UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLUMBIA
COMMON CAUSE, et al.,
Plaintiffs,
Civil Action No. 26 - 1352 (SLS)
v. Judge Sparkle L. Sooknanan
U.S. DEPARTMENT OF JUSTICE, et al.,
Defendants.
MEMORANDUM OPINION
The Civil Rights Division has been dubbed the “crown jewel” of the Justice Department.
President Dwight D. Eisenhower authorized the Division as part of the Civil Rights Act of 1957,
and three months later, it was born. The Division was forged in the Civil Rights Movement in
response to massive resistance against racial integration. The Supreme Court’s landmark decision
in Brown v. Board of Education, 344 U.S. 1 (1952), and our Nation’s new voting laws gave the
Division its first missions. Even in its infancy, the Division stood at the forefront of the federal
government’s efforts to protect Americans’ right to vote. And since then, generations of Civil
Rights Division attorneys and staff have worked to protect that right—a sacred right that gives our
citizenry a say in its government and secures all other individual rights against government
interference.
Against that backdrop, this case is anomalous. The Plaintiffs, a voting-rights organization
and four individual voters, allege that the Civil Rights Division has set out on a mission antithetical
to its purpose and history: to remove voters from voter rolls across the country, including United
States citizens. They challenge a policy adopted by the current Civil Rights Division seeking
unprecedented influence over states’ longstanding authorities to register eligible voters and maintain their voter rolls. Under the policy, the Plaintiffs say, the Division is demanding voter
registration lists from all states, comparing those lists against a citizenship-status database plagued
with inaccuracies, and urging states to remove voters who the Division deems ineligible. This
policy, the Plaintiffs contend, has left untold numbers of disenfranchised voters in its wake and
inflicted injuries to the Plaintiffs’ privacy and informational rights to boot.
The Defendants, the Department of Justice (DOJ) and the Attorney General, insist that DOJ
has the statutory authority to adopt this policy. But their claimed sources of authority raise
eyebrows. The Defendants claim that statutes aimed at expanding the Civil Rights Division’s tools
to protect the right to vote—the Civil Rights Act of 1960, the National Voter Registration Act, and
the Help America Vote Act—give the Division the authority to demand that states remove United
States citizens from their rolls. In furtherance of this position, the Defendants make other startling
arguments. They suggest that every American citizen who registers to vote is the subject of a voter
fraud investigation underway in the Civil Rights Division simply because they registered to vote.
And the Defendants downplay the risk of voter disenfranchisement—despite knowingly relying
on an inaccurate database to check voter eligibility. Behind all the window dressing, the challenged
policy represents the federal government’s attempt to decide who gets to vote. But Congress has
left that authority where our Constitution has always placed it: with the states.
DOJ cannot run roughshod over longstanding laws that were carefully crafted to protect
the rights of the American people. The Civil Rights Division’s policy is unlawful in several
respects. First, the Defendants’ claimed authorities—Civil Rights Act of 1960, the National Voter
Registration Act, and the Help America Vote Act—do not authorize the policy. Second, the policy
is arbitrary and capricious under the Administrative Procedure Act. Third, the policy violates both
substantive and procedural protections in the Privacy Act, a statute designed to ban federal data
2
banks and preserve the American tradition of limited, transparent government. And fourth, the
policy violates limits imposed by the Paperwork Reduction Act. The Court therefore sets aside and
vacates the challenged policy under the Administrative Procedure Act.
Today’s decision does not prevent the federal government from taking lawful steps to
support states’ efforts to maintain accurate voter rolls. Neither does it prevent states from
maintaining their own voter rolls. And to state the obvious, the Court’s decision does not pave the
way for ineligible voters to vote in our elections. Rather, the Court vacates a policy that has
removed United States citizens from the voter rolls in their home states and risks disenfranchising
many more—a policy that flies in the face of duly enacted laws designed to protect Americans.
When the federal government defies federal laws, our system of checks and balances permits
individuals to turn to federal courts for recourse. And if they prevail, courts are duty-bound to step
in under the Constitution.
BACKGROUND
A. Statutory Background
This case involves a quintet of statutes: the Civil Rights Act of 1960, the National Voter
Registration Act, the Help America Vote Act, the Privacy Act, and the Paperwork Reduction Act.
1. Voter Protection Laws
Congress passed the Civil Rights Act of 1960, Pub. L. No. 86-449, 74 Stat. 86 (1960)
(codified at 52 U.S.C. § 20701 et seq.), to buttress the “voting provisions of the Civil Rights Act
of 1957” and to “assur[e] full rights of suffrage to all Americans,” United States v. Mayton, 335
F.2d 153, 159 (5th Cir. 1964); see also Alabama ex rel. Gallion v. Rogers, 187 F. Supp. 848, 852
(M.D. Ala. 1960) (“[T]he entire history of the [1960 Civil Rights Act] reflects that it was and is
designed to provide a means of enforcing the basic federally guaranteed rights of citizenship (to
vote) against state action.”), aff’d sub nom. Dinkens v. Att’y Gen., 285 F.2d 430 (5th Cir. 1961).
3
Title III of the 1960 Act provides that “[e]very officer of election shall retain and preserve . . . all
records and papers which come into his possession relating to any application, registration,
payment of poll tax, or other act requisite to voting” “for a period of twenty-two months from the
date of any general, special, or primary election of which candidates for the [federal offices] are
voted for[.]” 52 U.S.C. § 20701. To enforce that record-retention requirement, Title III requires
that any record covered by Section 20701 be made available to the Attorney General upon
“demand in writing,” so long as the demand “contain[s] a statement of the basis and the purpose
therefor.” Id. § 20703. And Title III vests district courts with “jurisdiction by appropriate process
to compel the production” of records demanded under Section 20703. Id. § 20705.
Roughly three decades later, in 1993, Congress enacted the National Voter Registration
Act (NVRA), Pub. L. No. 103-31, 107 Stat. 77 (1993) (codified at 52 U.S.C. § 20501 et seq.), “to
address concerns that voter registration laws and procedures were depressing voter turnout,”
United States v. Evans, No. 25-cv-4403, 2026 WL 2267774, at *2 (D.D.C. Aug. 6, 2026).
Accordingly, “[t]he NVRA requires States to provide simplified systems for registering to vote in
federal elections[.]” Young v. Fordice, 520 U.S. 273, 275 (1997) (emphasis omitted). And it
“imposes requirements about just when, and how, States may remove people from the federal voter
rolls.” Id. at 276 (citing 52 U.S.C. § 20507(a)(3)–(4)). Relevant here, the NVRA requires that each
state “conduct a general program that makes a reasonable effort to remove the names of ineligible
voters from the official lists of eligible voters by reason of . . . the death of the registrant; or . . . a
change in the residence of the registrant[.]” 52 U.S.C. § 20507(a)(4). But states must complete
“any program the purpose of which is to systematically remove the names of ineligible voters from
the official lists of eligible voters” no later than 90 days before “a primary or general election for
Federal office[.]” Id. § 20507(c)(2)(A). If a state fails to comply with the NVRA, “[t]he Attorney
4
General may bring a civil action in an appropriate district court for such declaratory or injunctive
relief as is necessary to carry out [the NVRA].” Id. § 20510(a).
Nine years later, Congress supplemented the NVRA with the Help America Vote Act
(HAVA), Pub. L. No. 107-252, 116 Stat. 1666 (2002) (codified at 52 U.S.C. § 20901 et seq.).
Enacted following the contentious 2000 presidential election, “HAVA aimed to alleviate a
significant problem voters experience—eligible voters being turned away at the polls because their
names were missing from voter registration lists.” United States v. Benson, 179 F.4th 470, 476
(6th Cir. 2026) (cleaned up). It “require[s] every State to create and maintain a computerized
statewide list of all registered voters.” Crawford v. Marion Cnty. Election Bd., 553 U.S. 181, 192
(2008); see 52 U.S.C. § 21083(a). And states must “ensure that voter registration records in the
State are accurate and are updated regularly” and “make[] a reasonable effort to remove registrants
who are ineligible to vote from the official list of eligible voters.” 52 U.S.C. § 21083(a)(4),
(a)(4)(A). HAVA empowers the Attorney General to enforce its provisions by “bring[ing] a civil
action against any State or jurisdiction in an appropriate United States District Court for such
declaratory and injunctive relief . . . as may be necessary to carry out [HAVA’s] uniform and
nondiscriminatory election technology and administration requirements.” Id. § 21111.
2. Privacy Act
Enacted in 1974, the Privacy Act establishes “certain safeguards for an individual against
an invasion of personal privacy by requiring Federal agencies” to “collect, maintain, use, or
disseminate any record of identifiable personal information in a manner that assures that such
action is for a necessary and lawful purpose.” Pub. L. No. 93-579, § 2(b), (b)(4), 88 Stat. 1896,
1896 (1974). The Act imposes several limits on the ability of federal agencies to collect and
disseminate the personal information of American citizens. Four such restrictions are relevant here.
5
First, the Privacy Act furnishes certain procedural safeguards. When an agency
“establish[es] or revis[es]” any “system of records”—that is, “a group of any records” from which
an individual’s information may be retrieved—the agency must “publish in the Federal Register
. . . a notice of the existence and character of the system of records.” Id. § 552a(a)(5), (e)(4). And
the Act specifies that these Systems of Records Notices (SORNs) “shall include” nine categories
of information. Id. § 552a(e)(4). For instance, a SORN must include “each routine use of the
records contained in the system, including the categories of users and the purpose of such use[.]”
Id. § 552a(e)(4)(D).
Second, the Privacy Act limits when federal agencies may disclose government records,
whether within or outside the federal government—subject to certain exceptions. See 5 U.S.C.
§ 552a(b). Under the “routine use” exception, an agency may disclose a record “for a purpose
which is compatible with the purpose for which it was collected[.]” Id. § 552a(a)(7), (b)(3); see
also League of Women Voters v. DHS, 835 F. Supp. 3d 79, 98 (D.D.C. 2026). Separately, the “law
enforcement” exception permits disclosure
to another agency or to an instrumentality of any governmental jurisdiction within
or under the control of the United States for a civil or criminal law enforcement
activity if the activity is authorized by law, and if the head of the agency or
instrumentality has made a written request to the agency which maintains the record
specifying the particular portion desired and the law enforcement activity for which
the record is sought[.]
5 U.S.C. § 552a(b)(7).
Third, the Privacy Act imposes record-accuracy requirements. It requires agencies to
“maintain all records . . . with such accuracy, relevance, timeliness, and completeness as is
reasonably necessary to assure fairness[,]” id. § 552a(e)(5), and to “make reasonable efforts to
assure that such records are accurate, complete, timely, and relevant for agency purposes” “prior
6
to disseminating any record about an individual to any person other than an agency,” id.
§ 552a(e)(6).
Finally, the Privacy Act limits federal collection of information about First Amendment
protected activities. It forbids agencies from “maintain[ing]” any record “describing how any
individual exercises rights guaranteed by the First Amendment unless expressly authorized by
statute or by the individual about whom the record is maintained or unless pertinent to and within
the scope of an authorized law enforcement activity[.]” Id. § 552a(e)(7).
3. Paperwork Reduction Act
The Paperwork Reduction Act (PRA), Pub. L. No. 96-511, 94 Stat. 2812, 2812 (1980)
(codified as amended at 44 U.S.C. § 3501 et seq.), “sets standards for federal agencies when
collecting information from the public[,]” United to Protect Democracy v. Presidential Advisory
Comm’n on Election Integrity, 288 F. Supp. 3d 99, 101–02 (D.D.C. 2017). It requires federal
agencies to follow certain procedural steps before and during the “collection of information.”
