League of Women Voters v. U.S. Department of Homeland Security

majority opinion

UNITED STATES DISTRICT COURT

FOR THE DISTRICT OF COLUMBIA

LEAGUE OF WOMEN VOTERS, et al.,

Plaintiffs,

Civil Action No. 25 - 3501 (SLS)

Judge Sparkle L. Sooknanan

U.S. DEPARTMENT OF HOMELAND

SECURITY, et al.,

Defendants.

MEMORANDUM OPINION

This case implicates two fundamental rights that protect Americans from government

overreach: the right to privacy and the right to vote. In the past year, several federal agencies have

joined forces to create a centralized federal database that contains the private information of United

States citizens, including Social Security numbers, citizenship status, and other sensitive data. But

decades ago, Congress put protections in place to prevent precisely this type of centralized data

bank. And the record in this case shows that the federal agencies that created this database knew

that the database violates those statutory protections. The agencies were scrambling to comply

with an Executive Order aimed at reshaping federal elections, which directed them to create a

system for mass voter verification. So they haphazardly combined and repurposed the private

information of millions of Americans, including citizenship data that they knew to be unreliable.

Since then, states have partnered with the federal government to access the database and are

actively removing United States citizens from voter rolls based on inaccurate information. All in

all, the federal government has knowingly trampled on the privacy rights of American citizens in

a manner that threatens the sacred right to vote. This Court cannot stand idly by while that happens.

Last March, President Donald J. Trump signed a sweeping Executive Order directing

actions related to the administration of elections. Exec. Order No. 14248 of March 25, 2025,

Preserving and Protecting the Integrity of American Elections, 90 Fed. Reg. 14,005 (Mar. 28,

2025) (DHS AR 334–39). Several lawsuits followed, and courts across the country have since

enjoined various aspects of that Executive Order. As relevant here, the Executive Order instructed

certain federal agencies, including the Department of Homeland Security (DHS) and the Social

Security Administration (SSA), to put systems in place for state and local authorities to verify the

citizenship or immigration status of registered voters or individuals registering to vote. The

Executive Order triggered an overhaul of a system maintained by DHS to verify citizenship and

immigration status—the Systematic Alien Verification for Entitlements (SAVE) system. The 2025

SAVE overhaul modified the system in three major ways: (1) to include the records of naturalborn citizens, (2) to access SSA records, including Social Security numbers, and (3) to permit bulk

searches of records by SAVE users.

The League of Women Voters, its local affiliates, and the Electronic Privacy Information

Center sued DHS, SSA, and other federal governmental actors (collectively, the Federal

Defendants) to challenge the overhaul of SAVE, including the establishment of the modified

system and two related notices published by DHS and SSA. They allege that the modifications

transformed the system’s functionality, increased the scope of covered individuals, made SAVE

less accurate, violated statutory procedures, and were contrary to law. The Plaintiffs originally

moved for an Administrative Procedure Act (APA) stay, which this Court denied for failure to

show irreparable harm. Since then, states have run their voter rolls through the modified SAVE

system, and some of the Plaintiffs’ members have been wrongfully identified as non-citizens by

SAVE, resulting in the cancellation of their voter registrations. Meanwhile, the Court permitted

the State of Texas to intervene as a Defendant in this action.

The Plaintiffs now move for summary judgment. The Court agrees that the establishment

of the SAVE modified system and the notices that followed are unlawful in several respects. First,

they violate a prohibition in the Social Security Act against the disclosure of Social Security

numbers and other related SSA records. Second, they violate both substantive and procedural

protections in the Privacy Act, which prevent the non-consensual disclosure of certain information

(both by federal agencies and between federal agencies) and require notice and comment for

certain actions relevant here. Third, they violate the APA. The Court therefore sets aside and

vacates the 2025 SAVE modified system and the related notices because they were contrary to

law, arbitrary and capricious, in excess of statutory authority, and without observance of procedure

required by law.

BACKGROUND

A. Social Security Act

The Social Security Act of 1935 creates financial assistance benefit programs for certain

Americans. Pub. L. No. 74–271, 49 Stat. 620 (codified at 42 U.S.C. § 301 et seq.). Soon after its

enactment, the Social Security Board established the Social Security number (SSN) as an identifier

for “U.S. workers, enabling employers to submit accurate reports of covered earnings for use in

administering benefits under the new Social Security program.” Carolyn Puckett, The Story of the

Social Security Number, Soc. Sec. Bull., Vol. 69, No. 2 (July 2009), https://www.ssa.gov

/policy/docs/ssb/v69n2/v69n2p55.html [https://perma.cc/ H96G-835X]. This “is still the primary

purpose for the SSN.” Id.

Privacy was central to the newly formed regulatory scheme. In 1937, the Social Security

Board enacted its very first regulation, which “governed privacy and disclosure of Social Security

records.” Social Security History: Regulation No. 1, SSA, https://www.ssa.gov

/history/reg1.html [https://perma.cc/NGU4-FPM6]. That regulation prohibited any “member,

officer, or employee of the Board” from producing or disclosing “any record . . . or any information

acquired therefrom . . . pertaining to any person.” Disclosure of Official Records & Information,

2 Fed. Reg. 1,256, 1,256 (June 18, 1937). In 1939, Congress codified the language of that

regulation into the Social Security Act, prohibiting the disclosure of “any file, record, report, or

other paper, or any information” obtained by the Board except as the agency’s regulations

prescribe. Social Security Act Amendments of 1939, Pub. L. No. 76–379, title VIII, § 1106, 53

Stat. 1360, 1398 (codified as amended at 42 U.S.C. § 1306(a)). Today, the Social Security Act

expressly prohibits federal employees from disclosing the “[s]ocial security account numbers and

related records . . . obtained or maintained . . . pursuant to any provision of law enacted on or after

October 1, 1990.” 42 U.S.C. § 405(c)(2)(C)(viii)(I).

B. Privacy Act

The Privacy Act of 1974 establishes “certain safeguards for an individual against an

invasion of personal privacy by requiring Federal agencies” to “collect, maintain, use, or

disseminate any record of identifiable personal information in a manner that assures that such

action is for a necessary and lawful purpose.” Pub. L. No. 93–579, § 2(b)(4), 88 Stat. 1896, 1896

(codified at 5 U.S.C. § 552a note). The Act “was passed largely out of concern over ‘the impact of

computer data banks on individual privacy.’” U.S. DOJ v. Reps. Comm. for Freedom of the Press,

489 U.S. 749, 766 (1989) (quoting H.R. Rep. No. 93–1416, at 7 (1974)).

1. Statutory Background

The Privacy Act’s animating concern is that “the increasing use of computers and

sophisticated information technology, while essential to the efficient operations of the

Government, has greatly magnified the harm to individual privacy that can occur from any

collection, maintenance, use, or dissemination of personal information.” Privacy Act of 1974

§ 2(a)(2), 88 Stat. at 1896 (codified at 5 U.S.C. § 552a note). Indeed, the Act was precipitated by

proposals in the 1960s for a computerized “data center” maintained by the Executive Branch that

would bring “the data collected by various agencies into a single consistent body” and “identify

individual respondents in some way, [likely] by social security number.” Computer Privacy:

Hearings Before the Subcomm. on Admin. Prac. and Proc. of the S. Comm. on the Judiciary, 90th

Cong. 4–5 (1967) (statement of Carl Kaysen, Dir., Inst. for Advanced Study, Princeton Univ.).

Rather than garner support, these proposals “immediately caused a public outcry,” necessitating a

congressional response. Dongsheng Zang, The Privacy Act of 1974: The American Bill of Rights

on Data and Its Unfinished Business, 86 U. Pitt. L. Rev. 85, 100 (2024) (detailing the legislative

background of the Privacy Act of 1974).

Congress reacted by holding high-profile hearings on “The Computer and Invasion of

Privacy” and “Federal Data Banks,” where extensive criticism ensured that “the National Data

Center [idea was] probably dead.” Id. at 114–121 (citations omitted); see also Sampson v. Murray,

415 U.S. 61, 96 n.2 (1974) (Douglas, J., dissenting) (recognizing that the hearings reflected a

“congressional concern” that “we live in an Orwellian age in which the computer has become ‘the

heart of a [national] surveillance system’” (quoting Arthur R. Miller, Computers, Data Banks and

Individual Privacy: An Overview, 4 Colo. Human Rights L. Rev. 1, 2 (1972))). At the time, it

became evident that there was a grave “threat to privacy implicit in the accumulation of vast

amounts of personal information in computerized data banks or other massive government files,”

and that “[t]he right to collect and use such data for public purposes is typically accompanied by a

concomitant statutory or regulatory duty to avoid unwarranted disclosures.” Whalen v. Roe, 429

U.S. 589, 605 (1977).

Congress enacted the Privacy Act to address this “growing awareness that governmental

agencies were accumulating an ever-expanding stockpile of information about private individuals

that was readily susceptible to . . . inaccuracies that the citizen would never know of, let alone have

an opportunity to rebut or correct.” Londrigan v. FBI, 670 F.2d 1164, 1169 (D.C. Cir. 1981). It

responded with a detailed statutory scheme to prevent “the creation of secret information systems

or data banks” by the federal government that would result in “the wrongful disclosure and use, in

some cases, of [such] personal files held by Federal agencies.” Id. (quoting S. Rep. No. 1183, at 1,

2 (1974)). Thus, the Privacy Act “was designed to provide individuals with more control over the

gathering, dissemination, and accuracy of agency information about themselves,” Greentree v.

U.S. Customs Serv., 674 F.2d 74, 76 (D.C. Cir. 1982) (emphasis omitted), and to “establish

safeguards to protect individuals against the disclosure of confidential records ‘which could result

in substantial harm, embarrassment, inconvenience, or unfairness to any individual on whom

information is maintained,’” FAA v. Cooper, 566 U.S. 284, 294–95 (2012) (quoting 5 U.S.C.

§ 552a(e)(10)).

The statute’s provisions work together “to prevent the creation of formal or de facto

national data banks,” “centralized Federal information systems[,]” or “interagency computer data

banks”—by making it “legally impossible for the Federal Government in the future to put together

anything resembling a ‘1984’ personal dossier on a citizen, and [ensuring] proper regard for

individual privacy, the confidentiality of data, and the security of [any] system” of records

maintained by the federal government. See United States v. Weber, 816 F. Supp. 3d 1168, 1194

(C.D. Cal. 2026) (cleaned up) (quoting S. Comm. on Gov’t Operations & H.R. Comm. On Gov’t

Operations, 94th Cong., Source Book on Privacy 168, 217, 884 (Joint Comm. Print 1976)). The

Act accomplishes its goal through both substantive and procedural “safeguards . . . against an

invasion of personal privacy.” Cooper, 566 U.S. at 294–95 (quoting Privacy Act of 1974 § 2(b),

88 Stat. at 1896).

2. Substantive Safeguards

The Privacy Act’s substantive safeguards provide robust protections related to significant

governmental use and retention of identifiable personal information. See 5 U.S.C. § 552a. For

instance, the statute instructs federal agencies to “collect information to the greatest extent

practicable directly from the subject individual” when use of the information can adversely affect

the individual’s rights. Id. § 552a(e)(2). It requires agencies to maintain records “with such

accuracy, relevance, timeliness, and completeness as is reasonably necessary to assure fairness to

the individual.” Id. § 552a(e)(5). And it provides various mechanisms to give individuals notice of

what records are maintained by the federal government as well as to correct any inaccuracies in

those records. Id. § 552a(d)–(g). Importantly, the Act prohibits both inter-agency and extra-agency

disclosure of government records except in limited circumstances. Id. § 552a(b). One such

circumstance is a “routine use,” which is defined as “the use of such record for a purpose which is

compatible with the purpose for which it was collected.” Id. § 552a(a)(7), (b)(3).

The statute also has special provisions governing the use of Social Security numbers. The

Act provides that “[i]t shall be unlawful for any Federal, State or local government agency to deny

to any individual any right, benefit, or privilege provided by law because of such individual’s

refusal to disclose his social security account number.” Privacy Act of 1974 § 7(a)(1), 88 Stat.

at 1909 (codified at 5 U.S.C. § 552a note). The Act further requires that “[a]ny Federal, State, or

local government agency which requests an individual to disclose his social security account

number shall inform that individual whether that disclosure is mandatory or voluntary, by what

statutory or other authority such number is solicited, and what uses will be made of it.” Id. § 7(b),

88 Stat. at 1909.

In 1988, Congress amended the Privacy Act with the Computer Matching and Privacy

Protection Act of 1988. Pub. L. No. 100–503, 102 Stat. 2507 (codified at 5 U.S.C. § 552a note).

That statute prohibits federal agencies from disclosing records to other federal agencies, state

governments, or local governments through a “computer matching program” without a written

agreement. 5 U.S.C. § 552a(o)(1). The Act establishes various statutory procedures and

requirements governing such agreements. Id. § 552a(o). And it prohibits state or local governments

from duplicating or disclosing federal records received pursuant to such an agreement “except

where required by law or essential to the conduct of the matching program.” Id. § 552a(o)(1)(H).

That same prohibition applies to federal agencies with respect to records provided by “any State

or local government, or agency thereof, which discloses records to be used in a matching program.”

Id. § 552a(a)(11), (o)(1)(H).

Congress further provided that nothing in the 1988 Act “shall be construed to authorize

(1) the establishment or maintenance by any agency of a national data bank that combines, merges,

or links information on individuals maintained in systems of records by other Federal agencies;

(2) the direct linking of computerized systems of records maintained by Federal agencies”; or

“(3) the computer matching of records not otherwise authorized by law.” Computer Matching and

Privacy Protection Act of 1988 § 9, 102 Stat. at 2514.

3. Procedural Safeguards

The Privacy Act also prescribes procedural safeguards that apply when records maintained

by a federal agency—a so-called “system of records”—are changed or used in a new way. 5 U.S.C.

§ 552a(a)(5), (e). Congress enacted these safeguards to “permit an individual to determine what

records pertaining to him are collected, maintained, used, or disseminated by [federal] agencies”

and to ensure “adequate safeguards are provided to prevent misuse of such information.” Privacy

Act of 1974 § 2(b)(1), (4), 88 Stat. at 1896.

In relevant part, the statute establishes strict notice and comment requirements in these

circumstances. 5 U.S.C. § 552a(e)(4), (11). When an agency “establish[es] or revis[es]” any

“system of records,” it must “publish in the Federal Register . . . a notice of the existence and

character of the system of records,” i.e., a System of Records Notice (SORN). Id. § 552a(e)(4).

Each SORN “shall include” nine categories of information:

(A) the name and location of the system;

(B) the categories of individuals on whom records are maintained in the system;

(D) each routine use of the records contained in the system, including the categories

of users and the purpose of such use;

(E) the policies and practices of the agency regarding storage, retrievability, access

controls, retention, and disposal of the records;

(F) the title and business address of the agency official who is responsible for the

system of records;

(G) the agency procedures whereby an individual can be notified at his request if

the system of records contains a record pertaining to him;

(H) the agency procedures whereby an individual can be notified at his request how

he can gain access to any record pertaining to him contained in the system of

records, and how he can contest its content; and

(I) the categories of sources of records in the system.

Id. To publish a statutorily compliant SORN, a federal agency must provide at least thirty days

prior “notice of any new use or intended use of the information in the system, and provide an

opportunity for interested persons to submit written data, views, or arguments to the agency.” Id.

§ 552a(e)(11). And the agency must provide notice to Congress as well. Id. § 552a(r).

C. Factual Background

1. SAVE System of Records

SAVE is a system administered by DHS that is “designed to help federal, state, tribal, and

local government agencies confirm citizenship and immigration status prior to granting benefits

and licenses, as well as for other lawful purposes.” DHS AR 195. SAVE users “formalize the

purpose and use in which they use SAVE through a Memorandum of Agreement (MOA) or

Computer Matching Agreement (CMA)” establishing “the terms and conditions for the user

agency’s participation in SAVE.” DHS AR 195–96. One purpose for which states can enter into

such an agreement is to verify the citizenship of registered voters. Notice of a Modified System of

Records, 90 Fed. Reg. 48,948, 48,951 (Oct. 31, 2025) (DHS AR 117) (DHS 2025 SORN). Prior

to May 2025, SAVE users could access the immigration status of individuals with information

stored in the SAVE system, and SAVE’s response was based on the limited records maintained by

DHS, the State Department, and the Justice Department. See Notice of Modified System of

Records, 85 Fed. Reg. 31,798, 31,802 (May 27, 2025) (DHS AR 112) (2020 SORN). Also prior

to May 2025, DHS recognized SAVE as a system of records subject to the Privacy Act—which

means that DHS appeared to comply with the statute’s notice-and-comment requirements and

issued SORNs for changes to SAVE.1

See Notice of Modified System of Records, 85 Fed. Reg. 31,798, 31,798 (May 27, 2020) (DHS AR 108); DHS USCIS–004 SAVE Program System of Records, 81 Fed. Reg. 78,619, 78,619 (Nov. 8, 2016); DHS USCIS—004—SAVE Program System of Records, 77 Fed.

Reg. 47,415, 47,415 (Aug. 8, 2012); USCIS–004 Verification Information System (VIS) System of Records Notice, 73 Fed. Reg. 75,445, 75,445–46 (Dec. 11, 2008); USCIS VIS System of Records Notice, 73 Fed. Reg. 10,793, 10,793 (Feb. 28, 2008); Privacy Act: VIS Records Notice, 72 Fed. Reg. 17,569, 17,569 (Apr. 9, 2007); Privacy Act of 1974 System of Records, 67 Fed. Reg. 64,134, 64,134 (Oct. 17, 2002); Privacy Act of 1974 System of Records, 66 Fed. Reg. 46,812, 46,812 (Sep. 7, 2001).

2. Establishment of the Modified SAVE

On March 25, 2025, President Trump signed a sweeping Executive Order directing federal

agencies to take various actions related to the administration of federal elections. Exec. Order

No. 14248, 90 Fed. Reg. at 14,006–09 (DHS AR 335–38). The Executive Order instructs that for

the purpose of “identify[ing] unqualified voters registered in the States,” “the Secretary of

Homeland Security shall, consistent with applicable law, ensure that State and local officials have,

without the requirement of the payment of a fee, access to appropriate systems for verifying the

citizenship or immigration status of individuals registering to vote or who are already registered.”

Id. at 14,006 (DHS AR 335). The Executive Order further requires DHS to “share database

information with States upon request” under 8 U.S.C. § 1373(c) for voter list maintenance, and it

directs DHS, in coordination with the Department of Government Efficiency, to compare voter

records with “Federal immigration databases.” Id. at 14,005–06 (DHS AR 334–35). And the

Executive Order specifically directs SSA to make its databases available “to all State and local

election officials” for verifying voter eligibility. Id. at 14,007 (DHS AR 336).

