Elec. Privacy Info. Ctr. v. United States Postal Serv.

1

ELECTRONIC PRIVACY INFORMATION CENTER, Plaintiff, v. UNITED STATES POSTAL SERVICE, et al., Defendants.

No. 1:21-cv-02156 (TNM)

United States District Court, District of Columbia

March 25, 2022

MEMORANDUM OPINION

TREVOR N. MCFADDEN, U.S.D.J.

The Electronic Privacy Information Center (EPIC) is a frequent litigant in this circuit. Here, EPIC on its own behalf and on behalf of its members sues the U.S. Postal Service (USPS) and its law enforcement component for failure to comply with the E-Government Act. USPS disputes EPIC's standing for these claims. Indeed, in EPIC's prior actions the D.C. Circuit has rejected some of the standing theories that EPIC advances now. For all other theories, the Court agrees with USPS that EPIC has not met its burden to show a cognizable injury in fact. The Court will therefore grant USPS's motion to dismiss the Complaint.

I.

Congress passed the E-Government Act to improve the Government's use of information technology “in a manner consistent with laws regarding protection of personal privacy, national security, . . . and other relevant laws.” Pub. L. No 107-347, § 2(b)(11), 116 Stat. 2899, 2901 (2002) (Act) codified at 44 U.S.C. § 3501 note. Section 208 of the Act requires an agency to conduct, review, and “if practicable, ” publish a privacy impact assessment (PIA). Id. § 208(b)(1)(B). The agency must take these steps before it collects “information in an identifiable form permitting the physical or online contacting of a specific individual, ” if the agency imposes the same reporting requirements on “10 or more persons.” Id. § 208(b)(1).

Since “at least 2018, ” USPS has operated a “surveillance program known as the Internet Covert Operations Program (iCOP).” Am. Compl. ¶ 21, ECF No. 13 (Compl.). This program facilitates the identification of individuals and organizations who use “the mail or USPS online tools” for illegal purposes. Id. Through the program, USPS monitors social media posts to “search for potential threats of violence, ” id. ¶ 33, and identifies the users of the most worrisome accounts, see Id. ¶¶ 30-31. For that identification, USPS relies on facial recognition software.

Particularly relevant here is Clearview AI, which provides “a database of over 3 million images scraped from Facebook and other social media sites.” Id. ¶ 24. When a user inputs a person's image, the software compares that image against others in the database. See Id. If there is a match, Clearview AI gives “links to the individual's personal information, social media profiles, and other related online material.” Id. Using iCOP, USPS has identified multiple individuals. See Id. ¶¶ 30, 34.

Enter EPIC, a nonprofit membership organization committed to “oversight and analysis of government data collection activities.” Id. ¶ 6. In May 2021, EPIC submitted a FOIA request seeking a PIA for the facial recognition and social media monitoring systems used by iCOP. See Id. ¶ 42. USPS conducted a search but found no PIA. See Id. ¶ 43. EPIC renewed its request but never received a response. See Id. ¶¶ 50-56.

EPIC then filed this suit, making three claims. Count I alleges “unlawful agency action” under the Administrative Procedure Act (APA) because USPS began using iCOP and its attendant tools without conducting a PIA as required by the E-Government Act. See Id. ¶¶ 58- 65. Similarly, Count II alleges “agency action unlawfully withheld” because USPS “failed to conduct and publish” a PIA. Id. ¶ 67. And Count III seeks a writ of mandamus compelling USPS “to conduct and publish” a PIA and, until then, to suspend iCOP and the use of its software. Id. ¶ 78.

EPIC attached to its Complaint declarations from two of its members. See Hartzog Decl. ECF No. 13-5; Gropper Decl., ECF No. 13-6. Both members say that their personal data, including their “name and/or image, ” “are likely contained in Clearview AI's database” because both members habitually use social media and did so while iCOP “[was] known to have used social media monitoring tools.” Hartzog Decl. ¶¶ 9-10; Gropper Decl. ¶¶ 9-10.

USPS moves to dismiss EPIC's Complaint, arguing that EPIC lacks standing and has failed to properly state a claim. See Defs.' Mot. to Dismiss, ECF No. 14-1 (MTD). That motion is now ripe for decision.

II.

The Court begins and ends with standing. “[T]here is no justiciable case or controversy unless the plaintiff has standing.” West v. Lynch, 845 F.3d 1228, 1230 (D.C. Cir. 2017). As the party seeking federal jurisdiction, EPIC bears the burden to show standing. See Lujan v. Defs. of Wildlife, 504 U.S. 555, 560 (1992). EPIC “must show (1) it has suffered a concrete and particularized injury (2) that is fairly traceable to the challenged action of the defendant and (3) that is likely” redressable by a favorable decision from the Court. EPIC v. Pres. Advisory Comm'n on Election Integrity (EPIC I), 878 F.3d 371, 377 (D.C. Cir. 2017) (cleaned up).