44 U.S.C. §§ 3506(c), 3507(a). As relevant here, the PRA defines “collection of information” as
“the obtaining, causing to be obtained, soliciting, or requiring the disclosure to third parties or the
public, of facts or opinions by or for an agency, regardless of form or format, calling for . . .
answers to identical questions posed to, or identical reporting or recordkeeping requirements
imposed on, ten or more persons, other than agencies, instrumentalities, or employees of the United
States[.]” Id. § 3502(3). States are “persons” for PRA purposes. See id. § 3502(10). And while the
PRA does not apply to the “collection of information . . . during the conduct of a Federal criminal
investigation or prosecution” or a “civil action to which the United States or any official or agency
thereof is a party[,]” it nevertheless governs “the collection of information during the conduct of
7
general investigations . . . undertaken with reference to a category of individuals or entities such
as a class of licensees or an entire industry.” Id. § 3518(c).
When agencies propose a “collection of information,” they must “provide 60-day notice in
the Federal Register, and otherwise consult with members of the public and affected agencies . . .
to solicit comment[.]” Id. § 3506(c)(2)(A). 1 And when agencies collect information, they must
“inform[] the person receiving the collection of information of . . . the reasons the information is
being collected [and] the way such information is to be used[.]” Id. § 3506(c)(1)(B)(iii)(I)–(II).
B. Factual Background
The Court draws the facts from the Parties’ Joint Appendix, ECF No. 45. See 5 U.S.C.
§ 706; LCvR 7(n).
In March 2025, President Donald J. Trump signed an Executive Order related to election
administration. Exec. Order No. 14248, 90 Fed. Reg. 14005 (Mar. 25, 2025). Relevant here, it
directed the Attorney General to “take all appropriate action to enter into information-sharing
agreements” with state officials, with the goal of “provid[ing] the Department of Justice with
detailed information on all suspected violations of State and Federal election laws discovered by
State officials, including information on individuals” who, among other things, voted despite being
ineligible. Id. § 5(a), (a)(i). The Executive Order also instructed the Attorney General to “prioritize
1
There are exceptions to this notice requirement not applicable here. See 44 U.S.C. § 3506(c)(2)(B) (permitting “notice and comment” on proposed rules to suffice for PRA purposes); id. § 3507(j) (allowing the Director of the Office of Management and Budget to temporarily authorize collections of information without the 60-day notice when “public harm is reasonably likely to result if normal clearance procedures are followed[,] an unanticipated event has occurred[,] or . . . the use of normal clearance procedures is reasonably likely to prevent or disrupt the collection of information or is reasonably likely to cause a statutory or court ordered deadline to be missed”).
8
enforcement of Federal election integrity laws” in states that refused to enter into informationsharing agreements or otherwise cooperate with DOJ. Id. § 5(b)(i).
To implement the Executive Order, DOJ’s Civil Rights Division launched what the
administrative record refers to as the “list maintenance project,” e.g., CRT-7; CRT-27, or the
“NVRA List Maintenance Project,” CRT-3397. Broadly speaking, the Division began requesting
states’ unredacted voter rolls, disclosing the lists to other federal agencies, comparing them against
a federal database to identify purportedly ineligible voters, and demanding that states remove
voters from their rolls based on the results of those comparisons. Consistent with the administrative
record, the Court will refer to the challenged policy as the “Voter List Maintenance Policy.” And
drawing the facts from the administrative record, the Court will describe the policy in detail.
In May 2025, the Civil Rights Division began contacting states to request complete and
unredacted copies of their computerized statewide voter registration lists (SVRLs), including
voters’ full names, dates of birth, residential addresses, and state driver’s license numbers or last
four digits of Social Security numbers. E.g., CRT-2496. The Division assured states that “all data
received . . . w[ould] be kept securely and treated consistently with the Privacy Act.” E.g., CRT2686. The administrative record reflects that the Division made these requests to 49 states and the
District of Columbia. 2 States responded in different ways. At least 18 states fully cooperated,
2
See CRT-2107 (DOJ letter to Alabama); CRT-2327 (Alaska); CRT-2396 (Arizona); CRT-2407 (Arkansas); CRT-2428 (California); CRT-2432 (proposed MOU between DOJ and Colorado stating “[t]he Justice Department is requesting your state’s [voter registration list]”); CRT-2496 (Connecticut); CRT-2522 (Delaware); CRT-2548 (District of Columbia); CRT-2558 (Florida); CRT-2572 (Georgia); CRT-2593 (Hawaii); CRT-2647 (Idaho); CRT-2679 (Illinois); CRT-2688 (Indiana); CRT-2699 (Iowa); CRT-2710 (Kansas); CRT-2730 (Kentucky); CRT-2744
(Louisiana); CRT-2763 (Maine); CRT-2766 (Maryland); CRT-2774 (Massachusetts); CRT-2783 (Michigan); CRT-2818 (Minnesota); CRT-2838 (Mississippi); CRT-2858 (Missouri); CRT-2872 (Montana); CRT-2891 (Nebraska); CRT-2905 (Nevada); CRT-2908 (New Hampshire); CRT2923 (New Jersey); CRT-2948 (New Mexico); CRT-2952 (New York); CRT-2959 (North Carolina); CRT-2986 (Ohio); CRT-2989 (Oklahoma); CRT-3051 (Oregon); CRT-3068
9
turning over their unredacted SVRLs. See Pls.’ Mem. Supp. Partial Summ. J. Mot. (Mot.) at 7,
ECF No. 29-1; Defs.’ Combined Mem. Supp. Mot. Dismiss/Mot. Summ. J. and Opp’n to Pls.’
Mot. (Cross-Mot. & Opp’n) at 8–9, ECF No. 32-1. But others refused, leading DOJ to file a bevy
of lawsuits seeking to compel compliance. To date, every court to rule on motions to dismiss filed
by state defendants have dismissed DOJ’s enforcement actions. 3
(Pennsylvania); CRT-3071 (Rhode Island); CRT-3076 (South Carolina); CRT-3130 (South Dakota); CRT-3137 (Tennessee); CRT-3144 (Texas); CRT-3159 (Utah); CRT-3187 (Vermont); CRT-3190 (Virginia); CRT-3196 (Washington); CRT-3200 (West Virginia); CRT-3231 (email from DOJ attorney to Wisconsin Elections Commission “demand[ing] . . . [a]n electronic copy of the full Wisconsin statewide voter registration list”); CRT-3401 (Wyoming). North Dakota does not maintain a statewide voter registration list, see Brakebill v. Jaeger, 905 F.3d 553, 556 (8th Cir. 2018) (“North Dakota has no voter registration requirement”), so DOJ did not demand one from that state.
3
By this Court’s count, at least 25 federal district courts have dismissed enforcement actions brought by DOJ to obtain SVRLs, and one circuit court has affirmed dismissal. See United States v. Fontes, 832 F. Supp. 3d 944, 954 (D. Ariz. 2026); United States v. Weber, 816 F. Supp. 3d 1168, 1196 (C.D. Cal. 2026); United States v. Griswold, No. 25-cv-03967, 2026 WL 2235374, at *6 (D. Colo. Aug. 3, 2026); United States v. Thomas, No. 26-cv-21, 2026 WL 2070437, at *7 (D. Conn. July 17, 2026); United States v. Evans, No. 25-cv-4403, 2026 WL 2267774, at *11 (D.D.C. Aug. 6, 2026); United States v. Matthews, No. 25-cv-3398, 2026 WL 2212877, at *6 (C.D. Ill. July 31, 2026); United States v. Adams, 837 F. Supp. 3d 881, 888 (E.D. Ky. 2026); United States v. Bellows, 834 F. Supp. 3d 113, 128 (D. Me. 2026); United States v. DeMarinis, No. 25-cv-3934, 2026 WL 1780586, at *6 (D. Md. June 18, 2026); United States v. Galvin, 830 F. Supp. 3d 122, 131 (D. Mass. 2026); United States v. Benson, 819 F. Supp. 3d 753, 770 (W.D. Mich. 2026), aff’d, 179 F.4th 470 (6th Cir. 2026), reh’g en banc denied, 187 F.4th 462 (6th Cir. 2026); United States v. Simon, No. 25-cv-3761, 2026 WL 2389778, at *13 (D. Minn. Aug. 17, 2026); United States v. Aguilar, No. 25-cv-00728, 2026 WL 2364502, at *6 (D. Nev. Aug. 14, 2026); United States v. Scanlan, 838 F. Supp. 3d 150, 165 (D.N.H. 2026); United States v. Caldwell, No. 26-cv-2025, 2026 WL 2186515, at *8 (D.N.J. July 29, 2026); United States v. Oliver, No. 25-cv-01193, 2026 WL 2031479, at *10 (D.N.M. July 14, 2026); United States v. Bd. of Elections of N.Y., No. 25-cv1338, 2026 WL 1999921, at *14 (N.D.N.Y. July 10, 2026); United States v. Oregon, 828 F. Supp. 3d 1092, 1109 (D. Or. 2026); United States v. Schmidt, 835 F. Supp. 3d 697, 700 (W.D. Pa. 2026); United States v. Amore, 831 F. Supp. 3d 149, 158 (D.R.I. 2026); United States v. Koski, No. 26-cv-42, 2026 WL 2032532, at *6 (E.D. Va. July 14, 2026); United States v. Hanzas, No. 25-cv-00903, 2026 WL 2754349, at *6 (D. Vt. Sep. 17, 2026); United States v. Hobbs, No. C25-6078, 2026 WL 2833713, at *6 (W.D. Wash. Sep. 22, 2026); United States v. Warner, No. 26-cv-00156, 2026 WL 2018877, at *8 (S.D. W. Va. July 13, 2026); United States v. Wisc. Elections Comm’n, 833 F. Supp. 3d 949, 955–56 (W.D. Wis. 2026).
10
After obtaining unredacted SVRLs from the states who volunteered them, the Civil Rights
Division shared that data with the Department of Homeland Security (DHS). In turn, DHS would
run that data through the Systematic Alien Verification for Entitlements (SAVE) system
administered by the U.S. Citizenship and Immigration Services (USCIS), a component of DHS.