The Executive Order prompted a flurry of action by the Federal Defendants charged with

its implementation. SSA AR 1–2; DHS AR 39–68. On May 15, 2025, DHS and SSA executed a

letter agreement to overhaul the SAVE system, which authorized “information sharing” between

DHS and SSA “by matching data submitted through SAVE to SSA records in SSA’s Master Files

of Social Security Number (SSN) Holders and SSN Applications.” DHS AR 423 (citation

omitted); SSA AR 9 (citation omitted). The “SSA Master Files” (or NUMIDENT)—which would

be linked to SAVE under the new information sharing agreement—contains SSNs, names, dates

and places of birth, citizenship indicators, death records, and information obtained while

processing requests for SSNs. SSA AR 170–71; DHS AR 253. On May 22, 2025, the Federal

Defendants publicly launched the expanded SAVE system. DHS AR 493; DHS AR 1385. But no

agency published a SORN or otherwise provided an opportunity for the public to comment on the

modifications prior to publication. Mot. Hr’g Tr. 71:15–22, ECF No. 48. At that juncture, the

operative SORN for SAVE was published on May 27, 2020. Notice of Modified System of

Records, 85 Fed. at 31,798 (DHS AR 108).

3. Present Litigation and Promulgation of New SORNs

In September 2025, the Plaintiffs filed this action challenging the modified SAVE as

unlawful, see Compl., ECF No. 1, and moved for an emergency stay under Section 705 of the

APA, Mot. Stay, ECF No. 16. During those emergency proceedings, the Federal Defendants would

not say one way or the other whether the Privacy Act applies to modifications to SAVE—despite

DHS’s prior practice of publishing SORNs for modifications to the system. Mot Hr’g Tr. 69:18–

24. But the Federal Defendants conceded that the then-recent modification to SAVE was

substantial enough that the Privacy Act would require a SORN if it applied. Id. The Court

ultimately denied the Plaintiffs’ emergency motion for failure to show irreparable harm. See

League of Women Voters v. DHS., No. 25-cv-3501, 2025 WL 3198970, at *5 (D.D.C. Nov. 17,

2025).

The administrative record provides a window into DHS’s understanding of the SAVE

“modified system.” Notice of a Modified System of Records, 90 Fed. Reg. at 48,948

(DHS AR 114). Internal “Privacy Threshold Analysis” documents from July and September 2025

show that DHS was aware that the modification of SAVE was “not in compliance” with the Privacy

Act, DHS AR 277; DHS AR 319, and that “[s]hortfalls in data accuracy” in SSA citizenship data

integrated into the new SAVE system “could cause incomplete or false results,” DHS AR 260;

DHS AR 302. This was in part because “[t]here is no obligation for an individual to report to SSA

a change in their citizenship or immigration status until they request a replacement card or file a

claim for a Social Security benefit.” SSA AR 103. Thus, a naturalized citizen who applied for a

Social Security card or otherwise interacted with SSA prior to naturalization may be incorrectly

identified as a non-citizen in SSA records. Id.

After the hearing on the Plaintiffs’ emergency motion, DHS and SSA both published

SORNs (2025 SORNs) for the modifications made to their respective systems. Notice of a

Modified System of Records, 90 Fed. Reg. at 48,948–55 (DHS AR 114–21); Notice of a Modified

System of Records, 90 Fed. Reg. 50,879 (Nov. 12, 2025) (SSA AR 206) (SSA 2025 SORN); Fed.

Defs.’ Suppl. Resp. 8, ECF No. 51; Fed. Defs.’ Notice of Publication of SORN, ECF No. 54. The

2025 SORNs outlined the “modified system” that resulted from the modification of SAVE in May

2025. Notice of a Modified System of Records, 90 Fed. Reg. at 48,949 (DHS AR 115); see also

Notice of a Modified System of Records, 90 Fed. Reg. at 50,880 (SSA AR 207). The DHS 2025

SORN established a new “Routine Use L” to enable DHS to disclose records to SSA “and other

federal, state, tribal, territorial, local, governments and other authorized entities to assist [SAVE]

user agencies [to] determine U.S. citizenship and immigration status of an individual when a DHS

approved agreement is in place between DHS and the entity.” Notice of a Modified System of

Records, 90 Fed. Reg. at 48,954 (DHS AR 120). The SSA 2025 SORN added a new “Routine Use

No. 49” for disclosures of “citizenship and immigration status” to DHS “pursuant to 8 U.S.C.

[§] 1373(a).” Notice of a Modified System of Records, 90 Fed. Reg. at 50,883 (SSA AR 210). The

2025 SORNs solicited comments from the public—but they also provided that the modified SAVE

system outlined in the 2025 SORNs would be effective immediately (i.e., before the public could

submit comments). See Notice of a Modified System of Records, 90 Fed. Reg. at 48,949

(DHS AR 115); Notice of a Modified System of Records, 90 Fed. Reg. at 50,880 (SSA AR 207)

(recognizing immediate effect except for new routine uses which would automatically take effect

after thirty days). The modified system that resulted from the Federal Defendants’ self-described

“overhaul” of SAVE differed from SAVE’s prior functionality (authorized by DHS’s 2020 SORN)

in three primary ways. See DHS AR 493.

First, the old SAVE did not previously have access to the records of natural-born citizens

unless those individuals had some other interaction with DHS, e.g., as a sponsor of a non-citizen.

See Notice of Modified System of Records, 85 Fed. Reg. at 31,801 (DHS AR 111). But the new

SAVE includes records about “U.S. citizens by birth.” Notice of a Modified System of Records,

90 Fed. Reg. at 48,949–51 (DHS AR 115–17).

Second, the old SAVE only accessed records stored in DHS systems, along with certain

immigration-related records systems at the State Department and the Department of Justice

identified in the 2020 SAVE SORN. See Notice of Modified System of Records, 85 Fed Reg.

at 31,802 (DHS AR 112). The old SAVE did not access SSA databases and SAVE users could not

run initial SAVE searches using an individual’s SSN or partial SSN. Notice of Modified System

of Records, 85 Fed Reg. at 31,798–99, 31,802 (DHS AR 108–09, 112). Instead, users had to

provide an individual’s DHS numeric identifier (e.g., an alien registration number or A-Number).

Notice of Modified System of Records, 85 Fed Reg. at 31,799 (DHS AR 09); DHS AR 248; DHS

AR 399. The old SAVE only had access to Social Security numbers “in very limited

circumstances” when benefits applicants submitted that number through DHS’s Form G-845, a

form used to document a person’s immigration status and verify their identity. Notice of Modified

System of Records, 85 Fed Reg. at 31,802 (DHS AR 111). Previously, “[i]f SAVE display[ed] an

‘Institute Additional Verification’ message,” SAVE users could require completion of the form

“G-845 with the applicant’s knowledge and consent,” which could include a social security

number. DHS AR 192; see also DHS AR 205–06, 278. But beyond this circumstance, SAVE did

not have access to social security numbers. See Notice of Modified System of Records, 85 Fed

Reg. at 31,802 (DHS AR 112); DHS AR 278. Because most U.S.-born citizens do not have DHS

numeric identifiers, before 2025 SAVE generally did not query the records of natural-born U.S.

citizens. See DHS AR 248.

Meanwhile, the new SAVE “update[d] the categories of records in the system to include

collecting both full and truncated (last four digits) Social Security number[s]” and added the SSA

Master File as a “record source” for SAVE. Notice of a Modified System of Records, 90 Fed. Reg.

at 48,949 (DHS AR 115). The result is that SAVE users may use the modified system to query any

non-citizen, naturalized citizen, and natural-born citizen who have Social Security numbers in the

SSA Master File. See DHS AR 248.

Third, the old SAVE could only conduct individual searches; SAVE users could not

conduct bulk searches of more than one person’s data at a time. See DHS AR 247. But the new

SAVE added “the capability to create cases in SAVE by uploading a file with a list of multiple

cases” for a bulk search. Notice of a Modified System of Records, 90 Fed. Reg. at 48,951

(DHS AR 117).

4. Modified SAVE’s User Experience

The SAVE “modified system” operates as follows. Id. at 48,948 (DHS AR 114). After user

agencies execute an MOA or CMA with USCIS, which establish “the terms and conditions for the

user agency’s participation in SAVE,” DHS AR 195–96; see also DHS AR 223; DHS AR 1344,

those users may conduct bulk searches.

A SAVE user first downloads a spreadsheet and manually enters some or all the following

data: first name, last name, date of birth, either a full or partial SSN, and the reason for verification

(e.g., voter verification). DHS AR 1443. The SAVE user can also provide voters’ DHS numeric

identifiers (e.g., an A-number). DHS AR 225; DHS AR 2. The user then uploads the completed

file into the SAVE interface. DHS AR 1444. Once that happens, SAVE automatically discloses

the voters’ uploaded data to SSA and uses it to search the SSA Master File. See DHS AR 224–25;

DHS AR 253; DHS AR 1525. SSA automatically discloses the SSA Master File search results to

DHS, including the following fields:

• SSN Match (True/False);

• Full SSN for all matches (when a partial SSN is provided);

• Name Match (True/False);

• Date of Birth Match (True/False);

• Citizenship/Foreign Indicator:

o Blank – Citizenship code is blank and foreign-born indicator is blank;

o “A” – U.S. citizen;

o “B” – Legal alien, eligible to work;

o “C” – Legal alien, not eligible to work;

o “D” – Other;

o “E” – Alien student, restricted work authorized; and

o “F” – Conditionally legalized alien;

• Foreign Born indicator (citizenship code is not present, but voter was foreign

born);

• State/Country Code;

• American Samoa indicator (True/False);

• Alien Registration number (where applicable);

• Death indicator (Yes Deceased/Not Deceased); and

• Error code descriptions (transaction and record levels).

Notice of a Modified System of Records, 90 Fed. Reg. at 48,950 (DHS AR 116);

DHS AR 225–26; DHS AR 233; DHS AR 424; DHS AR 437–38.

If the search identifies a potential non-U.S. citizen and a DHS numeric identifier is

available (either from the user’s initial input or SSA records), SAVE automatically queries

additional systems across the federal government, DHS AR 1450–58; DHS AR 1525; Notice of a

Modified System of Records, 90 Fed. Reg. at 48,953–54 (DHS AR 119–20); DHS AR 227–30.

After a manual review of responses, SAVE may then return a response that will either include the

voter’s citizenship status—e.g., “U.S. Citizen” or “Lawful Permanent Resident”—or request

additional actions by the SAVE user, including requesting the submission of additional documents.

DHS AR 1525; DHS AR 1507; DHS AR 1378–79; DHS AR 1530.

If the match to SSA records is inconclusive, the SSA records confirm that a voter is a

citizen or is deceased, or SAVE identifies a potential non-U.S. citizen status and no DHS numeric

identifier is available, then SAVE ends the automated query, DHS AR 254–55; DHS AR 297, and

generates one of the following responses:

• U.S. Citizen (per SSA Record);

• Deceased (per SSA record);

• Immigration Enumerator [i.e. DHS identifier] Required – Resubmit with

Additional Information;

• Unable to Return Record from SSA – Resubmit with Additional Information;

• Full SSN Required – Resubmit with Additional Information.

DHS AR 1379.

If SAVE identifies a voter as a citizen, then the SAVE user need not take any further steps

or gather “additional information.” See DHS AR 1507–08. If SAVE identifies the individual as

anything else, then the template SAVE MOA directs the SAVE user to “contact the registrant or

registered voter to obtain proof of U.S. citizenship.” DHS AR 762. And if the SAVE result is

inconclusive (e.g., SAVE provides an “Immigration Enumerator Required – Resubmit with

Additional Information” response), then (1) the SAVE user must provide the voter’s DHS numeric

identifier (which state and local agencies likely do not possess), and/or (2) the SAVE user must

“contact the registrant or registered voter to obtain proof of U.S. citizenship.” See DHS AR 762;

DHS AR 1526.

D. Procedural Background

On January 21, 2026, after the comment period expired for the 2025 SORNs, the

Plaintiffs—the League of Women Voters, League of Women Voters of Texas, League of Women

Voters of Louisiana, League of Women Voters of Louisiana Education Fund, League of Women

Voters of Virginia, and the Electronic Privacy Information Center (EPIC)—filed an Amended and

Supplemental Complaint challenging the three major modifications to the SAVE system outlined

in those SORNs. Am. Compl., ECF No. 61. On April 6, 2026, the Court permitted the State of

Texas, a SAVE user, to intervene as a Defendant in this action. Order, ECF No. 86. The Plaintiffs

moved for summary judgment, asking this Court to set aside and vacate the modified SAVE system

and 2025 SORNs as unlawful under the APA and the Constitution. Pls.’ Mem. Supp. Summ. J.

Mot., ECF No. 66-1 (Pls.’ Mot.). The Federal Defendants cross-moved for either dismissal of this

action for lack of subject matter jurisdiction and failure to state a claim or for summary judgment.

Fed. Defs.’ Combined Mem. Supp. Mot. Dismiss/Mot. Summ. J. and Opp’n to Pls.’ Mot. (Fed.

Defs.’ Mot.), ECF No. 77-1. And the State of Texas moved to dismiss for lack of subject matter

jurisdiction and failure to state a claim. Texas Mot. Dismiss (Texas Mot.), ECF No. 97. These

motions are fully briefed and ripe for review. Pls.’ Combined Reply & Opp’n to Fed. Defs.’ Mot.

(Pls.’ Reply), ECF Nos. 99 & 100; Pls.’ Opp’n to Texas Mot. (Pls.’ Opp’n), ECF No. 104; Texas

Reply, ECF No. 105; Fed. Defs.’ Reply, ECF No. 106.2

The Court has received and considered amicus briefs in support of the Plaintiffs filed by Travis County, Travis County Tax Assessor-Collector Celia Israel, and Travis County Clerk Dyana Limon-Mercado; Campaign Legal Center, Center for Media and Democracy, Common Cause, and Protect Democracy Project; Texas Civil Rights Project; Lawyers Defending American

LEGAL STANDARD

A court “shall grant summary judgment if the movant shows that there is no genuine

dispute as to any material fact and the movant is entitled to judgment as a matter of law.” Fed. R.

Civ. P. 56(a). In the context of an APA challenge, summary judgment “serves as a mechanism for

deciding, as a matter of law, whether the administrative record supports the agency action and

whether the agency action is consistent with the APA standard of review.” Int’l Swaps &

Derivatives Ass’n v. U.S. CFTC, 887 F. Supp. 2d 259, 266 (D.D.C. 2012) (citing Richards v. INS,

554 F.2d 1173, 1177 & n.28 (D.C. Cir. 1977)).

“A motion under Rule 12(b)(1) ‘presents a threshold challenge to a court’s [subject-matter]

jurisdiction.’” Ctr. for Biological Diversity v. U.S. Int’l Dev. Fin. Corp., 585 F. Supp. 3d 63, 69

(D.D.C. 2022) (quoting Ctr. for Biological Diversity v. Jackson, 815 F. Supp. 2d 85, 89 (D.D.C.

2011)). The plaintiff “bears the burden of proving by a preponderance of the evidence that the

Court has subject-matter jurisdiction over her claims.” Schmidt v. U.S. Capitol Police Bd., 826

F. Supp. 2d 59, 69 (D.D.C. 2011). When evaluating a motion under Rule 12(b)(1), “the court may

consider documents outside the pleadings to assure itself that it has jurisdiction.” Sandoval v. U.S.

DOJ, 322 F. Supp. 3d 101, 104 (D.D.C. 2018).

Under Rule 12(b)(6), a court must dismiss a complaint that does not “contain sufficient

factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.’” Ashcroft v.

Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)).

Courts “must construe the complaint ‘in favor of the plaintiff, who must be granted the benefit of

all inferences that can be derived from the facts alleged.’” Hettinga v. United States, 677 F.3d 471,

476 (D.C. Cir. 2012) (quoting Schuler v. United States, 617 F.2d 605, 608 (D.C. Cir. 1979)). But

Democracy, Inc.; Service Employees International Union; and the American Civil Liberties Union. ECF Nos. 68, 89, 91, 87, 88 & 94.

courts need not accept as true “a legal conclusion couched as a factual allegation,” nor an

“inference[] . . . unsupported by the facts set out in the complaint.” Trudeau v. FTC, 456 F.3d 178,

193 (D.C. Cir. 2006) (first quoting Papasan v. Allain, 478 U.S. 265, 286 (1986); and then quoting

Kowal v. MCI Commc’ns Corp., 16 F.3d 1271, 1276 (D.C. Cir. 1994)).

DISCUSSION

The Plaintiffs contend that the Federal Defendants have unlawfully established a modified

SAVE system of records in violation of the APA and the Constitution. Specifically, they argue

that the establishment of the modified SAVE and the 2025 SORNs (1) violated the APA because

of substantive provisions in the Social Security Act and the Privacy Act, (2) violated certain

procedural protections in the Privacy Act and are arbitrary and capricious under the APA, and

(3) violated the constitutional separation of powers. The Plaintiffs seek summary judgment on their

claims, asking the Court to hold unlawful, vacate, and set aside the modified SAVE system and

the accompanying 2025 SORNs.

The Federal Defendants and the State of Texas (collectively, the Defendants) seek

dismissal of the Plaintiffs’ claims. They first raise threshold arguments in support of dismissal—

arguing that the Plaintiffs lack standing, that the challenged activity is not a final agency action,

and that the Plaintiffs have an adequate remedy elsewhere. They also defend the establishment of

the modified SAVE and the 2025 SORNs on the merits, asserting that they did not violate the APA

or the Constitution and were otherwise authorized by immigration laws.

Having reviewed the comprehensive briefing in this case, the Court is convinced that the

Plaintiffs have the better of the arguments. The Defendants’ threshold arguments are easily

dispensed with. And on the merits, the Court holds that the establishment of the modified SAVE

system and the 2025 SORNs are unlawful for at least three reasons. First, they violated the Social

Security Act. Second, they violated both substantive and procedural protections in the Privacy Act.

And third, they are arbitrary and capricious in violation of the APA. Because relief is warranted

on these claims alone, the Court declines to address the Plaintiffs’ remaining claims.3

A. Standing

Standing leads off. Recall that the Plaintiffs are non-profit organizations. An organization

may demonstrate standing by either (1) asserting associational “standing solely as the

representative of its members,” or (2) identifying an organizational injury “in its own right.”

Students for Fair Admissions, Inc. v. President & Fellows of Harvard Coll., 600 U.S. 181, 199

(2023) (quoting Warth v. Seldin, 422 U.S. 490, 511 (1975)). To establish associational standing,

an organization must show that: “(1) at least one of its members has standing to sue in her or his

own right, (2) the interests it seeks to protect are germane to its purpose, and (3) neither the claim

asserted nor the relief requested requires the participation of an individual member in the lawsuit.”

