EPIC relies mainly on two declarations. Both members “maintain social media profiles containing their images and personal information[]” and “were active on social media in 2020” when iCOP allegedly patrolled those sites. Id. at 17. Based on that activity and the “3 billion faces” in the Clearview AI database, EPIC says that its members are “highly likely” to appear in that database. Id.; see Hartzog Decl. ¶ 9; Gropper Decl. ¶ 9. USPS thus, EPIC says, used technology containing personal information without “first conduct[ing] a required analysis of the resulting privacy risks[.]” Opp'n at 17.
EPIC labels that failure a “privacy injury sufficient for Article III standing.” Id. But EPIC's own words undermine that characterization. Nowhere does EPIC challenge USPS's mere use of the technology. Instead, the only alleged injury is that USPS did so without “first conduct[ing] a required” PIA under § 208. Id. EPIC therefore “allege[s] a bare procedural violation” of the Act. Spokeo, Inc. v. Robins, 578 U.S. 330, 341 (2016). Such a violation does not create an injury in fact without an underlying concrete harm. See Summers v. Earth Island Inst., 555 U.S. 488, 496 (2009). So to show a plausible privacy injury-which is the injury that EPIC says its members suffered-“EPIC must allege harm that is distinct from a simple failure to comply with the procedural requirements of § 208.” EPIC II, 928 F.3d at 102.
EPIC has not done so. Privacy injuries “ordinarily stem from the disclosure of private information.” Id.; see In re SAIC Backup Tape Data Theft Litig., 45 F.Supp.3d 14, 28 (D.D.C. 2014) (“For a person's privacy to be invaded, their personal information must, at a minimum, be disclosed to a third party.”). Indeed, the D.C. Circuit has recognized a privacy injury only when personal information has been disclosed to third parties or there is a risk of such disclosure. See In re U.S. OPM Data Sec. Breach Litig., 928 F.3d 42, 56 (D.C. Cir. 2019); Owner-Operator Indep. Drivers Ass'n, Inc. v. DOT (OOIDA), 879 F.3d 339, 345 (D.C. Cir. 2018). In contrast, EPIC makes no allegation that USPS has disclosed any personal information of EPIC's members or is likely to do so. That deficiency in the Complaint is fatal to EPIC's assertion of a privacy injury. See Stewart v. Kendall, - F.Supp.3d -, No. 21-cv-1387 (RCL), 2022 WL 35642 at *5 (D.D.C. Jan. 4, 2022).
True, information gleaned from Clearview is now part of USPS's internal records. That arguably constitutes a disclosure. But D.C. Circuit precedent forecloses that argument, too. In OOIDA, the Circuit held that the existence of inaccurate information in government databases, “absent dissemination, ” did not “amount[ ] to concrete injury.” 879 F.3d at 345; cf. EPIC v. Dep't of Educ., 48 F.Supp.3d 1, 15 (D.D.C. 2014) (finding no injury in fact when, assuming that school records included personal information, plaintiffs “failed to make any showing that it is likely the schools will disclose the information to unregulated third parties”). “If the mere maintenance of inaccurate information is not sufficient to confer standing, surely an agency's retention of prosaic personal information is not either.” Taylor v. FAA, 351 F.Supp.3d 97, 104 (D.D.C. 2018).
In response, EPIC relies on the Supreme Court's decisions in Americans for Prosperity Foundation v. Bonta, 141 S.Ct. 2373 (2021), and Shelton v. Tucker, 364 U.S. 479 (1960). According to EPIC, those cases show that “government collection of personal information can” create concrete harm even without disclosure to the public. Opp'n at 17. Plaintiffs in those cases, however, argued that state laws infringed on the First Amendment right to associate. See Bonta, 141 S.Ct. at 2379; Shelton, 364 U.S. at 490. In contrast, EPIC asserts no similar constitutional injury from the collection of its members' information. Those decisions are thus inapt. EPIC cannot rely on them to find standing for a different alleged injury. See Lewis v. Casey, 518 U.S. 343, 358 n. 6 (1996) (“[S]tanding is not dispensed in gross.”).
Even if EPIC did, the D.C. Circuit has emphasized its “grave doubts” about “a constitutional right of privacy in the nondisclosure of personal information, at least where the information is collected by the government but not disseminated publicly.” EPIC II, 928 F.3d at 102 (cleaned up).
In sum, EPIC alleges a bare statutory violation that is “divorced from any concrete” privacy injury. Spokeo, 578 U.S. at 341. EPIC has thus “failed to show that its members have suffered, or imminently will suffer, a privacy injury” from USPS's failure to conduct a PIA. EPIC II, 928 F.3d at 103.
IV.
For these reasons, the Court holds that EPIC lacks standing for any of its claims. The Court will therefore grant USPS's motion to dismiss. A separate Order will issue.