See CRT-30–40. “SAVE is an online service for registered federal, state, territorial, tribal, and
local government agencies to verify immigration status and U.S. citizenship of applicants seeking
benefits or licenses.” SAVE, U.S. Citizenship & Immig. Servs., https://www.uscis.gov/save
[https://perma.cc/LLZ2-VHFT]. In 2025, the federal government modified SAVE to include
Social Security Administration (SSA) records for the first time. See Decl. of John B. Hill Ex. 17
at 213–14 (Hill Decl.), Pls.’ Ex. A, ECF No. 29-2 (SSA-AR-41–42); League of Women Voters,
835 F. Supp. 3d at 101; see also Press Release, U.S. Dep’t of Homeland Sec., DHS, USCIS, DOGE
Overhaul Systematic Alien Verification for Entitlements Database (Apr. 22, 2025),
https://www.dhs.gov/news/2025/04/22/dhs-uscis-doge-overhaul-systematic-alien-verificationentitlements-database [https://perma.cc/8XRG-PMSH]. 4
The information-sharing memorandum between the Civil Rights Division and DHS
acknowledged certain limitations on SAVE’s ability to verify citizenship. For instance, the
memorandum states that “SAVE may only be able to verify acquired U.S. citizens in certain
4
In June 2026, this Court found that the modified SAVE database—including the incorporation of Social Security records—violated the Privacy Act, the Social Security Act, and the APA. League of Women Voters v. DHS, 835 F. Supp. 3d 79, 100–04, 132 (D.D.C. 2026). It therefore set aside and vacated the modifications. Id. at 138. In September 2026, the Supreme Court stayed this Court’s Order, concluding that the Government was likely to prevail on its argument that 8 U.S.C. § 1373 authorized the modifications to SAVE. See DHS v. League of Women Voters, No. 26A308, 2026 WL 2879700, at *2–3 (U.S. Sep. 25, 2026) (per curiam). Dissenting, three Justices concluded that “nothing in § 1373 authorize[d] the modified SAVE system or overr[ode] the provisions of the Social Security Act and the Privacy Act” that the modified SAVE system was found to have violated. Id. at *8 (Jackson, J., dissenting). Neither Party argues that Section 1373 is implicated in this case or that the stay issued by the Supreme Court has any bearing on this case.
11
situations.” 5 CRT-32. Indeed, SSA has long recognized that its citizenship data contains certain
inaccuracies. See Hill Decl. Ex. 17 at 216 (SSA-AR-44); Hill Decl. Ex. 18 at 237 (SSA-AR-0103).
For one, SSA “did not begin to consistently maintain citizenship information until 1981,” and
therefore “does not have citizenship information for all individuals who have been issued an SSN.”
Hill Decl. Ex. 19 at 245. Moreover, because SSA merely captures an individual’s citizenship “at
the time of their interaction with SSA”—that is, when they apply for a Social Security number—
SSA does not update its records to reflect changes to an individual’s immigration status “unless
the individual is receiving Social Security payments.” Id. In other words, if an individual received
a Social Security number while a noncitizen—as the law permits, see 42 U.S.C.
§ 405(c)(2)(B)(i)(I)—and that individual later became a U.S. citizen through naturalization or
acquired citizenship, SSA records would likely misclassify her as a noncitizen. This data error is
far from abstract. A 2006 SSA audit found that 7% of the non-U.S. citizen records in SSA’s
database—totaling approximately 3.3 million people—misidentified U.S. citizens as noncitizens.
See Hill Decl. Ex. 20 at 253–54.
In addition to its agreement with SSA, the Civil Rights Division entered into a separate
arrangement with Homeland Security Investigations (HSI), another DHS component housed under
Immigration and Customs Enforcement (ICE). DOJ agreed to provide HSI with the states’ SVRL
datasets so that HSI could “conduct appropriate investigation of potential violations of federal
election law” and “enrich the SVRL datasets with OHS records to allow for vetting via the SAVE
system.” CRT-3400; see also CRT-3330 (“In response to the President’s order to identify those
5
Acquired citizenship is “citizenship conveyed to children through the naturalization of parents or, under certain circumstances, at birth to foreign-born children of U.S. citizens, provided certain conditions are met.” CRT-32 n.2.
12
who may be voting illegally . . . the Civil Rights Division . . . proposed to seek statewide voter
lists, and then to share the lists with [HSI] or another unit within DHS.”).
Finally, the Civil Rights Division reserved the option to share SVRLs outside of DOJ and
DHS. In its memoranda of understanding with some of the complying states, the Division
explained that it could disclose SVRL data to “a contractor with the Department of Justice who
needs access to the [SVRL] information in order to perform duties related to the Department’s list
maintenance verification procedures.” E.g., CRT-7 (Alaska); CRT-27 (South Carolina); CRT2042 (Texas).
The Civil Rights Division used the modified SAVE database to “verify the U.S. citizenship
and immigration status information of registrants or registered voters” listed on the SVRLs that it
received. CRT-31–32. And it agreed to alert the states of any voters listed on the SVRLs whom it
deemed to be noncitizens. See, e.g., CRT-5 (Alaska); CRT-2058 (Texas); CRT-25 (South
Carolina). The states, in turn, agreed to “clean” their SVRLs within 45 days of notification by DOJ
by removing those voters deemed ineligible by the Division. See, e.g., CRT-5 (Alaska); CRT-2058
(Texas); CRT-25 (South Carolina).
C. Procedural Background
In April 2026, the Plaintiffs—Common Cause, the Common Cause Education Fund, and
individuals Anthony Nel, Haley Smith, Linda Duckworth, and Ruth Nasrullah—filed a Complaint
challenging the Civil Rights Division’s policy on statutory and constitutional grounds. Compl.,
ECF No. 1. The Plaintiffs then moved for summary judgment on their statutory claims only, asking
this Court to set aside and vacate the policy under the APA and declare it unlawful, or,
alternatively, permanently enjoin the policy’s implementation. Pls.’ Partial Summ. J. Mot., ECF
No. 29-1. The Defendants—DOJ and the Attorney General—cross-moved for either dismissal or
13
summary judgment on all the Plaintiffs’ claims. Defs.’ Mot. Dismiss/Mot. Summ. J., ECF No. 32.
These motions are fully briefed and ripe for review. Pls.’ Combined Reply & Opp’n to Defs.’ Mot.
(Reply & Cross-Opp’n), ECF Nos. 35 & 36; Defs.’ Reply (Cross-Reply), ECF No. 43.
LEGAL STANDARD
“A motion [to dismiss] under Rule 12(b)(1) presents a threshold challenge to a court’s
[subject-matter] jurisdiction.” Ctr. for Biological Diversity v. U.S. Int’l Dev. Fin. Corp., 585
F. Supp. 3d 63, 69 (D.D.C. 2022) (cleaned up). A plaintiff bears the burden of establishing a
court’s jurisdiction. See Kokkonen v. Guardian Life Ins. Co., 511 U.S. 375, 377 (1994). In
evaluating whether a plaintiff has met that burden at the pleading stage, a court may “accept as
true all of the factual allegations contained in the complaint.” Am. Freedom L. Ctr. v. Obama, 821
F.3d 44, 49 (D.C. Cir. 2016) (quoting Swierkiewicz v. Sorema N.A., 534 U.S. 506, 508 n.1 (2002)).
“But [a] court is not limited to the allegations of the complaint and may consider such materials
outside the pleadings as it deems appropriate.” New Mexico v. Musk, 824 F. Supp. 3d 80, 91
(D.D.C. 2026) (cleaned up).
A court “shall grant summary judgment if the movant shows that there is no genuine
dispute as to any material fact and the movant is entitled to judgment as a matter of law.”
Fed. R. Civ. P. 56(a). In the context of an APA challenge, summary judgment “serves as a
mechanism for deciding, as a matter of law, whether the administrative record supports the agency
action and whether the agency action is consistent with the APA standard of review.” Int’l Swaps
& Derivatives Ass’n v. Commodity Futures Trading Comm’n, 887 F. Supp. 2d 259, 266 (D.D.C.
2012) (citing Richards v. INS, 554 F.2d 1173, 1177 & n.28 (D.C. Cir. 1977)).
DISCUSSION
The Plaintiffs contend that the Voter List Maintenance Policy is unlawful three times over
under the APA. They argue that the policy (1) exceeds DOJ’s statutory authority, 5 U.S.C.
14
§§ 706(2)(A), (C); (2) is arbitrary and capricious, id. § 706(2)(A); and (3) is contrary to law
because it violates the Privacy Act and the PRA, id. § 706(2)(A), (D). The Court agrees. In brief,
the Defendants have failed to show that any statute—including the 1960 Civil Rights Act, the
NVRA, and HAVA—authorizes DOJ to collect and share unredacted statewide voter rolls. And
the administrative record makes clear that in adopting the policy, DOJ entirely failed to consider
the risk that its use of citizenship records known to be unreliable would lead the Civil Rights
Division to demand that states remove U.S. citizens from their voter rolls. Along the way, DOJ
also violated the Privacy Act by improperly disclosing records, maintaining records without a
reasonable effort to ensure their accuracy, and unlawfully retaining records of First Amendment
protected activity without statutory authorization. And although DOJ was required to abide by the
PRA, it ignored its procedural requirements. For all these reasons, this Court must set aside the
Voter List Maintenance Policy under the APA.
A. Standing
The Court begins, as it must, with standing. To establish the “irreducible constitutional
minimum of standing,” Spokeo, Inc. v. Robins, 578 U.S. 330, 338 (2016) (cleaned up), “a plaintiff
must show (i) that he suffered an injury in fact that is concrete, particularized, and actual or
imminent; (ii) that the injury was likely caused by the defendant; and (iii) that the injury would
likely be redressed by judicial relief,” TransUnion LLC v. Ramirez, 594 U.S. 413, 423 (2021). The
Supreme Court has made clear that “plaintiffs must demonstrate standing for each claim that they
press against each defendant, and for each form of relief that they seek.” Murthy v. Missouri, 603
U.S. 43, 44 (2024) (cleaned up). But “only one plaintiff needs standing for a suit to proceed[.]”
Bost v. Ill. State Bd. of Elections, 607 U.S. 71, 76 n.3 (2026).
15
Recall that the Plaintiffs are four individual voters and two organizations, Common Cause
and the affiliated Common Cause Education Fund. At the outset, the Court dismisses Common
Cause Education Fund as a Plaintiff. The Complaint states that the two organizational Plaintiffs
“bring this action jointly.” Compl. ¶ 17. But the Plaintiffs’ briefing does not mention Common
Cause Education Fund or attempt to establish its standing. The Defendants pointed this out, see
Cross-Mot. & Opp’n at 27; Cross-Reply at 11, and the Plaintiffs did not bother to respond. So the
Court assumes that the organization is not continuing as a Plaintiff. See Hopkins v. Women’s Div.,
Gen. Bd. of Glob. Ministries, 284 F. Supp. 2d 15, 25 (D.D.C. 2003) (“It is well understood in this
Circuit that when a plaintiff files an opposition to a dispositive motion and addresses only certain
arguments raised by the defendant, a court may treat those arguments that the plaintiff failed to
address as conceded.”), aff’d, 98 F. App’x 8 (D.C. Cir. 2004).
As for the remaining Plaintiffs, they assert various theories of standing. Common Cause
contends that it has: (1) organizational standing because the Voter List Maintenance Policy caused
myriad disruptions to its organizational activities and informational injuries based on DOJ’s failure
to comply with the public notice provisions of the Privacy Act and PRA, Mot. at 12–16; and
(2) associational standing on behalf of its members, including the four individual Plaintiffs, Mot.
at 16–19. For their part, the individual Plaintiffs claim that they have suffered privacy, voting,
informational, and procedural harms because of the policy. Mot. at 16–18.
1. Organizational Standing
The Court begins with Common Cause’s organizational standing. “Like an individual, an
organization can establish standing by showing an actual or threatened injury in fact that is fairly
traceable to the defendant’s allegedly unlawful conduct and likely to be redressed by a favorable
court decision.” Ctr. for Biological Diversity v. Dep’t of the Interior (CBD II), 144 F.4th 296, 314
16
(D.C. Cir. 2025) (cleaned up). Common Cause urges two theories of organizational standing. It
first claims that the Voter List Maintenance Policy “‘directly affect[s] and interfere[s] with [its]
core business activities’ of providing services and educational resources to voters and its mission
of promoting political participation.” Mot. at 12 (quoting CBD II, 144 F.4th at 315). Second,
Common Cause contends that it has informational standing because “DOJ has deprived Common
Cause of critical information required by the public notice provisions of the Privacy Act and PRA.”