Institutional S’holder Servs., Inc. v. SEC, 142 F.4th 757, 764 (D.C. Cir. 2025) (quoting Wash. All.

of Tech. Workers v. DHS, 50 F.4th 164, 175 (D.C. Cir. 2022)). The first two prongs are rooted in

Article III of the Constitution, but the “third prong is a prudential one” focused on “matters of

administrative convenience and efficiency.” United Food & Com. Workers Union Loc. 751 v.

Brown Grp., Inc., 517 U.S. 544, 555–57 (1996).

Here, the Defendants do not appear to challenge the final two prongs. The League of

Women Voters and their state affiliates seek to protect the voting rights of their members, which

is germane to the League’s purpose to “empower voters and defend democracy, including by

registering voters and increasing voter participation.” Stewart Decl. ¶¶ 2, 7, ECF No. 16-5; see

also LeBombard Decl. ¶¶ 2, 5, 14, ECF No. 66-7; Suppl. Green Decl. ¶¶ 2, 6, ECF No. 66-8; Porte

The Court need not address the Plaintiffs’ constitutional claims; Privacy Act accuracy claims, 5 U.S.C. § 552a(e)(5), (6), (10); claims under Section 1306(a)(1) of the Social Security Act; and mandamus claims to enforce the Computer Matching and Privacy Protection Act.

Decl. ¶¶ 2, 3, 11, 14, ECF No. 16-6. And EPIC seeks to protect the privacy rights of its members,

which is germane to its “mission . . . to secure the fundamental right to privacy in the digital age.”

Butler Decl. ¶ 3, ECF No. 66-10. Furthermore, individual member participation is not necessary

where an organization seeks APA vacatur on behalf of its members. See Powder River Basin Res.

Council v. U.S. Dep’t of Interior, 749 F. Supp. 3d 151, 162 (D.D.C. 2024); Sierra Club v. Perry,

373 F. Supp. 3d 128, 135 (D.D.C. 2019).

Standing thus turns on whether “at least one of [the Plaintiffs’] members has standing to

sue in her or his own right.” Institutional S’holder Servs., 142 F.4th at 764 (quoting Wash. All. of

Tech. Workers, 50 F.4th at 175). “To establish Article III standing, a plaintiff must show (1) injury

in fact that is concrete and particularized and actual or imminent rather than conjectural or

hypothetical, (2) causation fairly traceable to the defendant’s challenged action and

(3) redressability by a favorable decision that is likely as opposed to merely speculative.” Am.

Whitewater v. FERC, 125 F.4th 1139, 1150 (D.C. Cir. 2025) (citing Lujan v. Defs. of Wildlife, 504

U.S. 555, 560–61 (1992)). The “plaintiff[] must demonstrate standing for each claim that they

press and for each form of relief that they seek.” TransUnion LLC v. Ramirez, 594 U.S. 413, 431

(2021). And where an action involves only non-monetary relief, “[o]nly one plaintiff . . . needs

standing in order for a particular claim to go forward. . . . That is, if constitutional standing ‘can

be shown for at least one plaintiff, [the Court] need not consider the standing of the other plaintiffs

to raise that claim.’” Whitman-Walker Clinic v. U.S. HHS, 485 F. Supp. 3d 1, 18 (D.D.C. 2020)

(quoting Carpenters Indus. Council v. Zinke, 854 F.3d 1, 9 (D.C. Cir. 2017)).

Here, the Court concludes that the League of Women Voters and the League of Women

Voters of Texas have standing to proceed. See Nel Decl., ECF No. 66-3; A. Doe Decl., ECF

No. 66-4; B. Doe Decl., ECF No. 66-5; J. Doe 4 Suppl. Decl., ECF No. 16-3.4 Their members

suffered three types of injuries: privacy or reputational injuries, voter injuries, and procedural

injuries. Pls.’ Mot. 13.5 The Court addresses each in turn.

1. Privacy or Reputational Injuries

The Plaintiffs first argue that the disclosure of their members’ personal information in

violation of the Social Security Act and the Privacy Act has caused privacy or reputational injuries

that are sufficiently concrete to confer Article III standing. See id. The Court agrees.

“[F]or Article III purposes, an injury is ‘concrete’ if it is similar to a type of harm

cognizable at common law.” Pileggi v. Washington Newspaper Publ’g Co., 146 F.4th 1219, 1226

(D.C. Cir. 2025) (quoting TransUnion, 594 U.S. at 424). Of course, “Article III does not require

‘an exact duplicate in American [common-law] history and tradition’”—“an injury is concrete if

it has ‘a close historical or common-law analogue’” and there is a “close relationship” between the

harm that Congress sought to remedy and that analogue. Id. (quoting TransUnion, 594 U.S.

at 424–25). In providing a private cause of action, Congress may even “identif[y] a modern relative

of a harm with long common law roots,” Gadelhak v. AT&T Servs., Inc., 950 F.3d 458, 462 (7th

Cir. 2020) (Barrett, J.), and “elevate to the status of legally cognizable injuries [those] concrete,

de facto injuries that were previously inadequate in law,” TransUnion, 594 U.S. at 425–26

(quoting Spokeo, Inc. v. Robins, 578 U.S. 330, 341 (2016)). Thus, the injury-in-fact requirement

is satisfied if a party brings a “private right of action to remedy” a harm recognized in common

law or “a harm that is a lesser form of a harm recognized at common law.” Pileggi, 146 F.4th

Members of local and state Leagues of Women Voters are also members of the League of Women Voters. Stewart Decl. ¶ 6, ECF No. 16-5; Supp. Stewart Decl. ¶ 10, ECF No. 66-5. 5

Because the Plaintiffs’ injuries suffice to confer standing for their claims, the Court does not address the Plaintiffs’ argument that organizational or informational standing can also support some of their claims. See Pls.’ Mot. 13.

at 1227. “Th[e]se include, for example, reputational harms, disclosure of private information, and

intrusion upon seclusion.” TransUnion, 594 U.S. at 425.

The Privacy Act “provide[s] certain safeguards for an individual against an invasion of

personal privacy.” Cooper, 566 U.S. at 294–95 (quoting Privacy Act of 1974 § 2(b), 88 Stat.

at 1896). “[T]he Act serves interests similar to those protected by defamation and privacy torts”—

“there is good reason to infer that Congress relied upon those torts in drafting the Act” and

“parallel[ed]” those “common-law torts” in its statutory scheme. Id. at 295–96.

Here, the Plaintiffs have established privacy injuries because of the modified SAVE

system. They claim that the Federal Defendants have disclosed their members’ private information

in SSA records (including their SSNs and citizenship status) without their consent through bulk

SAVE queries. Specifically, they allege that Texas, Louisiana, and other SAVE users have

accessed and continue to have access to this private information through SAVE in violation of the

Social Security Act and the Privacy Act. See Nel Decl. ¶¶ 27–43; A. Doe Decl. ¶¶ 18, 23–24; B.

Doe Decl. ¶¶ 32–44, 46–47; C. Doe Decl. ¶¶ 19–25, ECF No. 66–6. The Plaintiffs further allege

that their members provided this private information to SSA when they applied for SSNs, and that

they reasonably expected the agency to keep that information confidential and use it only for that

purpose. See Nel Decl. ¶ 33; A. Doe Decl. ¶ 18; B. Doe Decl. ¶ 38; C. Doe Decl. ¶ 25; Kisselburgh

Decl. ¶ 15, ECF No. 66-11; Suppl. Green Decl. ¶ 49; J. Doe 4 Suppl. Decl. ¶ 9; J. Doe 6 Decl.

¶¶ 10, 20, ECF No. 16-8.

The Plaintiffs establish reputational injuries, too. As they tell it, their members include

individuals who applied for SSNs when they were non-citizens but have since naturalized. Nel

Decl. ¶ 34; A. Doe Decl. ¶¶ 4–6; B. Doe Decl. ¶¶ 4–6; Suppl. Green Decl. ¶¶ 32, 35; J. Doe 4

Suppl. Decl. ¶¶ 2, 8; C. Doe Decl. ¶¶ 4–5; J. Doe 6 Decl. ¶¶ 2, 9. For those individuals, their Social

Security files are outdated and incorrectly list them as non-citizens. Nel Decl. ¶ 34; B. Doe Decl.

¶ 39; Suppl. Green Decl. ¶ 11; J. Doe 4 Suppl. Decl. ¶ 14; C. Doe Decl. ¶ 26; J. Doe 6 Decl. ¶ 15.

The Plaintiffs state that their members had no reason to believe that failure to update their

citizenship status with SSA would have any impact on their lives. Nel Decl. ¶ 34; A. Doe Decl.

¶ 19; B. Doe Decl. ¶ 39; C Doe Decl. ¶ 26. But because of the Federal Defendants’ disclosure of

their citizenship status through the modified SAVE, these individuals were identified as potential

non-citizens by the State of Texas based on a “comparison of the information in [their] voter

registration records with the United States Citizenship and Immigration Services SAVE records.”

Nel Decl., Ex. 1; A. Doe Decl., Ex. 1; B. Doe Decl., Ex. 2; C. Doe Decl., Ex. 1. And they have

had to provide proof of citizenship within thirty days to avoid cancellation of their voter

registrations. A. Doe Decl. ¶¶ 11–14 & Ex. 1; C. Doe Decl. ¶¶ 12–14, 18 & Ex. 1. Some of the

Plaintiffs’ members have had their voter registrations wrongfully cancelled for failure to provide

documentation within thirty days of these notices. See Nel Decl. ¶¶ 19–21, 24, 26 & Exs. 1, 2; B.

Doe Decl. ¶¶ 11–17, 21–22, 24–27, 30–31 & Exs. 1, 2.

The Plaintiffs argue that statutory claims challenging the disclosure of their private

information to both DHS and SAVE users have three common-law analogues: intrusion upon

seclusion, breach of confidence, and defamation. Pls.’ Mot. 14–16. The Court agrees that all three

analogues fit the bill. Therefore, it concludes that the Plaintiffs have established concrete injuries

that serve as a basis for standing in this Court.

a. Intrusion Upon Seclusion

The first analogue is intrusion upon seclusion. Pls.’ Mot. 14. An “injury . . . closely

analogous to the harm of intrusion upon seclusion” is cognizable under Article III. Pileggi, 146

F.4th at 1228. Intrusion upon seclusion is an “intentional[] intrusi[on], physical or otherwise, upon

the solitude or seclusion of another or his private affairs or concerns . . . if the intrusion would be

highly offensive to a reasonable person.” Id. (quoting Restatement (Second) of Torts § 652B

(A.L.I. 1977)). Various courts across the country, see, e.g., Am. Fed. of State, Cnty. & Mun. Emps.

v. SSA, 172 F.4th 361, 369 (4th Cir. 2026) (en banc), and nearly “every court in this circuit” have

held that the unauthorized disclosure of Social Security and other “private information” by

government employees is the exact type of injury protected by the tort of intrusion upon seclusion,

AFL-CIO v. Dep’t of Lab., No. 25-cv-339, 2026 WL 879518, at *10 (D.D.C. Mar. 31, 2026)

(collecting cases). And the Plaintiffs are challenging just that—an unauthorized disclosure of

Social Security and other private information. This supports Article III standing.

The Defendants urge the contrary. They say that intrusion upon seclusion has an additional

requirement: “knowledge that a third party is engaged in” the invasion of privacy, relying on the

Fourth Circuit’s abrogated opinion in Am. Fed’n of Teachers v. Bessent, 152 F.4th 162, 172 (4th

Cir. 2025), abrogated by 172 F.4th 361 (4th Cir. 2026). See Fed. Defs.’ Mot. 19; Texas Mot. 11–

12. That decision reasoned that intrusion upon seclusion is targeted to privacy injuries “that

invade[] one’s space or disrupt[] one’s daily activities,” while “[u]nauthorized knowledge of

sensitive information” like Social Security information without a “feeling of unease” or “trespass”

stemming from knowledge of that disclosure is more akin to “defamation.” Bessent, 152 F.4th

at 172 (citation omitted). Bessent’s rationale is both unconvincing and inapposite for three reasons.

First and foremost, Bessent was decided on an emergency basis and therefore on an

expedited timeline, and it thus concluded only that the plaintiffs there likely lacked standing. Id.

at 171. With more time to consider the issue, the en banc Fourth Circuit concluded that Bessent

misread the Second Restatement of Torts and held instead that disclosure of SSA data is akin to

the tort of intrusion upon seclusion irrespective of knowledge of the disclosure. Am. Fed. of State,

Cnty. & Mun. Emps., 172 F.4th at 370–71.

Second, Bessent is inapposite. In Bessent, none of the plaintiffs alleged that “any particular

row of information [in the database] belonging to any particular Plaintiff [was] examined” by a

third party. 152 F.4th at 172. In stark contrast, the record here abounds with declarations that SSA

handed over individuals’ private information to state authorities, that those authorities revoked or

threatened to revoke voter registrations based on the unauthorized and inaccurate disclosures, and

that the unauthorized and inaccurate disclosures disrupted the individuals’ daily lives when they

were forced to correct the inaccuracies. See, e.g., A. Doe Decl. ¶¶ 11–14; C. Doe Decl. ¶¶ 12–14,

18. These facts—United States citizens receiving notices from state authorities threatening

revocation of their voter registration and possible criminal sanctions based on the unauthorized

disclose of inaccurate, private information—undoubtedly create a “feeling of unease when and

where one should ideally be at peace.” Bessent, 152 F.4th at 172.

Third, Bessent is unpersuasive on its own terms. Most glaringly, it did not grapple with

TransUnion’s instruction that Article III does not “require an exact duplicate” to a harm cognizable

in common law and that Congress “may ‘elevate to the status of legally cognizable injuries

concrete, de facto injuries that were previously inadequate in law.’” TransUnion, 594 U.S.

at 425–26, 433 (quoting Spokeo, 578 U.S. at 341). Courts considering this instruction have held

that the disclosure of SSA data is undoubtedly the “same kind of harm that common law” privacy

torts, like intrusion upon seclusion, protect. See All. for Retired Ams. v. Bessent, 770 F. Supp. 3d

79, 104 (D.D.C. 2025) (quoting Gadelhak, 950 F.3d at 462). Indeed, TransUnion itself made clear

that “retention of information lawfully obtained, without further disclosure, traditionally has not

provided the basis for a lawsuit in American courts,” but a different analysis is necessary in

equitable suits where (1) private information is “provided” to third parties, (2) there is a “serious

likelihood of disclosure” of that information, or (3) when plaintiffs are “aware of . . . misleading

information” provided about them. 594 U.S. at 434, 436 n.7, 438 (emphases added) (cleaned up).

Courts have long held that the “unlawful” “collection, storage, and use” of private data “qualifies

as an invasion of a ‘private domain, much like an act of trespass would be’” and “is closely

analogous to historical claims for invasion of privacy.” Fox v. Dakkota Integrated Sys., LLC, 980

F.3d 1146, 1155 (7th Cir. 2020) (emphasis added) (cleaned up) (collecting cases and holding that

a plaintiff’s claim that her workplace unlawfully retained and shared her biometric data with a

third-party was sufficiently analogous to historical claims for invasion of privacy to establish an

Article III injury).

Accordingly, the Court concludes that the tort of intrusion upon seclusion is a sufficient

analogue for the disclosure claims under the Privacy and Social Security Acts. The Plaintiffs have

suffered a concrete injury for purposes of Article III standing.

b. Breach of Confidence

The Parties next dispute whether the tort of breach of confidence provides an analogue.

Pls.’ Mot. 14; Fed. Defs.’ Mot. 20–21; Texas Mot. 14–15. The tort of breach of confidence—“a

harm that has traditionally been regarded as providing a basis for a lawsuit in English or American

courts”—“‘lies where a person offers private information to a third party in confidence and the

third party reveals that information’ to another.” Jeffries v. Volume Servs. Am., Inc., 928 F.3d 1059,

1064 (D.C. Cir. 2019) (first quoting Spokeo, 578 U.S. at 340–41; and then quoting Muransky v.

Godiva Chocolatier, Inc., 922 F.3d 1175, 1190–91 (11th Cir. 2019)). Importantly, breach of

confidence bears a close resemblance to the Privacy Act’s prohibition on “disclosure” or “use of

[a] record for a purpose which is [in]compatible with the purpose for which it was collected.”

5 U.S.C. § 552a(a)(7), (b)(3). “[T]here is good reason to infer[, then,] that Congress relied upon

[this] tort[] in drafting the Act,” Cooper, 566 U.S. at 295, and that a violation of this provision in

the Privacy Act is a close “analogue” to breach of confidence, TransUnion, 594 U.S. at 424.

Accordingly, the Court agrees that the Plaintiffs’ Privacy Act claim challenging the “wrongful

sharing of sensitive information” through SAVE “bears a close relationship to the harms

traditionally redressable through . . . breach of confidence” as well. League of United Latin Am.

Citizens v. Exec. Off. of the President, 818 F. Supp. 3d 34, 110 (D.D.C. 2026).

c. Defamation

Finally, the Plaintiffs also rely on the common law tort of defamation as an analogue for

their disclosure injuries. Pls.’ Mot. 16. “Under longstanding American law, a person is injured

when a defamatory statement ‘that would subject him to hatred, contempt, or ridicule’ is published

to a third party.” TransUnion, 594 U.S. at 432 (quoting Milkovich v. Lorain Journal Co., 497 U.S.

1, 13 (1990)) (citing Restatement (First) of Torts § 559 (A.L.I. 1938)). “Any act whereby the

defamatory matter is intentionally or negligently communicated to a third person is a publication.”

Restatement (First) of Torts § 577 cmt. a (A.L.I. 1938). Thus, when a plaintiff is “injured by [the]

dissemination of allegedly inaccurate information” to a third party—that injury “bears a close

relationship to the common-law tort of defamation” and constitutes an Article III injury. Ranjan v.

U.S. DHS, 747 F. Supp. 3d 192, 199–200 (D.D.C. 2024). As another judge in this District has

explained:

To understand this [harm], it is useful to begin with the Supreme Court’s decision

in TransUnion. The plaintiff class sued TransUnion, a credit reporting agency,

arguing that it had “failed to use reasonable procedures to ensure the accuracy of

their credit files.” 594 U.S. at 417. For about 1,800 class members, TransUnion had

disseminated misleading credit reports to businesses, “label[ing] the class members

as potential terrorists, drug traffickers, or serious criminals.” Id. at 432. The Court

analogized that injury to the tort of defamation . . . [where] “a person is injured

when a defamatory statement ‘that would subject him to hatred, contempt, or

ridicule’ is published to a third party.” Id. (quoting [Milkovich, 497 U.S. at 13]).