When ruling on a motion to dismiss under Rule 12(b)(1), the Court “assume[s] the truth of all material factual allegations in the complaint and construe[s] the complaint liberally, granting [the] plaintiff the benefit of all inferences that can be derived from the facts alleged.” Am. Nat'l Ins. Co. v. FDIC, 642 F.3d 1137, 1139 (D.C. Cir. 2011) (cleaned up). The Court “may consider materials outside the pleadings in deciding whether to grant a motion to dismiss for lack of jurisdiction.” Cal. Cattlemen's Ass'n v. U.S. Fish and Wildlife Serv., 315 F.Supp.3d 282, 285 (D.D.C. 2018) (cleaned up). And the Court treats any documents attached to the Complaint-like the declarations from EPIC's members-“as if they are part of the complaint.” In re Cheney, 406 F.3d 723, 729 (D.C. Cir. 2005).

III.

EPIC argues that it has standing on two bases-organizational standing on its own behalf and associational standing on behalf of its members. The Court takes those in turn.

A.

EPIC can assert standing on its own behalf “if the defendant's actions cause a concrete and demonstrable injury to [EPIC's] activities that is more than simply a setback to the organization's abstract social interests.” ASPCA v. Feld Entm't, Inc., 659 F.3d 13, 25 (D.C. Cir. 2011) (cleaned up). EPIC argues that it has suffered an informational injury because USPS's failure to publish a PIA “unlawfully denied [ ] EPIC access to information” otherwise required by statute. Compl. ¶ 70, 75. For that informational gap to constitute an injury in fact, EPIC must allege that “(1) it has been deprived of information that, on its interpretation, a statute requires the government or a third party to disclose to it, and (2) it suffers, by being denied access to that information, the type of harm Congress sought to prevent by requiring disclosure.” Friends of Animals v. Jewell, 828 F.3d 989, 992 (D.C. Cir. 2016).

As a frequent filer in this circuit, EPIC is blessed and cursed with robust caselaw, some of which is directly relevant to its current arguments. The D.C. Circuit has twice rejected EPIC's argument that failure to publish a PIA creates an informational injury sufficient for standing. See EPIC v. Dep't of Commerce (EPIC II), 928 F.3d 95, 101 (D.C. Cir. 2019); EPIC I, 878 F.3d at 378. The third time is not the charm.

Start with the most obvious. In EPIC I, the D.C. Circuit held that § 208 of the E-Government Act “is intended to protect individuals.” 878 F.3d at 378 (emphasis in original). Because EPIC was not-and still is not-an individual, it is “not the type of plaintiff [ ] Congress had in mind.” Id. EPIC thus fails the second prong of the informational standing test. More, in EPIC II, the Circuit held that “the lack of information itself is not the harm that Congress sought to prevent through § 208.” 928 F.3d at 103. Instead, the statute prevented against “harm to individual privacy.” Id. at 104. Thus, an asserted informational injury under § 208 “cannot satisfy the second step” of the test for an informational injury in fact. Id.

For these reasons already propounded to EPIC by the D.C. Circuit, the Court finds that EPIC's alleged informational injury from the lack of a PIA does not confer organizational standing.

There is an old chestnut that insanity is doing the same thing over and over again and expecting a different result. And at law, an attorney who repeatedly raises arguments that have been squarely rejected in binding precedent risks sanctions. See, e.g., McLaughlin v. Bradlee, 803 F.2d 1197, 1205 (D.C. Cir. 1986). The Court reminds EPIC's attorneys to scrupulously adhere to their Rule 11 obligations in future cases.

B.

The Court turns next to EPIC's assertion of associational standing. EPIC has associational standing to sue on behalf of its members if, among other things, “at least one of [EPIC's] members has standing to sue in her or his own right[.]” EPIC II, 928 F.3d at 101.

EPIC says that its members have suffered informational and privacy injuries. See Pl.'s Opp'n to MTD at 13, 16, ECF No. 15 (Opp'n).^[1]

1.

The Court applies the same two-pronged test to EPIC's claim that its members have suffered an informational injury. See EPIC II, 928 F.3d at 103. And EPIC makes the same arguments that it made for itself. So some of the Court's analysis of organizational standing also applies here. True, EPIC's members are individuals. But they still assert an informational injury, which the D.C. Circuit explained is not the “harm Congress sought to prevent through § 208.” Id. Thus, EPIC's members fail the second step of the test for an informational injury in fact.

EPIC's members also fail the first step. Section 208 does not on its face “require” disclosure of a PIA. Jewell, 828 F.3d at 992. Instead, the statute mandates disclosure “if practicable.” Act § 208(b)(1)(B)(iii). EPIC creatively responds that...