Mot. at 15. The Court considers each theory in turn, ultimately concluding that Common Cause
establishes standing on both theories.
a. Activity-Based Standing
First up is Common Cause’s activity-based standing theory. Starting with the injury-in-fact
requirement, “the first and foremost of standing’s three elements[,]” Spokeo, 578 U.S. at 338
(cleaned up), “an organization must allege a ‘concrete and demonstrable injury to the
organization’s activities’ that is ‘more than simply a setback to the organization’s abstract social
interests,’” Am. Anti-Vivisection Soc’y v. USDA, 946 F.3d 615, 618 (D.C. Cir. 2020) (quoting
Havens Realty Corp. v. Coleman, 455 U.S. 363, 379 (1982)). The D.C. Circuit has set out a twopart inquiry to determine whether an organization has suffered an injury in fact. See Indep. Mkt.
Monitor for PJM v. FERC (PJM), 162 F.4th 1167, 1172 (D.C. Cir. 2025).
First, the organization must show “an injury to its organizational interests.” Id. (citation
omitted). That injury “must be ‘concrete,’ meaning that it must be real.” Id. (quoting FDA v. All.
for Hippocratic Med., 602 U.S. 367, 381 (2024)). For instance, injuries to an organization’s
capacity to conduct “issue advocacy”—such as “urg[ing] the government” to act through lobbying
or rulemaking petitions—are generally insufficient to confer standing. CBD II, 144 F.4th at 315;
see also Ctr. for L. & Educ. v. Dep’t of Educ., 396 F.3d 1152, 1161 (D.C. Cir. 2005) (“This Court
17
has not found standing when the only ‘injury’ arises from the effect of the regulations on the
organizations’ lobbying activities (as opposed to the effect on non-lobbying activities)[.]”). And
“an organization’s diversion of resources to litigation or to investigation in anticipation of
litigation” is a “self-inflicted budgetary choice” that does not confer standing. Am. Soc. for
Prevention of Cruelty to Animals v. Feld Ent., Inc., 659 F.3d 13, 25 (D.C. Cir. 2011) (cleaned up).
But an organization suffers a cognizable injury when a challenged action “directly affect[s]
and interfere[s] with [its] core business activities.” CBD II, 144 F.4th at 315 (quoting All. for
Hippocratic Med., 602 U.S. at 395). 6 Organizations can vindicate injuries to their “non-advocacy
operations,” including, for instance, programmatic efforts to educate the public. Id.; see also Am.
Anti-Vivisection Soc’y, 946 F.3d at 619 (finding standing where an organization “ha[d] been
compelled to fill the void” left by an agency’s “failure to enact regulations” by “developing the
guidance . . . that federal standards would otherwise provide[,]” causing a “‘drain on the
organization’s resources’” (quoting Havens Realty, 455 U.S. at 379)); PETA v. USDA, 797 F.3d
1087, 1093–95 (D.C. Cir. 2015). Put differently, “an organization must allege that the defendant’s
conduct perceptibly impaired the organization’s ability to provide services” by “caus[ing] an
inhibition of the organization’s daily operations.” Food & Water Watch, Inc. v. Vilsack, 808 F.3d
905, 919 (D.C. Cir. 2015) (cleaned up).
Second, a court must consider whether the organization “has used its resources to
counteract that harm.” PJM, 162 F.4th at 1172 (cleaned up). Specifically, the organization must
6
Although the Supreme Court recently cautioned against extensions of organizational standing, see FDA v. All. for Hippocratic Med., 602 U.S. 367, 396 (2024), “courts in this district evaluating organizational standing . . . appear to agree that prior circuit precedent is consistent with the organizational-standing principles articulated in Alliance for Hippocratic Medicine,” Sierra Club v. EPA, No. 25-cv-1112, 2026 WL 686323, at *9 (D.D.C. Mar. 11, 2026) (cleaned up) (collecting cases). This Court applies pre-2024 Circuit precedent only where it is consistent with Alliance for Hippocratic Medicine.
18
“identify programmatic expenditures it must make” because of the challenged action. Id. at 1174
(emphasis added) (cleaned up). Because the claimed injury must be programmatic, “resources
spent educating the public or the organization’s members cannot establish Article III injury ‘unless
doing so subjects the organization to operational costs beyond those normally expended.’” Ctr. for
Responsible Sci. v. Gottlieb, 346 F. Supp. 3d 29, 37 (D.D.C. 2018) (quoting Food & Water Watch,
808 F.3d at 920), aff’d sub nom. Ctr. for Responsible Sci. v. Hahn, 809 F. App’x 10 (D.C. Cir.
2020).
On the first prong, Common Cause has established that the Voter List Maintenance Policy
will disrupt its existing voter education and protection efforts. 7 For instance, Elena Nunez, who
serves as Common Cause’s Senior Vice President of States, declared that the policy is impeding
the organization’s voter-registration programming, see Decl. of Elena Nunez ¶ 11 (Nunez Decl.),
Pls.’ Ex. B, ECF No. 29-3, by “chilling potential voters from registering,” Reply & Cross-Opp’n
at 3–4. And “[e]ven when Common Cause is successful at encouraging citizens to register to vote
notwithstanding those concerns, that ‘work will have to be done again because of wrongful
cancellations of voter registrations[.]’” Id. at 4 (quoting Ind. State Conf. of NAACP v. Lawson, 326
F. Supp. 3d 646, 662 (S.D. Ind. 2018), aff’d sub nom. Common Cause Ind. v. Lawson, 937 F.3d
944 (7th Cir. 2019)); see also Decl. of Gavin Geis ¶ 11 (Geis Decl.), Pls.’ Ex. C, ECF No. 29-4
(“Purging voter registrations based on unreliable information and deterring people from
7
Common Cause also urges that the Voter List Maintenance Policy is “forcing them to respond to many new inquiries about misuse of voters’ sensitive information” and “making it more difficult for Common Cause to accurately inform voters[.]” Pls.’ Combined Reply & Opp’n to Defs.’ Mot. (Reply & Cross Opp’n) at 4, ECF Nos. 35 & 36. Because the Court concludes that Common Cause has established an injury to its core organizational activities, it need not decide if these other organizational injuries also confer standing.
19
participating in our democracy . . . makes [Common Cause’s] efforts to engage voters less
effective.”); Decl. of Catherine Turcer ¶ 16 (Turcer Decl.), Pls.’ Ex. E, ECF No. 29-6 (same).
Because Common Cause has established that the challenged policy “directly affect[s] and
interfere[s] with” its “core business activit[y]” of registering voters, All. for Hippocratic Med., 602
U.S. at 395, the Court finds a cognizable injury for standing purposes. See Ctr. for Taxpayer Rts.
v. IRS, No. 26-5006, 2026 WL 2635380, at *5 (D.C. Cir. Sep. 8, 2026) (“[W]here . . . a government
action ‘directly affect[s] and interfere[s] with’ an organization’s ‘core business activities,’ and the
organization ‘diverted its resources’ to continue pursuing those activities, such concrete harm to
the organization’s activities supports standing to sue.” (quoting All. for Hippocratic Med., 602
U.S. at 395)); see also Colorado Montana Wyoming State Area Conf. of the NAACP v. Smith, 180
F.4th 1266, 1270, 1275 (10th Cir. 2026) (concluding that organizations whose “core business
activities include engaging in some form of voter outreach and education to increase voter
participation” had standing to challenge a nonprofit organization’s “door-to-door canvassing
campaign, during which volunteers asked voters if they had engaged in voter fraud” and noting
that “several other circuit courts have similarly found that organizations engaged in voter outreach
activities are injured when a defendant’s actions caused them to divert resources away to mitigate
the effects of those actions on voters”).
Common Cause also claims that “DOJ’s failure to disclose how voters’ data will be
maintained and used is making it more difficult for Common Cause to accurately inform voters[.]”
Reply & Cross-Opp’n at 4. One of Common Cause’s declarants, who oversees Common Cause’s
state operations, attests that an “important part of [Common Cause’s] work is to be a trusted
resource for coalition partners, voters, and the public about voting laws, policies, and practices[,]”
and that “[t]he information the DOJ refuses to disclose is necessary for [Common Cause] to
20
provide accurate information.” Nunez Decl. ¶ 22. Common Cause’s other declarants, several of
whom are state-level Common Cause staff, explain the same: without accurate information from
DOJ, Common Cause cannot carry on its voter-education efforts. See Geis Decl. ¶ 13 (“Unless we
obtain full and accurate information from DOJ about its intended uses of voter data, the security
of DOJ’s data practices, the persons that have access to Nebraskan voters’ data, and the process
for removing Nebraskan voters’ registrations, we face a significant risk of misinforming voters
and the broader public.”); Decl. of Julia Vaughn ¶ 16 (Vaughn Decl.), Pls.’ Ex. D, ECF No. 29-5
(same as to Indiana); Turcer Decl. ¶ 11 (“Common Cause’s job of educating the public and other
groups is made very difficult by the total lack of transparency surrounding both the use of the
federal SAVE system and the process for investigating and removing voters from the rolls.”).
Binding Circuit precedent has deemed analogous injuries sufficient. For instance, the Circuit has
found an injury when agency action “restricts the flow of information that [an organization] uses
to educate its members.” Food & Water Watch, 808 F.3d at 921 (characterizing PETA, 797 F.3d
at 1094–95).
The Defendants’ counters to Common Cause’s organizational injuries boil down to a
simple refrain: Common Cause cannot spend its way into standing by diverting its resources from
its other activities. To be sure, the Supreme Court recently explained that an organization cannot
establish standing based solely on its decision to “divert[] its resources in response to a defendant’s
actions.” All. for Hippocratic Med., 602 U.S. at 395. But Alliance for Hippocratic Medicine—and
binding Circuit precedent—recognizes that an organization has standing to challenge actions that
“directly affect[] and interfere[] with [its] core business activities”—including “impos[ing] . . .
impediment[s] to the [organization’s] advocacy businesses.” Id.; see also CBD II, 144 F.4th at 315;
21
Action All. of Senior Citizens of Greater Philadelphia v. Heckler, 789 F.2d 931, 938 (D.C. Cir.
1986).
Common Cause has established an injury to its “core business activities,” All. for
Hippocratic Med., 602 U.S. at 395, that “perceptibly impaired the organization’s ability to provide
services,” Turlock Irrigation Dist. v. FERC, 786 F.3d 18, 24 (D.C. Cir. 2015) (cleaned up). It has
demonstrated that it is engaged in voter registration and education activities, and that the Voter
List Maintenance Policy has impeded those efforts. See, e.g., Nunez Decl. ¶¶ 11, 15–16 (describing
Common Cause’s efforts to register voters and explaining that past uses of the SAVE system to
remove purportedly ineligible voters have required Common Cause to “dedicate staff time to
conduct direct outreach to members in Texas to help identify voters who may have been wrongly
flagged for removal from the voter rolls,” “create educational materials, update trainings, and
expend greater resources in order to assist and engage voters”); Geis Decl. ¶ 8 (“The collection of
voter data from Nebraska by [DOJ] has already burdened Common Cause’s work in the state and
made executing its mission more difficult.”); Vaughn Decl. ¶ 22 (“Common Cause staff in Indiana
will likely be forced to focus its attention on mitigating the risk of erroneous purging of voter
registrations, including by conducting public education campaigns[.]”); Turcer Decl. ¶ 13 (“Since
December 2025, Common Cause has spent more than 75 hours working to investigate, build
relationships, and respond to reports around understanding the current unknowns of federal
involvement in Ohio’s voter registration.”). In other words, Common Cause establishes “that the
challenged conduct perceptibly impairs its activities, as opposed to merely frustrating its
mission[.]” Gottlieb, 346 F. Supp. 3d at 38. That suffices for the first element of organizational
standing.