Because those class members had “suffered a harm with a ‘close relationship’ to

the harm associated with the tort of defamation,” the Court had “no trouble

concluding” that they had experienced a concrete harm sufficient to confer

standing. Id. . . . [But] the Court held that the roughly 6,000 [other] class members

whose inaccurate reports had never been disseminated could not satisfy the

concrete-harm requirement. Id. at 434–35[.]

Ranjan, 747 F. Supp. 3d at 199–200.

Similarly, here, the undisputed record shows that the Plaintiffs’ members have been injured

by “dissemination of . . . inaccurate information” falsely indicating that they are non-citizens. Id.

at 199. Such publication is defamatory not only because it resulted in the revocation or threatened

revocation of their voter registrations but because it carries an implication that those members are

“serious criminals.” TransUnion, 594 U.S. at 432; see 18 U.S.C. § 611 (criminalizing non-citizen

voting); id. § 1015 (criminalizing voter registration by non-citizens); Press Release, Tex. Sec’y of

State, Texas Completes Citizenship Verifications in the SAVE Database (Oct. 20, 2025),

https://www.sos.state.tx.us/about/newsreleases/2025/102025.shtml [https://perma.cc/9WZ2-XVDA] (stating that “individuals who are deemed non-citizens” under SAVE and “that voted in a

Texas election will be referred to the Office of the Attorney General” of Texas for investigation).

Undoubtedly then, the Plaintiffs have suffered injuries with “a sufficiently close relationship to the

harm[s] from . . . false and defamatory statement[s].” TransUnion, 594 U.S. at 433.

The Defendants’ arguments to the contrary border on the absurd. The Defendants argue

that “a former non-citizen being described as a current non-citizen—even if mistakenly and

inaccurately, after naturalization—does not come close to” defamation and “is nothing like being

labeled a ‘potential terrorist.’” Fed. Defs.’ Mot. 22; see also Texas Mot. 15. The Defendants’ view

on the importance of citizenship bears little resemblance to reality. See Schneiderman v. United

States, 320 U.S. 118, 122 (1943) (“[I]t is safe to assert that nowhere in the world today is the right

of citizenship of greater worth to an individual than it is in this country. It would be difficult to

exaggerate its value and importance. By many it is regarded as the highest hope of civilized men.”);

Kennedy v. Mendoza-Martinez, 372 U.S. 144, 159 (1963) (“Citizenship is a most precious right.”);

Fedorenko v. United States, 449 U.S. 490, 506–07 (1981) (citizenship is a “priceless treasure”

(quoting Johnson v. Eisentrager, 339 U.S. 763, 791 (1950) (Black, J., dissenting))). As evidenced

by the actions taken by state authorities in this case, even the mere suggestion of non-citizenship

can cause grievous consequences. See Klapprott v. United States, 335 U.S. 601, 616 (1949)

(Rutledge, J., concurring in judgment) (“To take away a man’s citizenship deprives him of a right

no less precious than life or liberty, indeed of one which today comprehends those rights and

almost all others.”). This remains as true for a naturalized citizen as any other. See Luria v. United

States, 231 U.S. 9, 22 (1913) (“Under our Constitution, a naturalized citizen stands on an equal

footing with the native citizen in all respects, save that of eligibility to the Presidency.”). Suffice

it to say that in the context of voting—where citizenship status can distinguish an engaged voter

from a criminal—accusing a registered voter of being a non-citizen counts as, at the very least, “a

lesser form” of defamation. Pileggi, 146 F.4th at 1227.

* * *

Having found that the Plaintiffs have suffered privacy and reputational injuries, the

remaining standing inquiries are easily satisfied. The Defendants do not contest that those injuries

are the result of the SAVE modified system, and a favorable decision by this Court would

undoubtedly redress those injuries.

2. Voter Injuries

The Plaintiffs next argue that they have suffered cognizable Article III voter injuries that

can alternatively provide standing for all their claims. Pls.’ Mot. 16. The Court agrees.

It goes without saying that voting is “a process ‘of the most fundamental significance under

our constitutional structure.’” Bost v. Ill. State Bd. of Elections, 607 U.S. 71, 77 (2026) (quoting

Ill. Bd. of Elections v. Socialist Workers Party, 440 U.S. 173, 184 (1979)). Thus, “[t]here is no

doubt that the right to vote is a legally protected interest” cognizable under Article III of the

Constitution. Am. Encore v. Fontes, 152 F.4th 1097, 1111 (9th Cir. 2025). And “[a] plaintiff need

not have the franchise wholly denied to suffer injury” to this concrete interest. Charles H. Wesley

Educ. Found., Inc. v. Cox, 408 F.3d 1349, 1352 (11th Cir. 2005). Voters are injured when “they

[a]re wrongly identified as non-citizens” and their franchise is burdened as a result. Arcia v. Fla.

Sec’y of State, 772 F.3d 1335, 1341 (11th Cir. 2014). Even an “increased risk” of

disenfranchisement can make an injury “sufficiently ‘imminent’ for standing purposes.”

Richardson v. Trump, 496 F. Supp. 3d 165, 179 (D.D.C. 2020) (quoting Attias v. Carefirst, Inc.,

865 F.3d 620, 627 (D.C. Cir. 2017)). For instance, in a challenge to an Arizona law requiring the

use of SAVE, the Ninth Circuit found that naturalized voters had standing based on evidence that

“SAVE may not” have up-to-date “naturalization records,” and the resulting “danger” that

“properly registered voters, who in fact are citizens, may have their voter registrations cancelled[,]

. . . losing their constitutional right to vote.” Mi Familia Vota v. Fontes, 129 F.4th 691, 708–09

(9th Cir. 2025). And the Eleventh Circuit similarly held that naturalized voters had “standing to

prospectively challenge” Florida’s “attempt to remove non-citizens from the voter rolls using the

SAVE database” based on “potential errors that could occur when the Secretary attempted to

confirm their immigration status in various state and federal databases.” Arcia, 772 F.3d at 1341.

Here, as the Federal Defendants admit, the “Plaintiffs have found four people who were

apparently asked to confirm their citizenship to Texas officials.” Fed. Defs.’ Mot. 24 (citing Nel

Decl.; A. Doe Decl.; B. Doe Decl.; C. Doe Decl.). Sworn declarations from those individuals

establish that they were naturalized citizens with inaccurate SSA records; that Texas threatened to

revoke their voter registrations because of information obtained through the modified SAVE

system; and that they were required to confirm their citizenship to maintain their voter

registrations. See, e.g., Nel Decl. ¶¶ 19–21, 24–26, 34 & Exs. 1, 2; A. Doe Decl. ¶¶ 11–14 & Ex. 1;

B. Doe Decl. ¶¶ 11–17, 21–22, 24–28, 30–31, 39; C. Doe Decl. ¶¶ 12–14, 18 & Ex. 1. Two

members had to provide proof of citizenship to maintain their registered voter status. A. Doe Decl.

¶¶ 11–14; C. Doe Decl. ¶¶ 12–14, 18. One member had her voter registration revoked without her

knowledge and was asked to submit new documentation to restore her registration. B. Doe Decl.

¶¶ 11–17, 21–22, 24–27, 30–31. And two members’ voter registrations remained revoked at the

time that they filed their declarations in this case. Nel Decl. ¶¶ 19–26; B. Doe Decl. ¶¶ 30–31. The

Defendants have neither disputed this sworn testimony nor challenged their introduction. See Fed.

R. Civ. P. 56(c) (requiring a party opposing summary judgment to point to a contrary portion of

the record, assert the presence of a dispute, or argue evidence is inadmissible in order to show a

genuine dispute of material fact).6 On this record, the Plaintiffs’ voter injuries are sufficient to

confer standing.

The Defendants’ arguments do not alter this conclusion. First, the Defendants ask this

Court to “infer[] . . . that, after denial of their preliminary-injunction motion,” the “Plaintiffs went

searching for affected individuals, found a few, and signed them up for membership.” Fed. Defs.’

Mot. 13. If the Defendants are arguing that the Plaintiff organizations engaged in improper

solicitation, they cite no record evidence whatsoever to support that claim. And they never asked

Although Rule 56 operates differently with respect to a court’s review of an administrative record, Rule 56(c), alongside that rule’s other provisions, governs the consideration of declarations in support of standing at the summary judgment posture, even in APA cases. See, e.g., Teva Pharms. USA, Inc. v. U.S. FDA, 514 F. Supp. 3d 66, 89 n.3 (D.D.C. 2020).

this Court for discovery on this issue. See Fed. Defs.’ Mot. 13 n.6 (noting that the Federal

Defendants requested this information, did not receive it, but never raised the issue before the

Court); Fed. R. Civ. P. 56(e)(2) (permitting the Court to “consider [a] fact undisputed” if the

opposing party fails to properly address it). Regardless, the Court can think of no reason why this

is relevant to the standing inquiry, and the Defendants certainly do not explain why.

Next, the Defendants characterize the voting-related injury suffered by the member whose

voter registration was cancelled because of the modified SAVE as a “past injury.” Fed. Defs.’

Mot. 24; Texas Mot. 12. They are wrong. This member was facing “continuing, present adverse

effects” when the Plaintiffs filed this lawsuit by virtue of her voter registration being cancelled—

which is more than enough to satisfy Article III. O’Shea v. Littleton, 414 U.S. 488, 495–96 (1974).

And nothing in the record suggests that this injury has been redressed. Nel Decl. ¶ 26.

Relatedly, the Federal Defendants suggest that no Article III injury exists because the

identified members “hav[e] now had the opportunity to correct their records” and have not claimed

“any paperwork issues” preventing them from doing so. Fed. Defs.’ Mot. 24–25; Fed. Defs.’

Reply 10. But it is well established that the need to take “affirmative steps to avoid the risk of

harm” is itself an Article III injury. Meese v. Keene, 481 U.S. 465, 475 (1987). And the “disruption

of daily activities” to correct one’s citizenship information to vote is an injury-in-fact under

Article III. Env’t Def. Fund v. FERC, 2 F.4th 953, 971 (D.C. Cir. 2021) (quoting Sierra Club v.

FERC, 867 F.3d 1357, 1366 (D.C. Cir. 2017)); B. Doe Dec.; ¶¶ 19–23 (describing various phone

calls with Texas election officials to determine why their voter registration was cancelled and how

to fix it). The same is true of the pocket-book injury of “even a small amount of money,” such as

the cost of printing, postage, and obtaining an envelope to correct one’s voter registration.

Czyzewski v. Jevic Holding Corp., 580 U.S. 451, 464 (2017); see also Mack v. Resurgent Cap.

Servs., L.P., 70 F.4th 395, 405–07 (7th Cir. 2023) (holding that the time, effort, and money for

postage that a consumer spent responding to improper debt collector communication constituted a

concrete injury); Ebaugh v. Medicredit, Inc., No. 24-1838, 2025 WL 1088077, at *1 (8th Cir. Apr.

11, 2025) (same); See B. Doe Decl. ¶ 23 (resubmitting voter registration forms was necessary when

their voter registration was cancelled due to SAVE).

In any event, “past wrongs may serve as evidence” of “a real and immediate threat of

repeated injury” as well. Jibril v. Mayorkas, 20 F.4th 804, 814 (D.C. Cir. 2021) (cleaned up)

(quoting N.B. ex rel. Peacock v. District of Columbia, 682 F.3d 77, 84 (D.C. Cir. 2012)). That risk

is particularly pronounced on this record. The Plaintiffs have produced affidavits from individuals

whose citizenship status in SSA records is incorrect and who live in states that have agreements

with the Federal Defendants to use the modified SAVE to purge voter rolls. J. Doe 4 Decl. ¶¶ 8–12;

J. Doe 6 Decl. ¶¶ 5, 14–15. The administrative record shows that DHS “assumes the accuracy of

the Social Security Administration data” in its operation of SAVE, and thus, the system runs the

risk of “incomplete or false results” when individuals with inaccurate SSA data are run through it.

DHS AR 260; DHS AR 302; see also DHS AR 760 n.2. Indeed, the State of Texas does not

dispute that an independent investigation in Travis County, Texas, found that “twenty-five percent

of the non-citizen matches” in that county were individuals who had already proven citizenship in

the United States. Texas Mot. 17 (quoting Am. Compl. ¶¶ 141–42). The administrative record also

shows that, pursuant to its template agreement, DHS requires SAVE users to “contact the registrant

or registered voter to obtain proof of U.S. citizenship” “in all cases where the User Agency receives

any SAVE response other than that of U.S. citizen.” DHS AR 762. Thus, the Plaintiffs have shown

that their members will necessarily need to take “affirmative steps to avoid the risk of harm” that

accompanies being labeled a potentially ineligible voter should the modified SAVE system

continue to operate. Meese, 481 U.S. at 475. This is sufficient to demonstrate an Article III injury.

See Mi Familia Vota, 129 F.4th at 708–09; Arcia, 772 F.3d at 1341; League of Women Voters of

the U.S. v. Newby, 838 F.3d 1, 8 (D.C. Cir. 2016) (holding that the “experience of the Kansas

League” showed it was “almost certain that similar obstacles to registration will spring up in

Alabama and Georgia when those States decide to enforce their [proof-of-citizenship] laws”).

The Defendants make much of the fact that only a small proportion of the U.S. electorate

are naturalized voters with potentially inaccurate citizenship data in SSA records. This is a red

herring. The fact that only a “tiny number” of people are impacted by unlawful activity does not

mean that an Article III injury is not present. Contra Texas Mot. 16. Members of the Plaintiff

organizations are among those people—they live in States that have agreed to use SAVE data to

purge voter rolls and their SSA citizenship data is out of date. J. Doe 4 Decl. ¶¶ 8–12; Doe 6 Decl.

¶¶ 5, 15. The rule is not that an injury must be a generally shared grievance for it to be brought in

federal court. Rather, to sustain an action, an organization need only show that “one of its

members” suffered a particularized harm. Institutional S’holder Servs., 142 F.4th at 764 (quoting

Wash. All. of Tech. Workers, 50 F.4th at 175). And in this context, “even one disenfranchised

voter” is one “too many.” League of Women Voters of N.C. v. North Carolina, 769 F.3d 224, 244

(4th Cir. 2014).

Having established cognizable voter injuries, the Court turns to causation and

redressability. The Federal Defendants contend that the Plaintiffs’ voter injuries are caused by “the

independent action of some third party not before the court”—namely, states such as Texas. Fed.

Defs.’ Mot. 25–26 (citation omitted). Before addressing the Federal Defendants’ argument head

on, the Court notes that Texas is now a Defendant in this case. And “[w]hen a party intervenes, it

becomes a full participant in the lawsuit and is treated just as if it were an original party”—the

Court’s decision constitutes a “complete adjudication” on the merits and “the possibility that the

plaintiff will be able to obtain relief against the intervenor-defendant is part of the price paid for

intervention.” Schneider v. Dumbarton Devs., Inc., 767 F.2d 1007, 1017 (D.C. Cir. 1985) (first

quoting United States v. Oregon, 657 F.2d 1009, 1014 (8th Cir. 1981); and then quoting District

of Columbia v. MSPB, 762 F.2d 129, 132 (D.C. Cir. 1985)); see also Food & Water Watch v. U.S.

EPA, 5 F. Supp. 3d 62, 67 n.1 (D.D.C. 2013); Donovan v. Oil, Chem., & Atomic Workers Int’l

Union & Its Loc. 4-23, 718 F.2d 1341, 1350–51 (5th Cir. 1983); United States v. Jim, 891 F.3d

1242, 1252–53 (11th Cir. 2018).

Nevertheless, the Federal Defendants’ argument about third parties does not change the

result. As the Federal Defendants recognize, Article III “requires no more than de facto causality.”

Dep’t of Com. v. New York, 588 U.S. 752, 768 (2019) (quoting Block v. Meese, 793 F.2d 1303,

1309 (D.C. Cir. 1986) (Scalia, J.)); Fed. Defs.’ Mot. 26–27. A plaintiff has standing to sue the

federal government if “‘third parties will likely react’ to the government[’s] [action] (or judicial

relief) ‘in predictable ways’ that will likely cause (or redress) the plaintiff’s injury.” Diamond Alt.

Energy, LLC v. EPA, 606 U.S. 100, 112 (2025) (quoting Alliance for Hippocratic Medicine, 602

U.S. 367, 383 (2024)). The Defendants argue that states are the true cause of the Plaintiffs’ injuries

because “[n]o voter is cancelled from the rolls based solely on a SAVE response”; rather, Texas

engages in “additional verification” before cancelling voter registration. Texas Mot. 17; see also

Fed. Defs.’ Mot 26–27. But as explained above, that additional verification is itself an Article III

injury. And the undisputed record shows that the Plaintiffs’ members suffer that injury because

“SAVE records show that [they] are not . . . United States citizen[s].” B. Doe Decl., Ex. 2. It is

hardly surprising that additional voter verification and potential voter disenfranchisement is “the

predictable effect of” the federal government incorrectly informing a state that an individual may

be ineligible to vote. Hawkins v. Haaland, 991 F.3d 216, 225 (D.C. Cir. 2021) (quoting New York,

588 U.S. at 768).

Furthermore, this injury “is likely to be redressed by a favorable judicial decision.”

Students for Fair Admissions, 600 U.S. at 199 (quoting Spokeo, 578 U.S. at 338). Reverting SAVE

to its prior functionality before the recent changes—without the inaccurate SSA data labeling the

Plaintiffs’ members as non-citizens—would likely redress the Plaintiffs’ harms. Their future harms

from “potential errors” would certainly be redressed. Arcia, 772 F.3d at 1341; see also Mi Familia

Vota, 129 F.4th at 708–09.

3. Procedural Injuries

Finally, the Parties seem to dispute whether the Plaintiffs have standing to pursue their

procedural claims under the Privacy Act and the APA as well. See Pls.’ Mot. 22–25; Fed. Defs.’

Mot. 11–32; Texas Mot. 12–21. The Court finds that these injuries, too, are sufficient to support

standing.

Again, to demonstrate standing, a plaintiff must show: (1) that she suffered an “injury in

fact” that is concrete, particularized, and imminent, (2) that there is a fairly traceable “causal

connection between the injury and the conduct complained of,” and (3) that it is “likely” rather

than “speculative” that “the injury will be redressed by a favorable decision.” Dep’t of Educ. v.

Brown, 600 U.S. 551, 561 (2023) (quoting Lujan, 504 U.S. at 560–61). But for a procedural injury,

“courts relax—while not wholly eliminating—the issues of imminence and redressability[.]” Ctr.

for L. & Educ. v. Dep’t of Educ., 396 F.3d 1152, 1157 (D.C. Cir. 2005); see Brown, 600 U.S.

at 561. A plaintiff need only show “some concrete interest that is affected by the deprivation.”

Brown, 600 U.S. at 562 (quoting Summers v. Earth Island Inst., 555 U.S. 488, 496–97 (2009)). A

plaintiff need not demonstrate that observing proper procedure “would have led to (caused) a

different substantive outcome.” Id. at 565–66. Rather, the question is whether an agency’s

“substantive decisions” have any “causal relationship” to the interests that the plaintiff seeks to

vindicate. Id. at 566.

For instance, “a plaintiff with concrete plans to observe nature in a particular area ‘would

be harmed if [a] [land-management project] went forward without incorporation of the ideas he

would have suggested’ in his comments.” Id. (second alteration in original) (quoting Summers,

555 U.S. at 494). This is true even if it is “uncertain whether public comment would alter [that]

particular land-management decision[.]” Id. “A person ‘living adjacent to the site for proposed

construction of a federally licensed dam’” similarly “has standing to challenge the licensing

agency’s failure to prepare an environmental impact statement, even though he cannot establish

with any certainty that the statement will cause the license to be withheld or altered.” Id. at 561

(quoting Lujan, 504 U.S. at 572 n.7). “In th[ese] context[s], the fact that the defendant might well

come to the same decision[s] after abiding by the contested procedural requirement does not

deprive a plaintiff of standing.” Id. at 561–62. On the other hand, a plaintiff cannot bring a

procedural challenge to an agency action that bears no relationship to the “substantive decisions”

made by that agency. Id. at 566. For instance, a plaintiff whose application for a statutory benefit

was denied cannot challenge an agency’s procedure in deciding “to give other people [that benefit]

under a different statutory scheme.” Id. at 565 (emphasis omitted). That plaintiff’s injury—denial

of the statutory benefit—cannot be “traced” because the agency’s procedures governed a different

kind of benefit altogether. Id. at 567 (quoting Simon v. Eastern Ky. Welfare Rights Org., 426 U.S.

26, 42–43 (1976)). The question is whether the “procedural right” a plaintiff seeks to vindicate has

any bearing on the “protect[ion]” of the “concrete interest[s]” of that plaintiff. Ctr. for L. & Educ.,

396 F.3d at 1157 (emphasis omitted).

Here, as discussed, the Plaintiffs’ “legally protect[able] interest[s]” in privacy and voting

have been put at risk by the Federal Defendants’ failure to comply with the procedural

requirements of the Privacy Act and the APA. See Fontes, 152 F.4th at 1111. And the Federal

Defendants’ failure to follow these procedures deprived the Plaintiffs of the “adequate safeguards

. . . to prevent misuse of [their] information” that the law provides. Privacy Act of 1974 § 2(b)(1),

(4), 88 Stat. at 1896. Without these safeguards, the Plaintiffs were subject to nonconsensual

disclosure of their private information to DHS and SAVE users and the voter injuries that resulted

from inaccuracies in that data—the types of harms that these procedures were designed to remedy.

Undoubtedly then, the Plaintiffs have also shown that they have met the relaxed standard for

procedural standing based on the threat to their privacy and voting interests.

* * *

In sum, the Plaintiffs have unlocked three doors to show concrete injuries suffered by their

members. And with causation and redressability, they have sufficiently met their burden of

establishing Article III standing.

B. Final Agency Action

Moving to the next threshold argument, the Defendants contend that the establishment of

the modified SAVE system outlined in the DHS and SSA SORNs does not constitute a final agency

action reviewable under the APA. Texas Mot. 21–23; Fed. Defs.’ Mot. 36–38. This does not pass

muster.

The APA only permits review of “final agency action.” 5 U.S.C. § 704. An agency action

is final if it is (1) “the consummation of the agency’s decision-making process,” and (2) an action

“by which rights or obligations have been determined, or from which legal consequences will

flow.” Rhea Lana, Inc. v. Dep’t of Lab., 824 F.3d 1023, 1026 (D.C. Cir. 2016) (quoting Bennett v.

Spear, 520 U.S. 154, 177–78 (1997)). But whether rights or obligations have been determined or

“‘legal consequences will flow’ from an agency action is a ‘pragmatic’ inquiry.” Ipsen

Biopharmaceuticals, Inc. v. Azar, 943 F.3d 953, 956 (D.C. Cir. 2019) (quoting U.S. Army Corps

of Eng’rs v. Hawkes Co., 578 U.S. 590, 599 (2016)). Courts focus on the “concrete consequences”

of the “agency action” at issue. Cal. Cmtys. Against Toxics v. EPA, 934 F.3d 627, 637 (D.C. Cir.

2019).

The D.C. Circuit has long recognized that establishing “a policy of disclosing confidential

information without notice” constitutes a final agency action—observing that “permitting [federal]

employees to disclose confidential information without notice is surely a ‘consummation of the

agency’s decisionmaking process.’” Venetian Casino Resort, L.L.C. v. EEOC, 530 F.3d 925, 931

(D.C. Cir. 2008) (quoting Bennett, 520 U.S. at 177–78). After all, such a policy both determines

“the submitter’s rights” over the information handed over “and the agency’s obligations” on how

to handle that information. Id. (cleaned up). This is the exact result of the establishment of the

SAVE “modified system” outlined in the 2025 SORNs. Notice of a Modified System of Records,

90 Fed. Reg. at 48,948 (DHS AR 114); see also Notice of a Modified System of Records, 90 Fed.

Reg. at 50,879–84 (SSA AR 206–11). Those SORNs—which “illuminate[] the nature of the

policy”—reflect that establishing the modified system constituted the adoption of “a policy of

disclosing confidential information without notice.” Venetian Casino, 530 F.3d at 931. Thus,

establishing the SAVE modified system of records, as it is described in the 2025 SORNs, is a final

agency action.

In addition, the Plaintiffs challenge the SORNs themselves, which also count as final

agency action. See Pls.’ Reply 23.The SORNs permitted new “routine use[s] of the records

contained in the system[]” that they described and laid out “the policies and practices of the agency

regarding storage, retrievability, access controls, retention, and disposal of the records.” 5 U.S.C.

§ 552a(e)(4)(D)–(E); see Notice of a Modified System of Records, 90 Fed. Reg. at 48,948–49

(DHS AR 114–15); Notice of a Modified System of Records, 90 Fed. Reg. at 50,880

(SSA AR 207).7

The Defendants try to argue otherwise by relying on the D.C. Circuit’s decision in Centro

de Trabajadores Unidos v. Bessent, 167 F.4th 1218, 1236 (D.C. Cir. 2026). Fed. Defs.’

Mot. 37–38; Texas Mot. 5. But that case is inapposite. There, the D.C. Circuit held that when the

“text of the statute unambiguously authorizes . . . disclosure” of information, then a memorandum

of understanding explaining how that mandated disclosure will be executed is not a final agency

action. Centro de Trabajadores Unidos, 167 F.4th at 1234. This is because the memorandum “does

not impose binding duties—and therefore causes no legal consequences—when it merely clarifies

existing duties under a statute.” Id. at 1236 (cleaned up).

But unlike the statute at issue in Centro, the Privacy Act only authorizes a routine use

disclosure “within the scope of a routine use notice published by the agency.” Ames v. U.S. DHS,

861 F.3d 238, 240 (D.C. Cir. 2017) (citing 5 U.S.C. § 552a(a)(7), (e)(4)(D)). Thus, the 2025 DHS

and SSA SORNs are undoubtedly final agency actions, because the “concrete consequence[]” of

their promulgation is authorizing the challenged disclosures to occur, a consequence not authorized

by any other separate statutory mandate. Cal. Cmtys. Against Toxics, 934 F.3d at 637; see Barrick

Goldstrike Mines Inc. v. Browner, 215 F.3d 45, 48 (D.C. Cir. 2000) (“[D]ocument[s] reflecting a

settled agency position and having legal consequences . . . may constitute ‘final agency action’ for

The 2025 SSA SORN provided that its authorization of new routine uses would become automatically effective after thirty days. Notice of a Modified System of Records, 90 Fed. Reg. 50,879, 50,880 (Nov. 12, 2025) (SSA AR 207) Thus, even if the SORN did not constitute final agency action when it was issued, it certainly does now.

the purpose of judicial review.”). The SORNs act both as final “agency statement[s] of . . . future

effect designed to implement” the modified SAVE system and “license[s]” “permit[ting]” or acting

as a “form of permission” for the system, routine uses, and disclosures that they outline. Norton v.

S. Utah Wilderness All., 542 U.S. 55, 62 (2004) (first alteration in original) (quoting

5 U.S.C.§ 551). Both the establishment of the modified SAVE system described by the 2025

SORNs and the SORNs themselves are final agency actions that may be challenged under the

APA.

C. The Social Security Act

Turning to the merits, the Plaintiffs first argue that the modified SAVE system of records

violates the Social Security Act. They are correct.8

The Social Security Act instructs that: “Social security account numbers and related

records that are obtained or maintained by authorized persons pursuant to any provision of law

enacted on or after October 1, 1990, shall be confidential, and no authorized person shall disclose

any such social security account number or related record.” 42 U.S.C. § 405(c)(2)(C)(viii)(I). An

“authorized person” is “an officer or employee of the United States, an officer or employee of any

State, political subdivision of a State, or agency of a State or political subdivision of a State, and

any other person” who has access to such records. Id. § 405(c)(2)(C)(viii)(III).

There can be no question that the modified SAVE system violates this prohibition—the

system discloses both Social Security numbers and related records maintained by SSA. And the

Defendants do not argue otherwise. Instead, they contend that the Plaintiffs lack a cause of action

to enforce the Social Security Act—relying on inapposite cases where the relevant cause of action

Because the Plaintiffs succeed on their Social Security Act claim based on 42 U.S.C. § 405(c)(2)(C)(viii)(I), the Court does not address their alternative argument that the modified SAVE also violates 42 U.S.C. § 1306(a)(1). Pls.’ Mot. 32.

was not the APA. Fed. Defs.’ Mot. 50 (citing Biccum v. City of Watertown, No. 17-cv-645, 2019

WL 4752927 (N.D.N.Y. Sep. 30, 2019) (concerning a Section 1983 claim)). But the Defendants

ignore that “the APA provides an omnibus cause of action for violations of other statutes.” FDA

v. R. J. Reynolds Vapor Co., 606 U.S. 226, 232 n.4 (2025). The Plaintiffs’ claim challenging

compliance with the Social Security Act was brought under the APA. See Am Compl. ¶ 204. And

the APA’s judicial review provision, 5 U.S.C. § 702, “permits suit[s]” by any person aggrieved by

agency action “for violations of numerous statutes of varying character that do not themselves

include causes of action for judicial review.” Lexmark Int’l, Inc. v. Static Control Components,

Inc., 572 U.S. 118, 130 (2014). The Defendants do not explain why the APA’s cause of action

may not be used to remedy the Plaintiffs’ injuries caused by violations of the Social Security Act.

Indeed, the Defendants’ briefs are devoid of any mention of this subject. See Fed. Defs.’ Mot. 49–

50; Texas Mot. 26–27. Accordingly, the Defendants have conceded both (1) that an APA cause of

action exists for this claim, and (2) that the Social Security Act forbids disclosure of SSA data to

DHS or in responses to SAVE users. Texas v. United States, 798 F.3d 1108, 1110 (D.C. Cir. 2015)

(“[I]f a party files an opposition to a motion and therein addresses only some of the movant’s

arguments, the court may treat the unaddressed arguments as conceded.” (quoting Wannall v.

Honeywell, Inc., 775 F.3d 425, 428 (D.C. Cir. 2014))). By itself, this is sufficient for the Plaintiffs

to prevail.9

D. The Privacy Act

But there is more. Turning to the Privacy Act, the Plaintiffs argue that the SAVE modified

system violates the Act’s substantive and procedural protections. Pls.’ Mot. 35–40. The

The Defendants do argue that other statutes authorize the disclosure notwithstanding the Social Security Act, which the Court addresses below. See infra Discussion F; see also Fed. Defs.’ Mot. 49–50; Texas Mot. 26–27.

Defendants challenge the Plaintiffs’ ability to bring these claims under the APA and argue that

they fail in any event. See Fed. Defs.’ Mot. 54–59. The Plaintiffs’ arguments are more persuasive.

1. Other-Adequate-Remedy Bar

First, the Defendants argue that the Plaintiffs’ Privacy Act claims fail because “judicial

review” under the APA is not available when there is “[an]other adequate remedy in a court.”

5 U.S.C. § 704; Fed. Defs.’ Mot. 39. They point out that the Privacy Act provides judicial remedies

for some violations but does not authorize equitable relief to enforce the statute’s notice and

comment requirements or its limitations on disclosure. See Fed. Defs.’ Mot. 40–41 (citing 5 U.S.C.

§ 552a(g)); see also Sussman v. U.S. Marshals Serv., 494 F.3d 1106, 1122 (D.C. Cir. 2007).

Because the Privacy Act provides limited avenues for judicial review, 5 U.S.C. § 552a(g), the

Federal Defendants argue that Section 704 precludes APA relief based on that “other . . . remedy,”

5 U.S.C. § 704. See Fed. Defs.’ Mot. 39; Texas Mot. 23–24.

It is true that courts in this District have precluded APA suits for Privacy Act violations

when they “duplicate existing procedures for review of agency action.” Haleem v. U.S. Dep’t of

Def., No. 23-cv-1471, 2024 WL 230289, at *13–14 (D.D.C. Jan. 22, 2024) (quoting Bowen v.

Massachusetts, 487 U.S. 879, 903 (1988)). But these precedents are inapplicable to the statute’s

procedural requirements, 5 U.S.C. § 552a(e)(4), (11), and to forward-looking remedies to enforce

the statute’s disclosure provisions, 5 U.S.C. § 552a(b), for which the Privacy Act does not “offer[]

relief of the same genre,” Haleem, 2024 WL 230289, at *13 (quoting Garcia v. Vilsack, 563 F.3d

519, 522 (D.C. Cir. 2009)). Rather than suggesting a bar on APA review, the “absence of equitable

relief” for these claims in the Privacy Act’s judicial review provisions is easily “explained by the

availability of such relief under the APA,” Cooper, 566 U.S. at 303 n.12 (characterizing Doe v.

Chao, 540 U.S. 614, 619 n.1 (2004)); see also id. (“The [Privacy] Act deters violations of its

substantive provisions in other ways—for instance . . . possibly by allowing for injunctive relief

under the [APA]” (citations omitted)).10

Indeed, the D.C. Circuit has held that APA equitable or vacatur relief is available for

Privacy Act violations in a case where “the Privacy Act does not by itself authorize the injunctive

relief sought” by a plaintiff. Doe v. Stephens, 851 F.2d 1457, 1463, 1465–67 (D.C. Cir. 1988)

(challenging agency disclosure as not constituting a routine use under 5 U.S.C. § 552a(a)(7), (b)).

Various district courts have similarly rejected the Defendants’ reading of Section 704. See Ctr. for

Taxpayer Rts. v. IRS, 815 F. Supp. 3d 1, 43 (D.D.C. 2025); Am. Fed’n of Gov't Emps. v. U.S. OPM,

786 F. Supp. 3d 647, 691–92 (S.D.N.Y. 2025); Doe v. Noem, 783 F. Supp. 3d 907, 923–24 (W.D.

Va. 2025). And the Supreme Court has cautioned that the APA’s other-adequate-remedy bar,

5 U.S.C. § 704, should be “construed” narrowly and primarily to avoid “duplication,” rather than

“to defeat the [APA’s] central purpose of providing a broad spectrum of judicial review of agency

action.” Bowen, 487 U.S. at 903. “The mere fact that some acts are made reviewable,” Abbott

The Court notes that the inquiry is more complex for 5 U.S.C. § 552a(e)(5) and (e)(6), which require federal agencies to ensure the “accura[cy], complete[ess], timel[iness], and relevan[ce]” of records maintained to “mak[e] any determination about any individual” or that are “disseminated . . . to any person other than an agency.” These provisions are violated when it is reasonably “feasible, necessary, and proper for the agency . . . to determine whether each filed item of information is accurate,” timely, and relevant, but the agency fails to do so. Strang v. U.S. Arms Control & Disarmament Agency, 864 F.2d 859, 866 (D.C. Cir. 1989) (quoting Doe v. United States, 821 F.2d 694 (D.C. Cir. 1987) (en banc)). The Privacy Act provides for some injunctive relief when an agency fails to correct records “which the individual believes is not accurate, relevant, timely, or complete.” 5 U.S.C. § 552a(d)(2)–(3), (g)(1)(A). But the D.C. Circuit has made clear that the Privacy Act’s remedial provisions were not “intended to be [the] exclusive” remedies for such violations. Vymetalik v. F.B.I., 785 F.2d 1090, 1098 n.12 (D.C. Cir. 1986). And it is evident that Sections 552(e)(5) and (6) were violated here. See, e.g., DHS AR 240 (finding “risk” that the modified SAVE “may share inaccurate information with registered agencies”); DHS AR 260 (recognizing the modified SAVE’s “[s]hortfalls in data accuracy”); DHS AR 302 (same); SSA AR 44 (“[C]itizenship information in SSA’s records might not be current.”). Nevertheless, the Court does not rest its conclusion with respect to the Privacy Act on these violations given that the Federal Defendants also violated other provisions of the Privacy Act for which there is unambiguously no adequate relief for the Plaintiffs other than 5 U.S.C. §§ 702, 706.

Lab’ys v. Gardner, 387 U.S. 136, 141 (1967) (citation omitted), or that “a naked money judgment”

could be sought does not preclude APA review, Bowen, 487 U.S. at 905.

Stepping back, it is unclear whether the APA’s other-adequate-remedy bar even applies to

the Privacy Act. 5 U.S.C. § 704. Although courts commonly use terms like the “Administrative

Procedure Act” (or the “Freedom of Information Act”) to refer to the parts of Title 5 that carry

forward the substantive provisions of that Act, that language is technically imprecise. It is true that

the provisions of Chapter 5 and Chapter 7 of Title 5 “were originally enacted by act June 11, 1946,

ch. 324, 60 Stat. 237, popularly known as the ‘Administrative Procedure Act.’” 5 U.S.C. ch. 5,

subch. II note. But the Administrative Procedure Act was actually “repealed as part of [a] general

revision” by Congress in 1966. Id. In that revision, Congress repealed various statutes “relating to

the organization of government” and reenacted them as a single consolidated “Act” known as

“title 5.” Pub. L. No. 89–554, pmbl., §§ 7(a), 8, 80 Stat. 378, 378, 631–32 (1966). The APA was

one of the statutes repealed, id. § 8, 80 Stat. at 632 (repealing the APA, Pub. L. No. 79–404, 60

Stat. 237 (1946)), and Congress reenacted its provisions throughout the new “Act” “without

substantive change,” Pub. L. No. 89–554 § 7(a), 80 Stat. at 631. Thus, although courts popularly

use terms like the “Administrative Procedure Act”—there is in fact no Administrative Procedure

Act, just Title 5. See id. § 7(b), 80 Stat at 631 (“A reference to a law replaced by sections 1–6 of

this Act, including a reference in a regulation, order, or other law, is deemed to refer to the

corresponding provision enacted by this Act.”); Univ. of Cincinnati v. Shalala, 891 F. Supp. 1262,

1269 n.18 (S.D. Ohio 1995) (“Defendant cites to the Administrative Procedure Act (APA). The

APA was, however, repealed by Pub. L. No. 89–554, Sept. 6, 1966, 80 Stat. 381. The former

APA’s provisions were incorporated into 5 U.S.C. ch. 5 and 7.” (citation omitted)).