22
The second prong—that Common Cause has expended resources because of the injury—
is not seriously contested. Common Cause has submitted evidence that the challenged policy will
require it to dedicate staff time and other resources to “counteract the injury.” PJM, 162 F.4th
at 1174 (cleaned up); see Nunez Decl. ¶¶ 15–16 (“If DOJ is allowed to use state voter data to direct
the purging of voters’ registrations using the SAVE system, . . . [i]t will force us to redirect our
resources from our core programming and activities, in the same way that past attempts to use the
SAVE system and conduct voter purges have forced Common Cause to expend resources in order
to protect the right to vote. For example, we have previously had to dedicate staff time to conduct
direct outreach to members in Texas to help identify voters who may have been wrongly flagged
for removal from the voter rolls based on faulty data from the SAVE system.”); Geis Decl. ¶¶ 8–
9, 11–12 (attesting that “[s]ince Fall 2025,” Common Cause’s staff in Nebraska has “spent roughly
20 hours contacting state and local election officials in an effort to understand what data they are
sharing with DOJ and what agreements they have with the federal government regarding the datasharing,” and that “[u]nless DOJ’s actions are stopped,” Common Cause in Nebraska will have to
undertake poll monitoring, training, and voter education programming that “would require the
diversion of [] existing resources”); Vaughn Decl. ¶¶ 15, 18 (“Because of concerns about privacy
and DOJ gathering of sensitive voter data, Common Cause staff in Indiana has already had to
spend time and resources to respond.”). So Common Cause has established an organizational
injury that supports its standing.
With injury in fact established, only causation and redressability remain. The Parties spill
little ink on these elements of standing. The Plaintiffs argue that Common Cause’s injuries would
not have occurred but for the Voter List Maintenance Policy and would therefore be redressed if
the Court vacates that policy. Mot. at 19. The Court agrees. Because Common Cause’s injuries
23
stem from the direct effects of the Voter List Maintenance Policy and DOJ’s failures to comply
with statutory transparency requirements, they are “fairly traceable to the challenged conduct of
the defendant” and “likely to be redressed by a favorable judicial decision.” Spokeo, 578 U.S.
at 338.
Accordingly, the Court finds that Common Cause has organizational standing to challenge
the Voter List Maintenance Policy because of injuries to its core business activities.
b. Informational Standing
Turning to Common Cause’s informational standing theory, the D.C. Circuit has
“recognized that a denial of access to information can, in certain circumstances, work an ‘injury
in fact’ for standing purposes[.]” Elec. Priv. Info. Ctr. v. Presidential Advisory Comm’n on
Election Integrity, 878 F.3d 371, 378 (D.C. Cir. 2017) (cleaned up); see also FEC v. Akins, 524
U.S. 11, 21 (1998) (finding standing based on an “inability to obtain information”). “To prove an
informational injury, a plaintiff must show that (1) it has been deprived of information that, on its
interpretation, a statute requires the government or a third party to disclose to it, and (2) it suffers,
by being denied access to that information, the type of harm Congress sought to prevent by
requiring disclosure.” Ctr. for Biological Diversity v. U.S. Int’l Dev. Fin. Corp. (CBD I), 77 F.4th
679, 685 (D.C. Cir. 2023) (cleaned up). Importantly, the first prong of the informational standing
analysis requires only that a plaintiff “espouse a view of the law under which the defendant (or an
entity it regulates) is obligated to disclose certain information that the plaintiff has a right to
obtain.” Feld Ent., 659 F.3d at 23. For standing purposes, the Court need not conclude that a
plaintiff’s reading is “necessarily [] the correct view of the law.” United to Protect Democracy,
288 F. Supp. 3d at 106 n.2.
24
Here, the first requirement is straightforwardly satisfied. Common Cause contends that it
has suffered informational injury because “DOJ has deprived [it] of critical information required
by the public notice provisions of the Privacy Act and PRA.” Mot. at 15. Specifically, Common
Cause asserts that the Defendants “fail[ed] to publish a revised SORN,” as required by the Privacy
Act. Reply & Cross-Opp’n at 9. And it claims that the Defendants violated the PRA by “refusing
to publish information required by the PRA[,] depriving Common Cause of the reasons voter data
is being collected[,] the way(s) such voter data is to be used[,] and an estimate of the burden of the
collection[.]” Id. at 10 (citations omitted).
The second element is also met. Common Cause claims that DOJ’s failure to provide the
relevant disclosures deprived it of necessary information about the Voter List Maintenance Policy
and DOJ’s data-sharing practices, thus impairing its ability to conduct its voter-education and other
activities. See, e.g., Nunez Decl. ¶¶ 18–19, 22; Geis Decl. ¶ 9; Vaughn Decl. ¶¶ 16–18. Without
question, those harms are of the type that the Privacy Act and the PRA were intended to prevent.
The Privacy Act, for starters, expressly requires agencies to provide notice of a “new use
or intended use of the information” contained in a system of records, so that “interested persons”
may submit “written data, views, or arguments to the agency[.]” 5 U.S.C. § 552a(e)(11). While the
Act protects the information of “individual[s]”—defined as U.S. citizens and permanent residents,
see id. § 552a(a)(2)—its comment provisions apply more broadly to “interested persons,” id.
§ 552a(e)(11), a term that is separately defined to include “organization[s],” id. § 551(2). Thus,
even organizations not covered by the Privacy Act’s substantive protections may invoke its public
comment provisions. Indeed, the legislative history of the Act makes clear that it seeks to preserve
Americans’ privacy in part by allowing public scrutiny of federal agencies’ data-collection efforts.
See S. Rep. No. 93-1183 at 71 (1974) (“While the Committee intends in this legislation to
25
implement the guarantees of individual privacy, it also intends to make available to the press and
public all possible information concerning the operations of the Federal Government in order to
prevent secret data banks and unauthorized investigative programs on Americans.”). Thus,
Congress designed the Privacy Act’s notice provisions to prevent unauthorized uses of Americans’
personal information by, in part, informing the public of covered collections of information before
they take place.
Meanwhile, Congress enacted the PRA to “improve the quality and use of Federal
information to strengthen decisionmaking, accountability, and openness in Government and
society,” 44 U.S.C. § 3501(4), and to “improve the responsibility and accountability” of federal
agencies “to Congress and the public for implementing” the PRA’s requirements, id. § 3501(11).
“These statements evince Congress’s clear intent that information concerning the government’s
data collection efforts be shared with the public so that the public might hold the government to
account.” United to Protect Democracy, 288 F. Supp. 3d at 107.
The Defendants resist Common Cause’s informational standing, asking this Court to add a
third element to the two set out by the D.C. Circuit. They argue that “a plaintiff must identify a
particularized injury—as contrasted with a ‘generalized grievance’ that is ‘undifferentiated and
common to all members of the public.’” Cross-Mot. & Opp’n at 21 (quoting United States v.
Richardson, 418 U.S. 166, 176–77 (1974)). The Court declines to invent a new requirement out of
whole cloth. The D.C. Circuit has repeatedly found informational standing when agencies have
failed to make statutorily required publications in the Federal Register without requiring a showing
of a particularized injury. See CBD I, 77 F.4th at 686–87 (finding informational standing to
challenge an agency’s failure to publish notice of a meeting in the Federal Register without regard
for the Sunshine Act’s transparency requirements); Friends of Animals v. Jewell, 824 F.3d 1033,
26
1041–42 (D.C. Cir. 2016) (finding informational standing when an agency failed to comply with
the Endangered Species Act’s requirement that it disclose information received in connection with
a permit application, which allegedly hampered a plaintiff nonprofit organization’s ability to
“meaningfully participate in the Act’s permitting process, as well as engage in related advocacy
efforts”); Ethyl Corp. v. EPA, 306 F.3d 1144, 1146–48 (D.C. Cir. 2002) (finding informational
standing arising from an agency’s adoption of a procedural “mechanism [that] . . . deprive[d] [the
plaintiff] of the opportunity to observe the rulemaking process and thus gain information useful in
its efforts [] to develop and improve its products”). The Defendants’ cramped view of
informational standing cannot be squared with the D.C. Circuit precedent that binds this Court.
The Defendants rely primarily on Prisology, Inc. v. Fed. Bureau of Prisons, 852 F.3d 1114
(D.C. Cir. 2017), which does not advance their cause. There, the plaintiff claimed standing on the
theory that a federal agency had not complied with 5 U.S.C. § 552(a)(2), a provision of the
Freedom of Information Act requiring federal agencies to make certain “records electronically
available to the public.” Id. at 1115. The D.C. Circuit concluded that the plaintiff lacked standing
because their “complaint contain[ed] no allegation of injury, general or otherwise,” and even if an
injury could be inferred, it would be impermissibly generalized because the plaintiff had not even
requested the records that the defendant agency allegedly failed to make available. Id. at 1116–17.
Not so here. As described above, Common Cause has suffered specific harms from DOJ’s failure
to make certain disclosures. And Common Cause has shown that its harms are of the kind that
Congress sought to prevent. That is all that informational standing requires.
2. Associational and Individual Standing
In addition to its own organizational standing, Common Cause claims associational
standing on behalf of its members, including the four individual Plaintiffs. Mot. at 16. To establish
27
associational standing, an organization “must show that (1) at least one of its members has standing
to sue in her or his own right, (2) the interests it seeks to protect are germane to its purpose, and
(3) neither the claim asserted nor the relief requested requires the participation of an individual
member in the lawsuit.” Institutional S’holder Servs., Inc. v. SEC, 142 F.4th 757, 764 (D.C. Cir.
2025) (cleaned up). Here, the second and third prongs appear to be uncontested. See Cross-Mot.
& Opp’n at 26–27 (arguing that Common Cause has no associational standing because it failed to
identify individual members with standing). And the Court is satisfied that both are met. Common
Cause seeks to protect its members’ privacy, voting, informational, and procedural interests, which
are plainly related to Common Cause’s organizational purposes of “creating an open, honest, and
accountable government” and “empower[ing] people to make their voices heard in the political
process.” Nunez Decl. ¶ 8. Moreover, “the relief [Common Cause] seeks is invalidation of agency
action, rather than any remedy particularized to individual members.” Nat’l Lifeline Ass’n v. FCC,
983 F.3d 498, 508 (D.C. Cir. 2020) (cleaned up). So Common Cause’s associational standing rises
or falls with the individual Plaintiffs’ standing. See Mot. at 16 (noting that Common Cause’s
associational standing and the individual Plaintiffs’ standing are “based on the same injuries”).
Again, “[t]o establish Article III standing, a plaintiff must show (1) injury in fact that is
concrete and particularized and actual or imminent rather than conjectural or hypothetical,
(2) causation fairly traceable to the defendant’s challenged action and (3) redressability by a
favorable decision that is likely as opposed to merely speculative.” Am. Whitewater v. FERC, 125
F.4th 1139, 1150 (D.C. Cir. 2025) (citing Lujan v. Defs. of Wildlife, 504 U.S. 555, 560–61 (1992)).