Importantly, in 1974, Congress enacted the Privacy Act as an amendment to that Act,

Title 5, and placed it in Chapter 5 alongside the APA’s provisions. Privacy Act of 1974 pmbl., 88

Stat. at 1896 (“To amend title 5, United States Code, by adding a section 552a[.]”). Thus, it is

unclear whether the other-adequate-remedy bar (Section 704 of Title 5) directs a comparison

between relief under the Privacy Act and relief under the APA. Think of it this way. Section 704

asks whether “there is no other adequate remedy in a court” to review “final agency action,”

5 U.S.C. § 704 (emphasis added), meaning that “APA review is not available if Congress has

provided a ‘special and adequate review procedure’ elsewhere,” V.I. Hous. Fin. Auth. v. Fed’l

Emergency Mgmt. Agency, 151 F.4th 409, 418 (D.C. Cir. 2025) (quoting Bowen, 487 U.S. at 904)).

But review under the Privacy Act might not count as review “elsewhere,” id., given that both the

Privacy Act and the APA might be properly conceived of as components of the same scheme:

Title 5. Compare 5 U.S.C. § 552a(g) (authorizing “civil action[s] against [an] agency” regarding

“the matters under the provisions of this subsection”), with id. § 702 (entitling aggrieved persons

“to judicial review”); cf. id. § 552a(d)(3) (referring to § 552a(g)(1)(A) as provisions for “judicial

review”). This would explain why the “inattention” to detail in the Privacy Act’s equitable relief

provisions is largely “explained by the general provisions for equitable relief within the

Administrative Procedure Act” provisions of Title 5. Doe, 540 U.S. at 619 n.1.11

Indeed, the APA’s typical remedy for a violation of Title 5 is to “set aside” the agency action altogether. 5 U.S.C. § 706. But for some violations not at issue here, the Privacy Act provides for lesser, more tailored equitable relief. See 5 U.S.C. § 552a(g)(2)–(3) (authorizing the court to order lesser remedies of amending records or mandating disclosure when an agency violates provisions in 5 U.S.C. § 552a(d)). Authorizing courts to grant lesser relief for some violations does not mean that the ordinary set-aside remedy is no longer available for others (e.g., failure to provide notice and comment). See Bowen v. Massachusetts, 487 U.S. 879, 901 (1988) (remedial schemes providing “doubtful and limited relief” for the violation at issue are not adequate remedies within the meaning of the APA).

This understanding—that Section 704 does not bar Privacy Act relief—is supported by the

Office of Management and Budget’s interpretive guidelines “issued contemporaneously with the

statute,” Loper Bright Enters. v. Raimondo, 603 U.S. 369, 394 (2024), which recognized that the

Privacy Act’s judicial review provisions would not preclude “judicial review under other

provisions of the [APA],” OMB Privacy Act Implementation: Guidelines and Responsibilities, 40

Fed. Reg. 28,948, 28,968 (July 9, 1975) (emphasis added). And subsequent enactments show that

this was Congress’ understanding, too. Later amendments (not at issue here) expanding civil

liability under the Privacy Act have indicated when Privacy Act remedies are “exclusive.” Judicial

Redress Act of 2015, Pub. L. No. 114–126, § 2(b), 130 Stat. 282, 282–84 (codified at 5 U.S.C.

§ 552a note). And “[w]here Congress includes particular language in one section of a statute but

omits it in another section of the same Act, it is generally presumed that Congress acts intentionally

and purposely in the disparate inclusion or exclusion.” City & Cnty. of S.F. v. EPA, 604 U.S. 334,

344 (2025) (quoting Russello v. United States, 464 U.S. 16, 23 (1983)). Thus, the statutory scheme

and context suggest that Privacy Act claims (when not brought under the provisions explicitly

designated exclusive) are neither exclusive nor barred by Section 704 of the APA.

Ultimately, the Defendants ask this Court to discard this statutory structure and depart from

the D.C. Circuit’s binding precedent in Stephens, arguing that the Circuit’s decision is not entitled

to deference because it sua sponte construed the plaintiff’s complaint as raising an APA claim. See

Fed. Defs.’ Mot. 42 n.10. But the Defendants do not explain why this means that Stephens is

entitled to less precedential weight. “[I]t is axiomatic” that any precedential holding of the D.C.

Circuit must be “binding on this court.” Alabama v. U.S. Army Corps of Eng’rs, 774 F. Supp. 3d

142, 154 (D.D.C. 2025). The Defendants may not like it, but Section 704 is not a bar to the

Plaintiffs’ APA claims.

2. Disclosure Claims

On the merits of the disclosure claims, the Plaintiffs argue that the Federal Defendants’

disclosure of their SSA data to DHS and SAVE users violates the Privacy Act’s protections against

non-consensual disclosures. Pls.’ Mot. 35. They are plainly correct.

The Privacy Act makes it “unlawful for an agency to disclose a record to another agency”

or to any other entity “without the written consent of the person to whom the record pertains.”

Cooper, 566 U.S. at 289 n.2 (citing 5 U.S.C. § 552a(b)). The Act defines a “record” broadly as

encompassing “any item, collection, or grouping of information about an individual that is

maintained by an agency, including . . . his name, or the identifying number, symbol, or other

identifying particular assigned to the individual.” 5 U.S.C. § 552a(a)(4) (emphasis added). And a

disclosure encompasses “any means of communication.” Id. § 552a(b). Thus, the Act is violated

whenever there is a “nonconsensual disclosure of any information that has been retrieved from a

protected record.” Bartel v. FAA, 725 F.2d 1403, 1408 (D.C. Cir. 1984).

This limitation is subject to “certain exceptions.” Cooper, 566 U.S. at 289 n.2. One such

exception is a “routine use,” which is defined as “the use of such record for a purpose which is

compatible with the purpose for which it was collected.” 5 U.S.C. § 552a(a)(7), (b)(3). “To fit

within the confines of the routine-use exception to the Privacy Act, an agency’s disclosure of a

record must be both (i) ‘for a purpose which is compatible with the purpose for which it was

collected’ and (ii) within the scope of a routine use notice published by the agency.” Ames, 861

F.3d at 240 (first quoting 5 U.S.C. § 552a(a)(7); and then citing id. § 552a(e)(4)(D)). “[C]ourts

have held that compatibility requires a ‘meaningful degree of convergence’ between the agency’s

purpose in collecting the record and the agency’s purpose in disclosing the record.” Id. at 240 n.1

(quoting Britt v. Naval Investigative Serv., 886 F.2d 544, 549 (3d Cir. 1989)) (citing Swenson v.

Postal Service, 890 F.2d 1075, 1078 (9th Cir. 1989)); see also Chichakli v. Tillerson, 882 F.3d

229, 233–34 (D.C. Cir. 2018).12

On this record, the Court concludes that DHS’s use of Social Security numbers and other

SSA data for voter verification through SAVE is not a routine use under the Privacy Act. Although

the DHS and SSA SORNs adopted new routine uses for SSA data for “citizenship and

immigration” verification “to the Department of Homeland Security,” Notice of a Modified

System of Records, 90 Fed. Reg. at 50,880 (SSA AR 207); see also Notice of a Modified System

of Records, 90 Fed. Reg. at 48,954 (DHS AR 120), this does not change the fact that SSA collected

this information for purposes concerning work authorization and eligibility for SSA benefits, see

SSA AR 115–16; SSA AR 132; SSA AR 149; SSA AR 168–69; SSA AR 188–89; Notice of a

Modified System of Records, 90 Fed. Reg. at 50,880 (SSA AR 207). The purpose of collecting

such information was never the maintenance of “U.S. citizenship records” for voter verification.

SSA AR 103. Indeed, SSA recognizes that its “citizenship information is accurate for SSA’s

program purposes” only—“if used later for other purposes, it may not be current.” Id.

The Federal Defendants’ response to this argument is underwhelming. The Federal

Defendants start by rejecting the premise that SSA “‘collected’ some form of ‘personal data’ from

individuals” at all. Fed Defs.’ Mot. 58 (emphasis omitted). That is because, they say, “Social

Security numbers are issued by SSA, to individuals”—thus, SSA collected nothing. Id. (emphasis

It has long been suggested that the Privacy Act requires “actual notice” of any routine uses at the time the record was collected. USPS v. Nat’l Ass’n of Letter Carriers, 9 F.3d 138, 146 (D.C. Cir. 1993); Covert v. Harrington, 876 F.2d 751, 755–56 (9th Cir. 1989). This understanding is based on the Privacy Act’s requirement that “the routine uses which may be made of the information, as published pursuant to [the SORN]” must be “on the form which [the agency] uses to collect the information or on a separate form that can be retained by the individual.” 5 U.S.C. § 552a(e)(3)(C). The Parties do not brief this issue. But without question, the record provides nothing supporting that the Plaintiffs’ members received actual notice that their SSA data would be used for voter verification purposes when they disclosed that information to SSA.

omitted). As an initial matter, it is unclear what the Federal Defendants believe to be the upshot of

this argument. Asking about the “purpose for which [a record] was collected” is an inquiry

prompted by the routine-use exception, 5 U.S.C. § 552a(a)(7), not the Privacy Act’s prohibition

on disclosure, 5 U.S.C. § 552a(b), or the definition of record, 5 U.S.C. § 552a(a)(4). The Federal

Defendants do not explain why the source of Social Security numbers permits them to circumvent

the Privacy Act’s disclosure prohibition.

If the Federal Defendants are arguing that Social Security numbers are not records subject

to the Privacy Act’s prohibition on disclosure, that position does not square with the statutory text.

Under the Privacy Act, a “record” encompasses any “grouping of information about an

individual”—which includes an “identifying number” (such as an SSN), the individual’s “name,”

and any other particularized information about that individual (e.g., “criminal or employment

history”). 5 U.S.C. § 552a(a)(4). The disclosure prohibition comes into effect whenever such a

record becomes retrievable by that “name,” “identifying number,” or “identifying particular.” Id.

§ 552a(a)(5), (b). Further, the contemporary ordinary meaning of the verb “collect” at the time the

Privacy Act was passed was: “[t]o bring together into a group; gather; assemble”; “[t]o accumulate

as a hobby or study”; “[t]o recover control of”; “[t]o gather together; congregate; accumulate.”

Collect, American Heritage Dictionary of the English Language 261 (New Coll. Ed. 1976). And

the contemporary ordinary meaning of the adjective “collected” was “brought together or placed

from various sources.” Id. Thus, both the statutory definitions and the ordinary meaning of the

Privacy Act’s text suggest that an SSN is a record—at least when it is grouped, gathered together,

or placed with other personal information. So when an individual fills out a Social Security

application with her name and other personal information and SSA attaches an “identifying

number” to that information, a record is “collected” within the meaning of the Privacy Act. And

undoubtedly, SSA’s master file is a system of records containing private data organized by these

identifiers. The Court thus concludes that an SSN and any information accumulated with it are

records that are subject to the non-disclosure provisions of the Privacy Act.

As icing on the cake, this understanding is supported by the enactment history of the

Privacy Act. When Congress enacted the statute, it created an expert “Privacy Protection Study

Commission” to examine government “data banks, automated data processing programs, and

information systems”; to recommend practices consistent with “the requirements and principles”

of the Act to the President; and to make “legislative recommendations” to Congress “to protect the

privacy of individuals while meeting the legitimate needs of government.” Privacy Act of 1974

§ 5(b), 88 Stat. at 1906 (codified at 5 U.S.C. § 552a note). In particular, Congress instructed the

Commission to study the “use of social security numbers . . . to gain access to, integrate, or

centralize information systems and files.” Id. § 5(c)(1)(C), 88 Stat at 1906.

That Commission examined the Internal Revenue Service’s (IRS) existing practice of

disclosing individuals’ “name[s], address[es],” and “Social Security number[s]” “primarily to

identify individuals who may have failed to file.” Priv. Prot. Study Comm’n, Federal Tax Return

Confidentiality, at 46 (June 1976). The Commission concluded that there was “uncertainty” about

the IRS’s privacy obligations, that the Privacy Act “would appear to constrain [the IRS’s]

disclosure[] of data about taxpayers,” and that the IRS had continued such disclosures after the

passage of the Act. Id. at 15. The Commission thus recommended “that the Congress permit the

Internal Revenue Service to disclose the Social Security numbers of Federal taxpayers in a

locality” in certain circumstances. Id. at 4. Congress thereafter amended the Internal Revenue

Code to authorize this use of Social Security numbers and implement the Commission’s

recommendation. Tax Reform Act of 1976, Pub. L. No. 94–455, § 1211(c), 90 Stat. 1520, 1712

(codified as amended at 26 U.S.C. § 6109(a), (d)). Indeed, since the enactment of the Privacy Act,

Congress has consistently employed express statutory authorizations when it permits disclosure or

use of Social Security numbers for verification purposes. Lawyers Defending American

Democracy Amicus Br. 12–13 (collecting statutes), ECF No. 87. These provisions would be

superfluous if the Federal Defendants were correct and SSNs were not subject to the nondisclosure requirements of the Privacy Act. The Court declines to adopt such an interpretation.

Nielsen v. Preap, 586 U.S. 392, 414 (2019) (recognizing that courts generally do not construe

statutes such that they cause other statutory provisions “to have no consequence” (quoting Antonin

Scalia & Bryan A. Garner, Reading Law: The Interpretation of Legal Texts 174 (2012))).

The Federal Defendants next argue that sharing SSA records to verify U.S. citizenship for

voting is a proper routine use because government agencies have widely used the Social Security

number as a “means of identifying and gathering information about an individual.” Fed Defs.’

Mot. 58 (citation omitted). But this is irrelevant, as it does not go to why a Social Security number

and the accompanying information were “collected” in the first place. 5 U.S.C. § 552a(a)(7). The

routine-use inquiry looks to whether the disclosure is “compatible with the purpose for which [the

record] was collected.” Id. And the Defendants fail to explain why the federal government’s

collection of private information to assess Social Security benefits has any nexus to state

governments’ voter verification efforts.

Finally, the Defendants ask this Court to defer to an OMB interpretation, promulgated over

a decade after the Privacy Act was enacted, stating that a routine use encompasses any use that the

Executive considers “necessary and proper.” Texas Mot. 29 (citing OMB, Guidance on the Privacy

Act, 52 Fed. Reg. 12,990, 12,993 (Apr. 20, 1987)); Fed. Defs.’ Mot. 57 (same). The Defendants

concede that the OMB interpretation is less “searching” than the widely accepted interpretation of

the Privacy Act “articulated by the Third Circuit and cited approvingly by the D.C. Circuit” and

other courts nationwide, see Tex. Mot. 29, but they advance it, nonetheless. It is hard to understand

how this argument could survive the Supreme Court’s recent instruction to not afford blind

deference to agency interpretations. See generally Loper Bright Enters. v. Raimondo, 603 U.S. 369

(2024); see also USPS v. Nat’l Ass’n of Letter Carriers, 9 F.3d 138, 148–49 (D.C. Cir. 1993)

(Randolph, J., dissenting) (suggesting that the prior regime of “judicial deference” to agency

interpretations of the Privacy Act has allowed “the federal government [to] cede[]—lock, stock

and barrel—its statutory responsibility under the Privacy Act to preserve the confidentiality of

records pertaining to individuals”). And regardless, the statute does not contain the sort of

ambiguity that would previously have invited such deference—“the term ‘routine use’ means, with

respect to the disclosure of a record, the use of such record for a purpose which is compatible with

the purpose for which it was collected.” 5 U.S.C. § 552a(a)(7). Indeed, the Defendants fail to

identify any language in the statute that supports interpreting the routine-use exception to mean

any use designated “necessary and proper” by the Executive Branch. See Texas Mot. 29; Fed.

Defs.’ Mot. 57.

Without question, it is the duty of Congress, not federal agencies, to determine what is

“necessary and proper for carrying into [e]xecution” other enactments. Art. I, § 8, cl. 18. Congress

determined that “it is necessary and proper for the Congress” itself, not agencies, “to regulate the

collection, maintenance, use, and dissemination of information” “to protect the privacy of

individuals identified in information systems maintained by Federal agencies.” Privacy Act of

1974 § 2(a)(5), 88 Stat. at 1896 (codified at 5 U.S.C. § 552a note). And Congress provided that it

is the duty of federal agencies to not disclose records for any purpose not “compatible with the

purpose for which [the record] was collected.” 5 U.S.C. § 552a(a)(7), (b)(3). SSA’s disclosure of

Social Security numbers and associated information that SSA collected to DHS and states for voter

verification is not such a “compatible” use.

Meanwhile, Texas argues that the disclosure is authorized under another exception

altogether—the law enforcement exception in 5 U.S.C. § 552a(b)(7). That exception permits

disclosure for law enforcement “within or under the control of the United States” when “the head

of the agency or instrumentality has made a written request to the agency which maintains the

record specifying the particular portion desired and the law enforcement activity for which the

record is sought.” Id.; Texas Mot. 29–30. As the Plaintiffs correctly point out, there is no

suggestion that any such request was made. See Pls.’ Opp’n 19. Texas does not dispute this point

and candidly admits that the “Plaintiff[s] identified several errors in Texas’s Motion.” Texas

Reply 1 n.1. So this argument is unavailing as well. The Federal Defendants clearly violated the

Privacy Act’s non-disclosure bar by disclosing SSA records to DHS and SAVE users (including

states) without the consent of the Plaintiffs’ members. See 5 U.S.C. § 552a(b).

3. Procedural Claims

Next, the Plaintiffs argue that the establishment of the modified SAVE system outlined in

the 2025 SORNs without notice and comment violates the Privacy Act’s procedural protections.

Pls.’ Mot. 38–44. The Court agrees.

The Privacy Act requires notice and comment at least thirty days in advance of a “new use

or intended use of the information” in a system of records. 5 U.S.C. § 552a(e)(11). The statute

further requires the publication of a SORN “upon establishment or revision” of such a system. Id.