“[A]n injury is ‘concrete’ if it is similar to a type of harm cognizable at common law.” Pileggi v.
Washington Newspaper Publ’g Co., 146 F.4th 1219, 1226 (D.C. Cir. 2025) (citing TransUnion,
594 U.S. at 424). However, “Article III does not require ‘an exact duplicate in American
28
[common-law] history and tradition’”—“an injury is concrete if it has ‘a close historical or
common-law analogue[.]’” Id. (quoting TransUnion, 594 U.S. at 424–25). While concreteness is
ultimately determined by analogy to common law, statutory causes of action also bear on the
standing inquiry. By providing a private cause of action, Congress can “identif[y] a modern
relative of a harm with long common law roots,” Gadelhak v. AT&T Servs., Inc., 950 F.3d 458,
462 (7th Cir. 2020) (Barrett, J.), and “elevate to the status of legally cognizable injuries [those]
concrete, de facto injuries that were previously inadequate in law,” TransUnion, 594 U.S. at 425–
26 (cleaned up). Thus, a plaintiff may meet the injury-in-fact requirement by invoking a “a private
right of action to remedy a harm that is a lesser form of a harm recognized at common law.”
Pileggi, 146 F.4th at 1227.
The individual Plaintiffs assert harms to their “privacy, voting, informational, and
procedural rights.” Mot. at 16. The Court agrees that these harms establish standing.
a. Privacy Injuries
The Plaintiffs first argue that “DOJ’s wrongful use and disclosure” of the “protected voter
registration data” of the individual Plaintiffs and Common Cause’s members caused privacy
injuries. 8 Mot. at 16. They are correct.
Each of the individual Plaintiffs (and other Common Cause members) provided personal
information to state officials to register to vote, such as their name, date of birth, and Social
Security number or the last four digits thereof. Decl. of Anthony Nel ¶¶ 9–10 (Nel Decl.), Pls.’
Ex. G, ECF No. 29-8; Decl. of Linda Duckworth ¶¶ 6–8 (Duckworth Decl.), Pls.’ Ex. H, ECF
8
Because DOJ’s collection, disclosure, and dissemination of the individual Plaintiffs’ voterregistration information establishes privacy-related standing, the Court need not evaluate the Plaintiffs’ alternative theory that DOJ’s policy “exposes the [individual] Plaintiffs and other Common Cause members to the risk that their sensitive data will be misused or stolen.” Mot. at 17.
29
No. 29-9; Decl. of Ruth Nasrullah ¶¶ 6–8 (R. Nasrullah Decl.), Pls.’ Ex. I, ECF No. 29-10; Decl.
of Haley Smith ¶¶ 7–11 (Smith Decl.), Pls.’ Ex. J, ECF No. 29-11; Decl. of Alex Doe ¶¶ 8–9 (A.
Doe. Decl.), Pls.’ Ex. K, ECF No. 29-12; Decl. of Bailey Doe ¶¶ 9–10 (B. Doe Decl.), Pls.’ Ex. L,
ECF No. 29-13; Decl. of Claudio Mosse ¶¶ 10–12 (Mosse Decl.), Pls.’ Ex. M, ECF No. 29-14;
Decl. of Mohammed Nasrullah ¶¶ 10–12 (M. Nasrullah Decl.), Pls.’ Ex. N, ECF No. 29-15. And
at least one Plaintiff provided her party affiliation to state officials. Duckworth Decl. ¶ 8. The
individual Plaintiffs argue that DOJ, through the Voter List Maintenance Policy, obtained their
data from their home states and disseminated it to other federal agencies and private contractors.
Mot. at 17. They contend that these harms to their privacy rights are “sufficiently ‘concrete’
because they are a ‘“close . . . analogue”’ to the harms vindicated by the ‘common law tort of
intrusion upon seclusion.’” Id. at 16 (quoting Am. Fed’n of State, Cnty. & Mun. Emps. (AFSCME).
v. SSA, 172 F.4th 361, 368 (4th Cir. 2026) (en banc)).
“The common law has long recognized actions at law against defendants who invaded the
private solitude of another by committing the tort of intrusion upon seclusion.” Gadelhak, 950
F.3d at 462 (cleaned up)). And the Privacy Act provides a statutory implementation of many of
those ancient common-law principles. The Privacy Act “directs agencies to establish safeguards
to protect individuals against the disclosure of confidential records[.]” FAA v. Cooper, 566 U.S.
284, 294 (2012). As the Supreme Court has recognized, the “[Privacy] Act serves interests similar
to those protected by defamation and privacy torts,” so “there is good reason to infer that Congress
relied upon those torts in drafting the Act.” Id. Accordingly, “[v]arious courts across the country
and nearly ‘every court in this circuit’ have held that the unauthorized disclosure of . . . ‘private
information’ by government employees is the exact type of injury protected by the tort of intrusion
upon seclusion[.]” League of Women Voters, 835 F. Supp. 3d at 109 (first citing AFSCME, 172
30
F.4th at 369; and then citing AFL-CIO v. DOL (AFL-CIO II), 836 F. Supp. 3d 137, 157–58 (D.D.C.
2026)); see also AFL-CIO II, 836 F. Supp. 3d at 157–58 (collecting cases holding that a federal
agency’s unlawful collection and examination of individuals’ sensitive data bore a sufficiently
close relationship to the tort of intrusion upon seclusion to qualify as a concrete injury for standing
purposes).
The types of data disclosed here—dates of birth, addresses, partial or full Social Security
numbers, and party affiliations—assuredly qualify as sensitive information over which the
Plaintiffs had a reasonable expectation of privacy. See All. for Retired Ams. v. Bessent, 770
F. Supp. 3d 79, 89, 100–03 (D.D.C. 2025) (finding standing from the intra-agency disclosure of
“sensitive information,” which included names, Social Security numbers, and dates and location
of birth); League of Women Voters, 835 F. Supp. 3d at 108–10 (finding standing from the
disclosure of Social Security numbers and citizenship status to SAVE users, including states).
After all, the Plaintiffs (and other Common Cause members) uniformly aver that they shared their
information with state officials only to register to vote with the expectation that it would be kept
private. See, e.g., Nel Decl. ¶ 36; Duckworth Decl. ¶¶ 9–10; R. Nasrullah Decl. ¶¶ 9–10; Smith
Decl. ¶¶ 10–13; A. Doe Decl. ¶ 20; B. Doe Decl. ¶ 39; Mosse Decl. ¶¶ 11–14; M. Nasrullah Decl.
¶¶ 11–14.
In urging otherwise, the Defendants contend that the Plaintiffs’ harms are insufficiently
analogous to the common-law tort of intrusion upon seclusion. They claim that proving a concrete
injury by analogy to that tort requires a showing of “targeted snooping” by the tortfeasor. CrossMot. & Opp’n at 15–17. Like other courts that have considered that argument, the Court is
31
unpersuaded. See, e.g., AFSCME, 172 F.4th at 371. 9 For one, it is entirely unclear that the tort of
intrusion upon seclusion requires a showing of targeted snooping. Such a requirement appears
nowhere in the description of the tort in the Second Restatement of Torts, for instance. See id.
(citing Restatement (Second) of Torts § 652B). But even more to the point, the Plaintiffs’ burden
is not to show that their injury amounts to a tortious intrusion upon seclusion. Rather, the Plaintiffs
need only show that they suffered the “same kind of harm that common law courts recognize[.]”
Gadelhak, 950 F.3d at 463 (emphasis in original); see also TransUnion, 594 U.S. at 424
(explaining that concreteness requires “a close historical or common-law analogue for [the]
asserted injury” but “does not require an exact duplicate in American history and tradition”). And
“[c]ourts have long held that the ‘unlawful’ ‘collection, storage, and use’ of private data ‘qualifies
as an invasion of a ‘private domain, much like an act of trespass would be’ and ‘is closely
analogous to historical claims for invasion of privacy.’” League of Women Voters, 835 F. Supp. 3d
at 110 (quoting Fox v. Dakkota Integrated Sys., LLC, 980 F.3d 1146, 1155 (7th Cir. 2020)); see
also Fox, 980 F.3d at 1155 (collecting cases).
In sum, the collection, examination, and disclosure of the individual Plaintiffs’ voterregistration data constitute a concrete injury to those individuals’ privacy rights. Moreover, that
injury was plainly caused by the Voter List Maintenance Policy, and would be redressed by its
vacatur. Therefore, the individual Plaintiffs’ privacy injuries confer associational and individual
standing.
9
The Parties quibble about the Fourth Circuit’s abrogated opinion in Am. Fed’n of Teachers v. Bessent, 152 F.4th 162, 172 (4th Cir. 2025), abrogated by 172 F.4th 361 (4th Cir. 2026). As the Court has previously explained, “Bessent’s rationale is both unconvincing and inapposite[.]” League of Women Voters, 835 F. Supp. 3d at 109.
32
b. Voting Injuries
Next, the individual Plaintiffs claim voting-related injuries stemming from the Voter List
Maintenance Policy. See Mot. at 17–18. They contend that DOJ’s use of the modified SAVE
database to “maintain” state voter rolls causes the wrongful removal of eligible voters because of
SAVE’s inaccurate citizenship data. And crucially, some states have entered into memoranda of
agreement with DOJ obligating them to remove voters who are identified by SAVE as ineligible.
See CRT-2058. The burden of disenfranchisement, according to the Plaintiffs, falls particularly on
naturalized and derived citizens. The Court agrees that these injuries support standing.
As this Court explained in a similar case, “voting is ‘a process of the most fundamental
significance under our constitutional structure.’” League of Women Voters, 835 F. Supp. 3d at 112
(quoting Bost, 607 U.S. at 77) (internal quotation omitted). Therefore, “‘[t]here is no doubt that
the right to vote is a legally protected interest,’ cognizable under Article III of the Constitution.”
League of Women Voters, 835 F. Supp. 3d at 112 (quoting Am. Encore v. Fontes, 152 F.4th 1097,
1111 (9th Cir. 2025)). Moreover, disenfranchisement need not be consummated to be cognizable—
“if a person needs to prove their citizenship to remain registered to vote or if they are removed
from the registration rolls, they suffer a cognizable injury.” League of Women Voters v. DHS,
No. 26-5243, 2026 WL 2643439, at *4 (D.C. Cir. Sep. 4, 2026) (per curiam) (citing Meese v.
Keene, 481 U.S. 465, 475 (1987)); see also Arcia v. Fla. Sec’y of State, 772 F.3d 1335, 1341 (11th
Cir. 2014) (finding standing for plaintiffs who were “wrongly identified as non-citizens[] [e]ven
though they were ultimately not prevented from voting”). The Supreme Court recently made the
same point. In finding that a plaintiff misclassified as a noncitizen by the modified SAVE database
had standing to challenge SAVE modifications, the Court explained that “[h]ad the modified
SAVE program not been set aside, [the plaintiff] likely would have been required to provide
33
additional proof of citizenship” and “[s]uch a ‘need to take . . . affirmative steps to avoid risk of
harm . . . constitutes a cognizable injury’ supporting standing[.]” DHS v. League of Women Voters,
No. 26A308, 2026 WL 2879700, at *2 (U.S. Sep. 25, 2026) (per curiam) (quoting Meese, 418 U.S.
at 475).