§ 552a(e)(4). Undoubtedly, SAVE is a system of records under the statute—a fact that DHS has

acknowledged in at least eight SORNs,13 and in a May 2025 agreement governing data sharing

between DHS and SSA, DHS AR 420–31. At a prior stage of these proceedings, the Federal

Defendants even conceded that the 2025 modifications to SAVE were substantial enough that the

Privacy Act would require notice if it covered SAVE. Mot Hr’g Tr. 69:21–24.

Yet the Defendants failed to publish SORNs at least thirty days before overhauling SAVE.

They instead launched the modified SAVE system without a SORN on May 22, 2025. See

DHS AR 491; DHS AR 493; DHS AR 1385. And they continued the new uses for five months

before DHS issued a SORN on October 31, 2025, and SSA issued a SORN on November 12, 2025.

See Notice of a Modified System of Records, 90 Fed. Reg. at 48,948 (DHS AR 114); Notice of a

Modified System of Records, 90 Fed. Reg. at 50,879–80 (SSA AR 206–07). Further, the

SORNs—when eventually published—had some curious features. The DHS SORN made clear

that the modification was already “effective upon publication”; that relevant individuals could

“[s]ubmit comments on or before December 1, 2025”; and that “[n]ew or modified routine uses

w[ould] be effective December 1, 2025,” regardless. Notice of a Modified System of Records, 90

Fed. Reg. at 48,949 (DHS AR 115).

The Plaintiffs argue that the establishment of the modified SAVE system as described in

the 2025 SORNs—as well as the SORNs themselves—violated a long line of D.C. Circuit cases

holding that an opportunity to comment must be “meaningful,” Rural Cellular Ass’n v. FCC, 588

F.3d 1095, 1101 (D.C. Cir. 2009), and that a postponed opportunity for notice and comment can

See Notice of Modified System of Records, 85 Fed. Reg. at 31,798 (DHS AR 108); DHS USCIS–004 SAVE Program System of Records, 81 Fed. Reg. at 78,619; DHS USCIS—004— SAVE Program System of Records, 77 Fed. Reg. at 47,415; USCIS–004 Verification Information System of Records Notice, 73 Fed. Reg. at 75,445; USCIS VIS System of Records Notice, 73 Fed. Reg. at 10,793; Privacy Act: VIS Records Notice, 72 Fed. Reg. at 17,569; Privacy Act of 1974 System of Records, 67 Fed. Reg. at 64,134; Privacy Act of 1974 System of Records, 66 Fed. Reg. at 46,812.

have a “curative effect depend[ing] on the agency’s mind remaining open enough at [that] later

stage,” McLouth Steel Prods. Corp. v. Thomas, 838 F.2d 1317, 1323 (D.C. Cir. 1988).

Undoubtedly, the Federal Defendants’ process was anything but open-minded. The DHS SORN

made clear that the modifications to SAVE were immediately effective and that new uses would

go into effect automatically on December 1, 2025, on the last day that comments were still being

solicited. See Notice of a Modified System of Records, 90 Fed. Reg. at 48,949 (DHS AR 115).

And the SSA SORN added the disclosure of Social Security numbers to DHS as a new routine use

long after SSA had already begun such disclosures, offering no opportunity for benefits applicants

and concerned persons to offer comments prior to the sharing of their data. See DHS AR 431 (May

2025 agreement authorizing disclosure of records); Notice of a Modified System of Records, 90

Fed. Reg. at 50,880 (SSA AR 207) (notice of new routine use on November 12, 2025). The SAVE

notice and comment process thus provided little opportunity for meaningful input and

consideration of comments.

The Defendants argue that the line of D.C. Circuit precedents upon which the Plaintiffs

rely was overturned by the Supreme Court’s recent instruction in Little Sisters of the Poor Saints

Peter & Paul Home v. Pennsylvania that “the APA imposes no general ‘open-mindedness’

requirement on agencies beyond the statute’s specific ‘objective criteria.’” Bahman Grp. v.

Palluconi, No. 22-cv-3826, 2025 WL 3225196, at *5 (D.D.C. Sep. 29, 2025) (quoting Little Sisters

of the Poor Saints Peter & Paul Home v. Pennsylvania, 591 U.S. 657, 685 (2020)); Fed. Defs.’

Mot. 55; Texas Mot. 30–31. But Little Sisters was just an application of the “general proposition

that courts are not free to impose upon agencies specific procedural requirements that have no

basis in the APA.” Little Sisters, 591 U.S. at 685 (quoting Pension Benefit Guar. Corp. v. LTV

Corp., 496 U.S. 633, 654 (1990)). That rule has little relevance here.

Indeed, in Little Sisters, the lower court held that an agency failed to maintain an open

mind when its “final rules” were “virtually identical” to their pre-comment counterparts. Id.

(citation omitted). The Supreme Court recognized that the APA, among other things, “requires that

final rules must be published 30 days before they become effective” and that “interested persons”

must be provided an opportunity to comment. Id. at 685–86. There, the rules at issue “were

published on November 15, 2018, [and] did not become effective until January 14, 2019—more

than 30 days after being published” and subject to comment. Id. at 686. Since the agency

“complied with . . . these statutory procedures,” the Supreme Court ruled that the lower court erred

in “impos[ing] judge-made procedures in addition to the APA’s mandates” by requiring the agency

to “maintain[] an open mind” as well. Id. at 684–86 (cleaned up).

Here, unlike in Little Sisters, SAVE’s “modified system [was] effective upon publication”

of the SORNs, and public comment was permitted only after the modified SAVE system was

implemented. Notice of a Modified System of Records, 90 Fed. Reg. at 48,949 (DHS AR 115);

see also Notice of a Modified System of Records, 90 Fed. Reg. at 50,880 (SSA AR 207). This is

flatly inconsistent with the Privacy Act’s statutory requirement that “notice of any new use or

intended use of the information in the system” and “an opportunity” for comment must be provided

“at least 30 days prior” to the final SORN. 5 U.S.C.§ 552a(e)(11). And a final SORN must be

published “subject to the provisions” of the Act requiring notice and comment. Id. § 552a(e)(4).

The SSA and DHS SORNs—as well at the modified SAVE system they describe—fail to meet

these statutory requirements because they were never preceded by proposed revision notice and

comment periods “30 days prior.” Id. § 552a(e)(11). Unlike in Little Sisters where the final rule

was promulgated “more than 30 days after” they were proposed, the 2025 SORNs at issue here

were not in compliance with the “procedural requirements that Congress”—not the courts—

established. Little Sisters, 591 U.S. at 686 (cleaned up).

“The Privacy Act’s public notice and comment structure is an essential component of the

Act and an essential piece of American democracy. Americans deserve to know the nature, scope,

and routine uses of the records before they are collected by the federal government.” Weber, 816

F. Supp. 3d at 1193 (emphasis added); see also Privacy Act of 1974 § 2(b)(1), 88 Stat. at 1896

(noting the Privacy Act’s protections seek to “permit an individual to determine what records

pertaining to him are collected, maintained, used, or disseminated by such agencies”). Indeed, “[i]t

is flatly inconsistent with the text, structure, and purpose of the Privacy Act for an agency to initiate

a major new data-sharing program affecting the sensitive data of millions of Americans, then

validate that program as a ‘routine use’ months after it has begun.” League of United Latin Am.

Citizens, 818 F. Supp. 3d at 115–16. These requirements were imposed by Congress—they are not

“judge-made.” Little Sisters, 591 U.S. at 685 (quoting Perez v. Mortg. Bankers Ass’n, 575 U.S.

92, 102 (2015)).

Assuming that the Federal Defendants are correct and Little Sisters abrogated the D.C.

Circuit’s use of the open-mindedness test, the Federal Defendants are no better off. The openmindedness test is at best a “judge-made procedur[e]” to excuse failure to comply with statutory

obligations. Id. at 685 (quoting Mortg. Bankers Ass’n, 575 U.S. at 102). Without it, there is no

basis to conclude that the Federal Defendants may ever use “additional commentary” to excuse

failure to provide notice “without actual suspension of the [agency action] in question.” Forester

v. Consumer Prod. Safety Comm’n, 559 F.2d 774, 788 n.19 (D.C. Cir. 1977). Thus, since the

Federal Defendants have neither shown compliance with the open-mindedness test nor the Privacy

Act’s notice and comment requirements, 5 U.S.C. § 552a(e)(11), they have acted “without

observance of procedure required by law,” 5 U.S.C. § 706(2)(D).14

E. The Administrative Procedure Act

The Plaintiffs also argue that the establishment of the SAVE modified system was arbitrary

and capricious under the APA, 5 U.SC. § 706(2)(A). Pls.’ Mot. 40–44. The Court is persuaded.

The APA “requires agencies to engage in reasoned decision-making” and “to reasonably

explain to reviewing courts the bases for the actions they take and the conclusions they reach.”

Bhd. Of Locomotive Eng’rs v. Fed. R.R. Admin., 972 F.3d 83, 115 (D.C. Cir. 2020) (quoting DHS

v. Regents of the Univ. of Cal. (Regents), 591 U.S. 1, 16 (2020)). To do so, an agency must

“examine the relevant data and articulate a satisfactory explanation for its action.” FCC v. Fox

Television Stations, Inc., 556 U.S. 502, 513 (2009) (quoting Motor Vehicle Mfrs. Ass’n of U.S. v.

State Farm Mut. Auto. Ins. Co., 463 U.S. 29, 43 (1983)). Agency action is arbitrary and capricious

if it “has relied on factors which Congress has not intended it to consider, entirely failed to consider

an important aspect of the problem, offered an explanation for its decision that runs counter to the

evidence before the agency, or is so implausible that it could not be ascribed to a difference in

view or the product of agency expertise.” State Farm, 463 U.S. at 43.

The Defendants claim that the comment period provided by the SORNs render the

notice-and-comment claim moot and suggest that the Plaintiffs must establish standing for each component of the modified SORN (i.e., bulk searches). See Fed. Defs.’ Mot. 33; Texas Reply 6–7. But the Plaintiffs’ notice-and-comment claim is not moot because notice and comment is required “prior to” the new use. 5 U.S.C. § 552a(e)(11). The Plaintiffs have shown procedural standing to challenge the agency action—the 2025 SORNs and the modified SAVE detailed in the 2025 SORNs—which the record shows affected their privacy disclosure and voter registration interests. That injury is not moot. The Defendants’ point about each component of the modified SORN perhaps goes to severability. But that is an issue that was not properly raised before this Court and is thus conceded.

Importantly, this “standard demands that an agency give a reasoned justification for its

decision to alter an existing regulatory scheme,” Farmers Union Cent. Exch., Inc. v. FERC, 734

F.2d 1486, 1500 (D.C. Cir. 1984), a principle known as the “change-in-position doctrine,” FDA v.

Wages & White Lion Invs., L.L.C., 604 U.S. 542, 568 (2025). “An agency may not, for example,

depart from a prior policy sub silentio or simply disregard rules that are still on the books.” Fox

Television, 556 U.S. at 515 (citing United States v. Nixon, 418 U.S. 683, 696 (1974)). “And of

course the agency must show that there are good reasons for the new policy.” Id. Under the

doctrine, agencies are “free to change their existing policies as long as they provide a reasoned

explanation for the change, display awareness that they are changing position, and consider serious

reliance interests.” Wages & White Lion Invs., 604 U.S. at 568 (cleaned up).

Here, the Federal Defendants concede that they changed position, but they stress that they

expressed awareness of the change through press releases. Fed. Defs.’ Mot. 56. But by failing to

engage in notice and comment when “expanding the scope” of the SAVE program, the Federal

Defendants neither “consider[ed] serious reliance interests” nor considered opposing views. Fox

Television, 556 U.S. at 515,517. Indeed, the “central object of requiring that the public be afforded

notice and an opportunity to comment is to assure that the agency fully understands the potential

impact of a proposed rule before finalizing it. Public notice and comment, that is, might alter an

agency’s initial assumptions about whether (and how) a proposed rule affects the public at large.”

City of Billings v. TSA, 153 F.4th 46, 53 (D.C. Cir. 2025). By changing their position without the

statutorily required notice and comment, the Federal Defendants both failed to consider “factors

which Congress . . . intended [them] to consider” (i.e., the “written data, views, or arguments” of

impacted persons, 5 U.S.C. § 552a(e)(11)), and they “entirely failed to consider an important

aspect of the problem” (i.e., the reliance interests of persons who had provided information to SSA

or failed to update SSA data without knowledge of how it would now be used). State Farm, 463

U.S. at 43. Even “[s]tanding alone, a notice and comment violation establishes that the

government’s conduct was arbitrary and capricious.” See In re Long-Distance Tel. Serv. Fed.

Excise Tax Refund Litig., 751 F.3d 629, 637 (D.C. Cir. 2014).

Furthermore, even if the Federal Defendants later considered comments in response to the

modified SORNs, those comments could not provide a “reasoned explanation for the change” that

the Federal Defendants undertook. Wages & White Lion Invs., 604 U.S. at 568 (citation omitted).

Indeed, an agency’s “explanation ‘must be viewed critically’ to ensure that the [change] is not

upheld on the basis of impermissible ‘post hoc rationalization.’” Regents, 591 U.S. at 21 (quoting

Citizens to Pres. Overton Park, Inc. v. Volpe (Overton Park), 401 U.S. 402, 420 (1971)). “It is a

‘foundational principle of administrative law’ that judicial review of agency action is limited to

‘the grounds that the agency invoked when it took the action.’” Id. at 20 (quoting Michigan v. EPA,

576 U.S. 743, 758 (2015)). This is mandated by the APA’s instruction to consider “the ‘whole

record’” before the agency when engaging in judicial review. Overton Park, 401 U.S. at 419

(quoting 5 U.S.C. § 706). Since the Federal Defendants implemented the SAVE modified system

in May 2025, the explanations in the 2025 SORNs and the comments received thereafter are not

properly before the Court because they postdate the decision to implement the challenged program.

And without the statutorily mandated comments, the Federal Defendants were unable to “assess

whether there were reliance interests, determine whether they were significant, and weigh any such

interests against competing policy concerns.” Regents, 591 U.S. at 33. To state the obvious, this

was arbitrary and capricious. Id.

Since the Federal Defendants are unable to rely on “belated justifications” to explain their

failure to comply with the procedural requirements of the APA and Privacy Act, they must “deal

with the problem afresh” should they wish to implement any SAVE modifications not barred by

the substantive provisions of the Privacy Act or Social Security Act. Id. at 21, 23 (first quoting

SEC v. Chenery Corp. (Chenery I), 318 U.S. 80, 94 (1943); and then quoting SEC v. Chenery

Corp. (Chenery II), 332 U.S. 194, 201 (1947)). In the words of the Supreme Court:

The Government . . . protests that requiring a new decision before considering . . .

new justifications would be “an idle and useless formality.” Procedural

requirements can often seem such. But here the rule serves important values of

administrative law. Requiring a new decision before considering new reasons

promotes “agency accountability[]” by ensuring that parties and the public can

respond fully and in a timely manner to an agency’s exercise of authority.

Id. at 23 (citations omitted). Accordingly, this Court must vacate the modified SAVE system and

the Federal Defendants “must comply with the procedural requirements for new agency action.”

Id. at 21. That means revising SAVE or authorizing any other “new use or intended use of the

information in the system” only after engaging in notice and comment. 5 U.S.C. § 552a(e)(11).

Finally, the Federal Defendants argue that they are not required to comply with the APA’s

arbitrary and capricious procedural requirement because:

Unlike for an APA rulemaking . . . —which starts with a notice of proposed

rulemaking and ends with a final rule—a Privacy Act SORN publication does not

end with any agency obligation to state “in the rules adopted a concise general

statement of their basis and purpose.” 5 U.S.C. § 553(c). So

arbitrary-and-capricious review—which is typically based on the quality and the

content of the agency’s explanation in that “statement” of the final rule’s “basis and

purpose,” id.—does not make sense in this . . . context.

Fed. Defs.’ Mot. 54 (emphasis omitted). But this argument is not supported by the text of the APA.

The arbitrary-and-capricious principle is laid out in Section 706 of the APA, not Section 553(c).

And the argument has also been rejected by the Supreme Court. See Overton Park, 401 U.S.

at 417–21 (holding that an agency that was exempt from making findings under Section 553(c)

due to exclusion in Section 553(a)(2) was nevertheless subject to arbitrary- and-capricious review,

with review focusing on the “whole record” before the agency when it took the decision).

“Justice Holmes famously wrote that ‘men must turn square corners when they deal with

the Government.’ But it is also true, particularly when so much is at stake, that the Government

should turn square corners in dealing with the people. The basic rule here is clear . . . [t]his is not

the case for cutting corners to allow DHS to rely upon reasons absent from its original decision.”

Regents, 591 U.S. at 24 (cleaned up).

F. Other Statutes

Having flunked compliance with the Social Security Act, the Privacy Act, and the APA,

the Defendants look to other statutes to justify the establishment of the modified SAVE system.

They contend that even if the agency action violates the Social Security Act, the Privacy Act, or

the APA, it is nevertheless authorized by provisions of the Immigration Reform and Control Act

of 1986 (1986 Act), Pub. L. No. 99–603, 100 Stat. 3359, and the Illegal Immigration Reform and

Immigrant Responsibility Act of 1996 (1996 Act), Pub. L. No. 104–208, 110 Stat. 3009–546. Fed.

Defs.’ Mot. 45–53; Texas Mot. 25–27. This argument is not a winner either.

Start with this: The Defendants are effectively arguing that the 1986 Act and the 1996 Act

displace or supersede the relevant provisions of the Social Security Act, the Privacy Act, and the

APA. But that argument runs contrary to the “strong presumption that repeals by implication are

disfavored and that Congress will specifically address pre-existing law when it wishes to suspend

its normal operations in a later statute.” Epic Sys. Corp. v. Lewis, 584 U.S. 497, 510 (2018)

(cleaned up). When interpreting statutory provisions that appear to be in tension, a court “must . . .

strive to give effect to both” and is not at “liberty to pick and choose among” them. Id. (quoting

Morton v. Mancari, 417 U.S. 535, 551 (1974)). A court will only imply otherwise “if there is a

‘positive repugnancy’ between overlapping statutes,” and even then, the court must cure such a

conflict only “to the extent of the repugnancy.” United States v. Philip Morris Inc. 263 F. Supp. 2d

72, 76 (D.D.C. 2003) (quoting United States v. Borden Co., 308 U.S. 188, 198–99 (1939)). Thus,

courts find implied repeals only in cases where: (1) “two statutes are in ‘irreconcilable conflict,’”

or (2) “the latter Act covers the whole subject of the earlier one and ‘is clearly intended as a

substitute.’” Branch v. Smith, 538 U.S. 254, 273 (2003) (Scalia, J.) (quoting Posadas v. Nat’l City

Bank, 296 U.S. 497, 503 (1936)).