Here, at least one named Plaintiff and at least one Common Cause member have already
suffered this type of injury. Anthony Nel is a derived citizen whose Texas voter registration was
cancelled after the modified SAVE system failed to confirm his citizenship. Nel Decl. ¶¶ 14–28.
The same happened to Common Cause member Bailey Doe, a naturalized citizen and Texas voter.
B. Doe Decl. ¶¶ 11–31. And other Common Cause members have been required to take steps to
provide additional proof of citizenship to prevent cancellation of their voter registrations. See A.
Doe Decl. ¶¶ 11–14, Ex. 1.
These individuals also face an imminent risk of future injury because their citizenship
status—along with that of other voters—is likely still outdated in the SAVE database, making
them subject to future removal by their states under DOJ’s Voter List Maintenance Policy. See Nel
Decl. ¶¶ 42–45; A. Doe Decl. ¶ 29. The Defendants protest the existence of any future injuries,
arguing that they are too speculative to be imminent. See Cross-Mot. & Opp’n at 18–19. But the
Plaintiffs do not bear the burden of “know[ing] in advance that [their] name[s] will be dropped
from the rolls[.]” Sandusky Cnty. Democratic Party v. Blackwell, 387 F.3d 565, 574 (6th Cir.
2004). And “past wrongs may serve as evidence” of “a real and immediate threat of repeated
injury[.]” Jibril v. Mayorkas, 20 F.4th 804, 814 (D.C. Cir. 2021) (cleaned up) (quoting N.B. ex rel.
Peacock v. District of Columbia, 682 F.3d 77, 84 (D.C. Cir. 2012)). Here, at least one individual
Plaintiff and multiple Common Cause members are registered voters who are likely classified as
noncitizens in Social Security—and therefore modified SAVE—records. See Nel Decl. ¶¶ 4–5, 43
34
(attesting that the Plaintiff Anthony Nel was a noncitizen when he was issued a Social Security
number but has since acquired citizenship and registered to vote in Texas; explaining that the
Plaintiff Nel was informed by an SSA employee in December 2025 that he was listed as a
noncitizen in SSA’s records); CRT-32 & n.2 (“SAVE may only be able to verify acquired U.S.
citizens in certain situations.”); see also M. Nasrullah Decl. ¶¶ 7–8, 28 (Common Cause member
and registered Texas voter attesting to having become a naturalized citizen after receiving a Social
Security number). And these voters reside in Texas—which, following the Voter List Maintenance
Policy, has agreed to “clean its [SVRL] by removing ineligible voters” within 45 days of “receiving
[] notice from the Justice Department of any issues, insufficiencies, inadequacies, deficiencies,
anomalies, or concerns[.]” CRT-2058. Because the administrative record shows both (1) that
DOJ’s Voter List Maintenance Policy relies on SSA citizenship data that misidentifies certain
classes of U.S. citizens as noncitizens, and (2) that complying states have agreed to remove voters
based on DOJ’s eligibility determinations, the risk of future removal is far from speculative.
The Defendants also downplay “the risks of misidentification through SAVE,” claiming
that the error rate is so low that the Court should ignore it. Cross-Mot. & Opp’n at 18. As the Court
has previously explained, that argument is both factually inaccurate and legally irrelevant. First, a
significant number of U.S. citizens are misclassified as noncitizens by SSA records. In 2006, an
SSA audit found that seven percent of people classified as noncitizens by SSA were in fact
citizens—totaling approximately 3.3 million people. Hill Decl. Ex. 20 at 253–54. Because
modified SAVE relies on those SSA records, those misclassifications lead to misidentifications of
lawful voters as wrongfully registered. “[A]n independent investigation in Travis County, Texas,”
for instance, “found that twenty-five percent of the non-citizen matches in that county were
individuals who had already proven citizenship in the United States.” League of Women Voters,
35
835 F. Supp. 3d at 115 (cleaned up). Second, the number of voters who face the risk of error has
no bearing on the standing inquiry. Instead, an organizational Plaintiff need only show that “one
of its members” has standing. Institutional S’holder Servs., 142 F.4th at 764 (cleaned up). And
here, the Plaintiffs have identified individual Plaintiffs and Common Cause members who face
specific risks of harm. In sum, the Plaintiffs’ voter injuries confer standing on this record.
Moving past injury, the Defendants contend that the Plaintiffs cannot show the causation
and redressability required to sustain standing because “[s]tates are ultimately responsible for
removing voters from the state voter registration lists, not DOJ[.]” Cross-Mot. & Opp’n at 19. But
this argument, too, misses the mark. “Article III requires no more than de facto causality[.]” Dep’t
of Com. v. New York, 588 U.S. 752, 768 (2019) (cleaned up). As the D.C. Circuit recently explained
in a related case, “[a]n injury remains fairly traceable to federal action when third parties ‘will
likely react’ to it ‘in predictable ways.’” League of Women Voters, 2026 WL 2643439, at *5
(quoting Diamond Alt. Energy, LLC v. EPA, 606 U.S. 100, 112 (2025)); see also League of Women
Voters, 2026 WL 2879700, at *2 (Supreme Court finding standing when a plaintiff “likely would
have been required to provide additional proof of citizenship” due to errors in modified SAVE).
And here, the “states’ response to an adverse SAVE result is not conjectural—after all, the states
wanting to use modified SAVE to conduct citizenship checks do so because they expect its result
to inform their eligibility determinations.” League of Women Voters, 2026 WL 2643439, at *5.
Indeed, DOJ’s Office of Legal Counsel (OLC) has stated that under the Voter List Maintenance
Policy, database results indicating noncitizenship may be used to “strike the [individual’s] name
from the voter registration list for future elections, refer the [individual] for prosecution, or both.”
CRT-3334. And the memoranda of understanding between DOJ and cooperating states likewise
stipulate that the state shall “remov[e] ineligible voters” “within [45] days of receiving [] notice
36
from the Justice Department” that ineligible voters are present on voter lists. E.g., CRT-5 (Alaska
MOU); CRT-2058 (Texas MOU). “When third party behavior is predictable, commonsense
inferences may be drawn.” Diamond Alt. Energy, 606 U.S. at 116.
Here, the record makes clear that erroneous responses generated because of DOJ’s Voter
List Maintenance Policy “sets the process in motion” that ultimately burdens the Plaintiffs’
fundamental voting rights. League of Women Voters, 2026 WL 2643439, at *5. Therefore, the
“risk” of disenfranchisement “would be reduced to some extent if [the Plaintiffs] received the relief
they seek”—vacatur of the challenged policy. Massachusetts v. EPA, 549 U.S. 497, 526 (2007);
see also Alstom Transp., Inc. v. Fed. R.R. Admin., No. 25-5456, 2026 WL 2881203, at *2 (D.C.
Cir. Sep. 25, 2026) (explaining that in a case where “causation and redressability depend on [thirdparty] behavior,” a causal chain is sufficiently “predictable” when there is “a substantial likelihood
that the plaintiff’s injury is traceable to the agency action under review and would be redressed by
a favorable decision setting it aside” (cleaned up)).
All in all, the Plaintiffs have demonstrated that their voting-related injuries meet each of
the requirements of Article III standing.
c. Procedural Injuries
The Plaintiffs next assert procedural standing for certain of their claims based on DOJ’s
alleged violations of procedural requirements imposed by the Privacy Act and the PRA. Mot.
at 18–19. In general, “a bare procedural violation, divorced from any concrete harm” cannot
“satisfy the injury-in-fact requirement of Article III.” Spokeo, 578 U.S. at 341; see also Summers
v. Earth Island Inst., 555 U.S. 488, 496 (2009) (noting that “a procedural right in vacuo . . . is
insufficient to create Article III standing”). Instead, a plaintiff must invoke a procedural right with
some relationship to “protect[ing]” a “concrete interest[.]” Ctr. for L. & Educ., 396 F.3d at 1157.
37
Here, the Plaintiffs have identified multiple “concrete interest[s] that [are] affected by the
deprivation” of their procedural rights conferred by statute. Summers, 555 U.S. at 496. The
Plaintiffs assert concrete injuries based on the misuse of their information, including privacy
injuries. And the procedural requirements of the Privacy Act and the PRA—which are designed in
part to protect privacy rights—are related to those concrete injuries. For instance, the Privacy Act
is designed to impose “adequate safeguards . . . to prevent misuse of [] information.” Privacy Act
of 1974 § 2(b)(1), (4), 88 Stat. at 1896. Relatedly, a goal of the PRA is “to ensure that the
collection, maintenance, use and dissemination of information by or for the Federal Government
is consistent with applicable laws, including law . . . relating to privacy and confidentiality,” such
as the Privacy Act. 44 U.S.C. § 3501(8), (8)(A). And in addition to concrete injury, the Plaintiffs
have shown that the Voter List Maintenance Policy caused their procedural injury and that its
vacatur would redress their procedural injury. Procedural standing requires nothing more.
3. Article II
Article II rounds out the standing discussion. The Defendants ask this Court to rely on
Article II to disregard the Plaintiffs’ standing, arguing that this suit impermissibly “attempt[s] to
control the Executive’s exercise of investigatory and enforcement discretion.” Cross-Mot. &
Opp’n at 10. Specifically, they contend that DOJ is merely enforcing the NVRA and HAVA
through the Voter List Maintenance Policy, making that policy an “investigatory choice[]” that the
Plaintiffs lack standing to challenge. Id. at 12. To be sure, “[u]nder Article II, the Executive Branch
possesses authority to decide how to prioritize and how aggressively to pursue legal actions against
defendants who violate the law.” United States v. Texas, 599 U.S. 670, 678 (2023) (cleaned up).
And it is equally true that the NVRA and HAVA vest DOJ with the authority to commence civil
actions against states to ensure compliance with those statutes. See 52 U.S.C. § 20510(a) (“The
38
Attorney General may bring a civil action in an appropriate district court for such declaratory or
injunctive relief as is necessary to carry out [the NVRA].”); id. § 21111 (“The Attorney General
may bring a civil action against any State or jurisdiction in an appropriate United States District
Court for such declaratory and injunctive relief . . . as may be necessary to carry out the uniform
and nondiscriminatory election technology and administration requirements under [HAVA].”).
But those principles do not support the Defendants’ sweeping arguments.
The Plaintiffs do not challenge DOJ’s investigatory or enforcement choices in specific
matters. Rather, they challenge the legality of the Voter List Maintenance Policy, a policy that they
say is without statutory authority. Article II does not bar federal courts from adjudicating such
challenges, and the Defendants’ authorities do not say otherwise. The Defendants rely heavily on
United States v. Texas, which holds that “federal courts are generally not the proper forum for
resolving claims that the Executive Branch should make more arrests or bring more prosecutions.”
599 U.S. at 680 (emphasis added). But as the Texas Court explained, that case “raise[d] only the
narrow Article III standing question of whether the Federal Judiciary may in effect order the
Executive Branch to take enforcement actions against violators of federal law[.]” Id. at 684–85
(emphasis added). The Defendants’ other authorities say more of the same. See, e.g., Heckler v.
Chaney, 470 U.S. 821, 832 (1985) (“[W]hen an agency does act to enforce . . . [t]he action at least
can be reviewed to determine whether the agency exceeded its statutory powers.”); Am. First Legal
Found. v. Greer, 153 F.4th 1311, 1315–16 (D.C. Cir. 2025) (rejecting a claim to standing that
relied on an agency’s failure to conduct an investigation).