The Federal Defendants argue that applying this canon runs contrary to the understanding

that “statutes enacted by one Congress cannot bind a later Congress, which remains free to repeal

the earlier statute, to exempt the current statute from the earlier statute, to modify the earlier statute,

or to apply the earlier statute but as modified.” Fed. Defs.’ Mot. 49 (quoting Dorsey v. United

States, 567 U.S. 260, 274 (2012)). But this argument misapprehends the basis of the presumption

against implied repeals. The presumption is founded on the principle that:

Since laws are presumed to be passed with deliberation, and with full knowledge

of existing ones on the same subject, it is but reasonable to conclude that the

legislature, in passing a statute, did not intend to interfere with or abrogate any

former law relating to the same matter, unless the repugnancy between the two is

irreconcilable.

Scalia & Garner, Reading Law 328 (citation omitted). Undoubtedly then, requiring a “clear[]

statement” for implied repeals does not in any way impair Congress’ authority to undo or modify

its predecessors’ actions but merely “reflect[s] ‘common sense as to the manner in which Congress

is likely’” to do so. See Biden v. Nebraska, 600 U.S. 477, 511 (2023) (Barrett, J., concurring)

(quoting FDA v. Brown & Williamson Tobacco Corp., 529 U.S. 120, 133 (2000)).

Here, the Defendants have failed to meet their “heavy burden of showing” that the statutes

they cite and the Privacy Act “cannot be harmonized.” Epic Sys. Corp., 584 U.S. at 510. Indeed,

none of the provisions that the Defendants cite support their proposition.

The Defendants first point to the 1986 Act, which provides that DHS “shall implement a

system for the verification of immigration status under paragraphs (3) and (4)(B)(i) of

section 1137(d) of the Social Security Act (as amended by this section) so that the system is

available to all the States.” § 20(c)(1), 100 Stat. at 3391 (codified at 42 U.S.C. § 1320b–7 note).

But this provision, alongside its cross-references, has little relevance to this case. Section 1137(d)

governs “income and eligibility verification,” “documentation,” and “denial of benefits” under the

Social Security Act. 42 U.S.C. § 1320b–7(d). Paragraph (3) provides that “the State shall utilize

the individual’s alien file or alien admission number to verify with [DHS] the individual’s

immigration status through an automated or other system” when a non-citizen or non-national

applies for certain benefits. Id. § 1320b–7(d)(3). It is expressly limited to benefits applications for

applicants who are “not a citizen or national of the United States” and makes no reference to using

a Social Security number as opposed to “the individual’s alien file or alien admission number.” Id.

§ 1320b–7(d)(2), (3). Paragraph (4)(B)(i) provides that if a State finds that a non-citizen has other

documentation which “constitutes reasonable evidence” that he is eligible for benefits, then the

State must provide “photostatic or other similar copies of such documents, or information from

such documents, as specified by [DHS], for official verification.” Id. § 1320b–7(4)(B)(i).

While SAVE was originally established to effectuate the 1986 Act’s benefit-verification

provisions, DHS AR 420, these provisions govern benefits, not voter eligibility. And nothing in

the 1986 Act suggests that any resulting system could not be harmonized with the protections in

the Privacy Act. To the contrary, the 1986 Act expressly amended the Social Security Act to ensure

that the “automated or other system . . . protects the individual’s privacy to the maximum degree

possible.” § 121(d)(3)(B), 100 Stat. at 3385 (codified at 42 U.S.C. § 1320b–7(d)(3)(B)).

Next, the Defendants rely on a provision in the 1996 Act that provides that DHS “shall

respond to an inquiry by a Federal, State, or local government agency, seeking to verify or ascertain

the citizenship or immigration status of any individual within the jurisdiction of the agency for any

purpose authorized by law, by providing the requested verification or status information.” 8 U.S.C.

§ 1373(c). The Federal Defendants argue that this provision authorizes the modified SAVE and

permits DHS to verify citizenship in any manner that it sees fit—notwithstanding prior statutory

limitations on inter-agency data sharing and disclosure of private information. See Fed. Defs.’

Mot 46–49. But such a reading is inconsistent with normal rules of statutory interpretation.15 “[N]o

statute pursues any single purpose at all costs,” and courts no longer depart from a statute’s

ordinary meaning merely to effectuate the executive’s claim that doing so would merely help it

“make effective a statute’s purpose.” See Medina v. Planned Parenthood S. Atl., 606 U.S. 357,

368 (2025) (cleaned up). Rather, “[i]t is a fundamental canon of statutory construction that the

words of a statute must be read in their context and with a view to their place in the overall statutory

scheme.” West Virginia v. EPA, 597 U.S. 697, 721 (2022) (quoting Davis v. Mich. Dep’t of

Treasury, 489 U.S. 803, 809 (1989)).

“Context is not found exclusively within the four corners of a statute”; “[b]ackground legal

conventions, for instance, are part of the statute’s context.” Nebraska, 600 U.S. at 512 (Barrett, J.,

concurring) (cleaned up). One such convention is that the 1996 Act should not be read to impliedly

amend or repeal the Privacy Act’s protections unless it “expressly contradicts” those protections

or “such a construction is absolutely necessary in order [for] the words” of the 1996 Act to “have

any meaning at all.” Nat’l Ass’n of Home Builders v. Defs. of Wildlife, 551 U.S. 644, 662–63

Because the Defendants lack a basis for their actions based on the plain meaning of the statutes that they cite, the Court does not address whether they would also satisfy the “clear statement” rule of the major questions doctrine—should that rule apply in this context. See Biden v. Nebraska, 600 U.S. 477, 505–06 (2023); but see Louis J. Capozzi III, Biden v. Nebraska and the Continued Refinement of the Major Questions Doctrine, Harv. J.L. & Pub. Pol’y: Per Curiam, Summer 2024 No. 13, at 6–7 (suggesting that an action is politically significant for purposes of the major questions doctrine if it raises concerns that the Executive is using vague terms to “try to enact policies circumventing Congress,” especially on an issue of ongoing public debate).

(2007) (cleaned up); see also id. at 664 n.8 (“[W]e have repeatedly recognized that implied

amendments are no more favored than implied repeals.”). As evidenced by the record before this

Court, the Federal Defendants do not need to depart from the Privacy Act’s procedural

requirements or its substantive protections to verify citizenship requests. Indeed, since the 1996

Act’s passage, the Federal Government has never needed SSA data or to depart from Privacy Act

procedures to verify citizenship requests. See supra Bkd. (noting that SAVE did not access SSA

data until 2025). Furthermore. the ordinary meaning of “verify ‘is “to establish the truth, accuracy,

or reality of” something. Verify, Merriam Webster’s Collegiate Dictionary (10th Ed. 1996); see

also Verification, Merriam Webster’s Collegiate Dictionary (10th Ed. 1996) (“the act or process

of verifying”; “the state of being verified”). And the record shows that the modified SAVE has

caused inaccurate rather than accurate matching of citizenship data. See, e.g., DHS AR 240

(finding “risk” that the modified SAVE “may share inaccurate information with registered

agencies”); DHS AR 260 (recognizing the modified SAVE’s “[s]hortfalls in data accuracy”);

DHS AR 302 (same); SSA AR 44 (“[C]itizenship information in SSA’s records might not be

current.”). Simply put, there is no reason to believe that an implied repeal or amendment of the

protections of the Privacy Act or Social Security Act is “absolutely necessary” for the verification

provisions in Section 1373(c) to have any effect. Mittleman v. Postal Regul. Comm’n, 757 F.3d

300, 306 (D.C. Cir. 2014) (quoting Nat’l Ass’n of Home Builders, 551 U.S. at 662–63).

Finally, the Defendants argue that Section 1373(a) of the 1996 Act authorized the

establishment of the modified SAVE system of records. See Fed Defs.’ Mot. 45–46. That provision

states: “Notwithstanding any other provision of Federal, State, or local law, a Federal, State, or

local government entity or official may not prohibit, or in any way restrict, any government entity

or official from sending to, or receiving from, [DHS] information regarding the citizenship or

immigration status, lawful or unlawful, of any individual.” 8 U.S.C. § 1373(a). But prohibitory

language such as “shall not” or “may not” is generally not read as an “an affirmative grant of

power.” See New England Power Co. v. New Hampshire, 455 U.S. 331, 341 (1982). Nothing in

this provision permits the Federal Defendants to create a new system of records with complete

disregard for the Privacy Act’s protections. Indeed, the “Executive Branch interpretation . . . issued

roughly contemporaneously with enactment of the statute” and “the longstanding ‘practice of the

government’” since the 1996 Act’s enactment confirms that this is not the case. Loper Bright, 603

U.S. at 386 (quoting NLRB v. Noel Canning, 573 U.S. 513, 525 (2014)); see Relationship Between

Illegal Immigr. Reform & Immigrant Resp. Act of 1996 & Statutory Requirement for

Confidentiality of Census Info., 23 Op. O.L.C. (May 18, 1999) (slip op. at 6), 1999 WL 34995963

(recognizing that Section 1373(a) does “not clearly invest governmental officials or entities with

the affirmative authority to disclose information in circumstances where they otherwise would be

prohibited from doing so by a federal statute”); see supra Bkd. (explaining that DHS complied

with the Privacy Act in instituting SAVE up until 2025). Simply put, Section 1373(a) does not on

its own authorize the establishment of the SAVE modified system—it is merely a prohibition on

conduct.

Moreover, “the overall statutory scheme” of the 1996 Act also does not support the

Defendants’ interpretation. West Virginia, 597 U.S. at 721 (quoting Davis, 489 U.S. at 809). For

instance, another provision of the 1996 Act authorizes SSA to “compare[] the name and social

security account number provided in an inquiry” to its own files, but only “to confirm (or not

confirm) the validity of the information provided regarding an individual whose identity and

employment eligibility must be confirmed,” and only as part of a temporary employment

verification pilot program (E-Verify) that, among others, states and the “Department[s] of the

Federal Government shall elect to participate in.” §§ 402(e)(1)(A)(i), 404(e), 110 Stat. at 658, 665

(codified at 8 U.S.C. § 1324a note). Importantly, that temporary “system” does not permit SSA to

“disclose or release social security information (other than such confirmation or nonconfirmation)”

and prohibits SSA from “utiliz[ing] any information, data base, or other records” in the program

“for any other purpose.” Id. § 404(e), (h)(1), 110 Stat. at 3009–665. The 1996 Act also provides

that the authorization for this matching system would be temporary and only last a “4-year period.”

Id. § 401(b), 110 Stat. at 3009–655–56 (codified at 8 U.S.C. § 1324a note).16 The 1996 Act’s

authorization for limited Social Security number verification for employment purposes only, its

strict controls on what SSA information can be accessed and how it is used, and the limited

program duration would make little sense if another provision of that same Act, e.g.,

Section 1373(a) or (c), already authorized SSA to share any of its records regardless of any other

law, as the Defendants suggest. Cf. 1986 Act § 101(a), 100 Stat. at 3361–65 (codified as amended

at 8 U.S.C. § 1324a(b), (d)) (establishing that, like voter eligibility, the Federal Government is also

authorized to verify employment eligibility of non-citizens). Courts generally presume that

Congress does not enact such “surplusage.” Preap, 586 U.S. at 414 (recognizing that courts are

hesitant to adopt an interpretation that “causes [a provision] to duplicate another provision”

(quoting Scalia & Garner, Reading Law 174)). And “[w]here Congress uses certain language in

one part of a statute and different language in another, it is generally presumed that Congress acts

intentionally.” Nat’l Fed’n of Indep. Bus. v. Sebelius, 567 U.S. 519, 544 (2012). Here, the statutory

scheme of the 1996 Act shows that “Congress knew how to” permit Social Security number

verification “when it wanted to” and chose not to in Section 1373(a) or (c). Allina Health Servs. v.

Congress has since extended the deadline for termination of that program to September 30, 2026. Consolidated Appropriations Act of 2026, Pub. L. No. 119–75, § 5014, 140 Stat. 173, 631 (codified at 8 U.S.C. § 1324a note).

Price, 863 F.3d 937, 944 (D.C. Cir. 2017) (Kavanaugh, J.). None of the provisions that the

Defendants cite support the overhaul of SAVE.

G. Comity and Equitable Considerations

Finally, the Defendants ask this Court to deny relief to the Plaintiffs based on “principles

of equity and comity”; entering a judgment for the Plaintiffs, they say, may interfere with consent

decrees entered during this litigation in other federal courts while this litigation was ongoing. See

Fed. Defs.’ Mot. 62. The Court is not convinced for two reasons.

First, the Defendants’ argument necessarily requires this Court to construe the Defendants’

consent decrees before other courts—something that this Court lacks the authority to do. See

Martini v. Republic Steel Corp., 532 F.2d 1079, 1081 (6th Cir. 1976) (“As to those counts of

appellants’ complaint which allege that the consent decree is not being properly implemented we

note that . . . [t]he consent decree applies nationwide, but principles of comity certainly require

that these issues be raised before the court which granted the decree.”). This alone is a basis to

reject the Defendants’ argument.

Second, even if it were a proper consideration, comity does not favor dismissing or

abstaining in this circumstance. “[T]he doctrine of federal comity . . . permits one federal district

court to defer to the jurisdiction of another federal district court on an issue properly before the

latter court in order to avoid unnecessarily burdening the federal judiciary and delivering

conflicting judgments.” Beck v. U.S. DOJ, No. 88-cv-3433, 1991 WL 519827, at *5 (D.D.C. Jan.

31, 1991) (citing Kerotest Mfg. Co. v. C–O–Two Fire Equipment Co., 342 U.S. 180 (1952)). The

doctrine applies most readily “where previously-filed litigation is brought promptly to the attention

of the district court” and comity considerations are asserted early in litigation. See Church of

Scientology of Cal. v. U.S. Dep’t of the Army, 611 F.2d 738, 750 (9th Cir. 1979), overruled on

other grounds by Animal Legal Def. Fund v. U.S. FDA, 836 F.3d 987, 989 (9th Cir. 2016) (per

curiam). The Court’s decision is “equitable in nature,” with an eye towards “[w]ise judicial

administration, giving regard to conservation of judicial resources and comprehensive disposition

of litigation[.]” Kerotest Mfg., 342 U.S. at 183. And this Court has “ample . . . discretion” in

assessing these interests, Stone & Webster, Inc. v. Ga. Power Co., 779 F.3d 614, 617 (D.C. Cir.

2015) (quoting Kerotest Mfg., 342 U.S. at 183–84), which “requires a balancing not of empty

priorities but of equitable considerations genuinely relevant to the ends of justice,” Columbia Plaza

Corp. v. Sec. Nat. Bank, 525 F.2d 620, 628 (D.C. Cir. 1975) (quoting Polaroid Corp. v. Casselman,

213 F. Supp. 379, 381 (S.D.N.Y. 1962)). See Kline v. Burke Constr. Co., 260 U.S. 226, 229 (1922)

(“The forbearance which courts of co-ordinate jurisdiction, administered under a single system,

exercise towards each other . . . [has] perhaps no higher sanction than the utility which comes from

concord[.]” (quoting Covell v. Heyman, 111 U.S. 176, 182 (1884))).

The Court doubts that judicial administration and efficiency warrant dismissing this case

for comity reasons at this late stage of proceedings—where all Parties have briefed the merits and

the Court is ready to enter final relief. Nor is it apparent that the Federal Defendants having entered

a consent decree purportedly barring the very relief sought in this litigation while it was ongoing

is consistent with the equitable considerations of clean hands, “good faith,” and the prevention of

“forum shopping.” EEOC v. Univ. of Pa., 850 F.2d 969, 972, 979 (3d Cir. 1988), aff’d, 493 U.S.

182 (1990). The Court finds that equity would not bar this suit where the result would be “to

circumvent” the APA action at issue. Id. at 978. Indeed, comity does not favor deferring to another

forum when it is not “apparent that a remedy is available there”—and the Plaintiffs have no say in

the consent decrees that the Federal Defendants enter in other districts. Mann Mfg., Inc. v. Hortex,

Inc., 439 F.2d 403, 408 (5th Cir. 1971) (quoting Lapin v. Shulton, Inc., 333 F.2d 169, 172 (9th Cir.

1964)).

Simply put, even if they were appropriately before the Court in these circumstances, the

Defendants’ comity arguments are unavailing. See Emrick v. Bethlehem Steel Corp., 624 F.2d 450,

454 (3d Cir. 1980) (affirming the district court’s dismissal of a direct challenge to a consent decree

for comity purposes but reversing the district court’s dismissal of other statutory claims merely

because they may implicate the consent decree).

H. Constitutional Claims

Finally, because this case can be resolved on a statutory basis, the Court does not reach the

Plaintiffs’ constitutional claims. See Pls.’ Mot. 33. “[C]ourts ‘ought not to pass on questions of

constitutionality unless such adjudication is unavoidable.’” United States v. Gaffney, 812

F. Supp. 3d 49, 81 (D.D.C. 2025) (quoting Matal v. Tam, 582 U.S. 218, 231 (2017)).

REMEDY

The APA mandates that a “reviewing court shall . . . hold unlawful and set aside agency

action” that is in excess of statutory authority, contrary to law, unconstitutional, arbitrary and

capricious, or procedurally defective. 5 U.S.C. § 706(2)(A)–(D) (emphasis added). Setting aside

an agency action means “re-establish[ing] the status quo absent the unlawful agency action.” Las

Ams. Immigrant Advoc. Ctr. v. U.S. DHS, 783 F. Supp. 3d 200, 233 (D.D.C. 2025) (citation

omitted); see also Ctr. for Biological Diversity v. Haaland, No. 22-cv-3588, 2023 WL 5161741,

at *7 (D.D.C. Aug. 11, 2023) (“The remedy of vacatur under the Administrative Procedure Act

restores the prior regulatory status quo; the invalid rule is eliminated and replaced by any

preexisting rule it had superseded.” (cleaned up)). Accordingly, the Court sets aside and vacates

the 2025 DHS and SSA SORNs as unlawful. Notice of a Modified System of Records, 90 Fed.

Reg. 48,948 (DHS AR 114–21); Notice of a Modified System of Records, 90 Fed. Reg. 50,879

(SSA AR 205–11). The Court further sets asides and vacates the SAVE “modified system”

described in the 2025 DHS SORN. Notice of a Modified System of Records, 90 Fed. Reg.

at 48,948 (DHS AR 114–21).

CONCLUSION

For the foregoing reasons, the Court grants the Plaintiffs’ Motion for Summary Judgment,

ECF No. 66, and denies the Federal Defendants’ Motion to Dismiss (or in the alternative Motion

for Summary Judgment), ECF No. 77, and the State of Texas’ Motion to Dismiss, ECF No. 97.

A separate order will issue.

SPARKLE L. SOOKNANAN

United States District Judge

Date: June 22, 2026

League of Women Voters v. U.S. Department of Homeland Security

Authorities cited

Opinion · public domain