As these authorities uniformly recognize, there is a world of difference between a suit
seeking to require the Executive Branch to conduct certain investigations or prosecutions and a
suit seeking to vacate an investigatory or enforcement policy that allegedly exceeds the federal
39
government’s statutory authority and is otherwise unlawful. While federal courts may not order
the Executive Branch to take enforcement action or dictate its choice among lawful enforcement
policies, it is fully within their province to adjudicate claims of unlawful enforcement policies.
The Defendants may not hide behind Article II to avoid judicial review of an allegedly unlawful
policy. Therefore, assuming that the Plaintiffs are correct on the merits, as the Court must when
assessing standing, the Defendants’ Article II objections do not defeat the Plaintiffs’ standing. 10
* * *
In sum, the Plaintiffs have established organizational, associational, and individual
standing under Article III. And Article II does not change that result.
B. Final Agency Action
Turning to the next threshold argument, the Defendants argue that the Plaintiffs do not
challenge a discrete and final agency action. The Court disagrees.
Section 704 of the APA provides that “[a]gency action made reviewable by statute and
final agency action for which there is no other adequate remedy in a court are subject to judicial
review.” 5 U.S.C. § 704. As the text of Section 704 makes plain, “[t]he APA authorizes courts to
review only ‘final agency action[s].’” Centro de Trabajadores Unidos v. Bessent, 167 F.4th 1218,
1235 (D.C. Cir. 2026) (quoting 5 U.S.C. § 704). The APA, in turn, defines “agency action” to
“include[] the whole or a part of an agency rule, order, license, sanction, relief, or the equivalent
or denial thereof, or failure to act[.]” 5 U.S.C. § 551(13). “This list is . . . ‘meant to cover
comprehensively every manner in which an agency may exercise its power.’” Fund for Animals,
10
The Defendants also muster the related argument that the Plaintiffs lack standing to challenge the Voter List Maintenance Policy because states, not the Plaintiffs, are the direct targets of DOJ’s enforcement actions under the policy. See Cross-Mot. & Opp’n at 12. But that argument, too, relies on the Defendants’ characterization of the policy as within DOJ’s enforcement discretion—a conclusion that this Court rejects for the reasons set out above.
40
Inc. v. U.S. Bureau of Land Mgmt., 460 F.3d 13, 19 (D.C. Cir. 2006) (quoting Whitman v. Am.
Trucking Ass’n’s, 531 U.S. 457, 478 (2001)). Moreover, an agency action need not be written to
be reviewable. See, e.g., AFL-CIO v. DOL (AFL-CIO I), 778 F. Supp. 3d 56, 77 (D.D.C. 2025);
Venetian Casino Resort, L.L.C. v. EEOC, 530 F.3d 925, 929–30 (D.C. Cir. 2008); Ctr. for
Taxpayer Rts., 2026 WL 2635380, at *7; cf. Bhd. of Locomotive Eng’rs & Trainmen v. Fed. R.R.
Admin., 972 F.3d 83, 100 (D.C. Cir. 2020) (explaining in the context of another statute authorizing
judicial review of “final agency action” that “the absence of a written memorialization by the
agency does not defeat finality”).
The Defendants mount two attacks under Section 704. First, they argue that the Plaintiffs
have failed to identify agency action that is reviewable under the APA. Second, they urge that any
agency action is not “final.” The Court considers each contention in turn.
1. Discrete Agency Action
The Defendants first claim that the Plaintiffs do not challenge a discrete agency action. See
Cross-Mot. & Opp’n at 28–31. They point out that the Voter List Maintenance Policy entails
various “constituent actions,” id. at 28, and they describe the Plaintiffs’ challenge as a “broad
programmatic attack[],” Norton v. S. Utah Wilderness All., 542 U.S. 55, 64 (2004), rather than a
challenge to a “particular ‘agency action’ that causes [the Plaintiffs] harm,” Lujan v. Nat’l Wildlife
Fed’n, 497 U.S. 871, 891 (1990). To be sure, challengers cannot use the APA to “seek wholesale
improvement of [a] program by court decree[.]” Id. (emphasis omitted). As the Defendants put it,
the “Plaintiffs must identify what, exactly, the agency did that they are seeking to challenge.”
Cross-Mot. & Opp’n at 30. But the Plaintiffs have done just that.
The Plaintiffs challenge the Voter List Maintenance Policy, which the Defendants adopted
in response to Executive Order 14248. Under the policy, DOJ’s Civil Rights Division sought
41
SVRLs, disseminated them to contractors and federal agencies, cross-checked them against the
SAVE database, and demanded that states remove voters from their rolls. Along the way, OLC
provided its opinion on the Division’s “proposal”—made “in response to the President’s order”—
“to seek statewide voter lists, and then to share the lists” with DHS. CRT-3330; see also CRT3334 (OLC memorandum describing the obtaining and sharing of SVRLs as a “complianceensuring effort”). 11 Indeed, the administrative record reveals that DOJ viewed this series of steps
as a policy choice. The record refers to the policy as the “list maintenance project,” e.g., CRT-7;
CRT-27, or the “NVRA List Maintenance Project,” CRT-3397, aimed at implementing the
Executive Order. To be sure, the title is not dispositive. But the Defendants undoubtedly
“implement[ed] a policy choice, putting it into motion in a way that leads to concrete results and
prescribes consequences[.]” Ctr. for Taxpayer Rts., 2026 WL 2635380, at *7.
The Defendants seem to suggest that the policy is unreviewable under the APA because it
is made up of multiple constituent actions. They are wrong. The Supreme Court’s decision in
National Wildlife Federation, on which the Defendants rely, makes the point plain. It distinguished
an unreviewable challenge to an agency’s entire program of land regulation from an agency’s
reviewable choice to “apply[] some particular measure across the board[.]” Nat’l Wildlife Fed’n,
497 U.S. at 890 n.2; see also Hisp. Affs. Project v. Acosta, 901 F.3d 378, 387 (D.C. Cir. 2018)
(“The Supreme Court stressed in National Wildlife Federation that, in contrast to the broad
programmatic takeover advanced there, an agency’s action in ‘applying some particular measure
across the board . . . [could] of course [still] be challenged under the APA.’” (alteration in original)
(citing 497 U.S. at 890 n.2)). And following National Wildlife Federation, courts have reviewed
11
At some point, the Civil Rights Division sought OLC’s advice on its “proposal[.]” CRT-3330. The record reflects that OLC gave informal answers in “early September 2025” and subsequently memorialized its advice in May 2026. Id.
42
agencies’ decisions to adopt categorical policies under the APA. New York v. Trump, 171 F.4th 1,
18 (1st Cir. 2026) (allowing an APA challenge to a “discrete, agency-wide categorical freeze” of
federal funds); Elev8 Balt., Inc. v. Corp. for Nat’l & Cmty. Serv., 804 F. Supp. 3d 524, 557 (D.
Md. 2025) (permitting an APA challenge to a set of “discrete agency actions” that “all occurred
within a period of less than two weeks and reflect[ed] a final and categorical decision” by the
defendant agency). And of course, an agency’s decision to adopt a policy, even if unwritten, can
be challenged under the APA. See, e.g., Venetian Casino, 530 F.3d at 931 (recognizing that an
agency’s “decision” to adopt a particular policy—there, a policy of “disclosing confidential
information without notice”—constituted agency action reviewable under the APA); Ctr. for
Taxpayer Rts., 2026 WL 2635380, at *7 (holding that an agency’s decision to begin sharing
particular data with other federal agencies, though not committed to writing, constituted
reviewable agency action).
At bottom, a close review of the administrative record leaves no doubt about the contours
of the policy being challenged. Following Executive Order 14248, which directed greater DOJ
oversight of state election administration, DOJ sought SVRLs from each state, executed
memoranda of understanding with two DHS components, and began comparing SVRLs to the
SAVE database in a bid to identify ineligible voters. See CRT-3330, 3334. DOJ offered each state
a memorandum of understanding that was “constructed as an offer to all states” and could not “be
redlined in any fashion.” CRT-1875. And DOJ’s near-identical memoranda of understanding with
complying states speak of a “list maintenance project” that can be “complete,” with identifiable
“purposes” that can be “accomplished.” 12 E.g., CRT-7 (Alaska); CRT-27–28 (South Carolina).
12
While DOJ’s memorandum of understanding with South Carolina incorporated “several clarifications” that distinguished it from other MOUs, CRT-17, the Defendants cite no authority holding that a policy does not exist solely because it has exceptions. Thus, the distinctions in the
43
DOJ then filed enforcement actions against each state that did not accede to DOJ’s demands to
share their SVRLs under the terms of DOJ’s cookie-cutter MOUs. See Cross-Mot. & Opp’n at 1;
supra n.3.
The Defendants next try to frame the policy as “choices . . . made as to each individual
State and each individual list” that are unreviewable under the APA. Cross-Mot. & Opp’n at 29.
But they tell only half the story. According to the OLC memorandum, the Civil Rights Division
set out to implement a policy “[i]n response to [Executive Order 14248] to identify those who may
be voting illegally (whether by reason of alienage or otherwise)[.]” CRT-3330. That policy
involved “seek[ing] statewide voter lists, and then . . . shar[ing] the lists with Homeland Security
Investigations . . . or another unit within DHS” to “enable cross-referencing the lists against
existing databases in order to identify illegal aliens who are ineligible to vote” so that DOJ could
“seek to strike the [individual]’s name from the voter registration list for future elections[.]” CRT3330, 3334. And the head of DOJ’s Civil Rights Division described the policy as a “comprehensive
effort” to “request[] the voter rolls from all states and the District of Columbia” for “voting
hygiene.” Hill Decl. ¶ 8. Only by ignoring the elephant in the room could the Defendants argue
that this is not agency action. Dep’t of Com., 588 U.S. at 785 (courts are “not required to exhibit a
naiveté from which ordinary citizens are free”) (quoting United States v. Stanchich, 550 F.2d 1294,
1300 (2d Cir. 1977) (Friendly, J.)).
South Carolina MOU do not alter the Court’s conclusion that DOJ adopted the Voter List Maintenance Policy. Indeed, the administrative record makes clear that following the adoption of that policy, DOJ explained to the National Association of Secretaries of State that “DOJ would present a standard MOU to [the] states—and the DOJ would not be negotiating 50 different MOUs that may consume months of time. If a state insist[ed] on an MOU, it w[ould] have to be entered into quickly and in a uniform way (the same or similar MOU presented to other states).” CRT3385.
44
In sum, the Voter List Maintenance Policy, adopted in response to Executive Order 14248,
constitutes agency action that is reviewable under the APA. Cf. Nat’l Council of Nonprofits v.
OMB, 775 F. Supp. 3d 100, 115 (D.D.C. 2025), vacated as moot, 188 F.4th 400 (D.C. Cir. 2026)
(rejecting the “remarkable—and unfathomable—coincidence” that “countless federal agencies . . .
suddenly began exercising their own discretion” in the same way “at the exact same time”).
2. Final Agency Action
Next, the Defendants make the familiar argument that the Voter List Maintenance Policy
is not final agency action. An agency action is “final” under the APA if (1) it “mark[s] the
consummation of the agency’s decisionmaking process” and (2) “rights or obligations have been
determined” by it or “legal consequences will flow” from it. U.S. Army Corps of Eng’rs v. Hawkes
Co., 578 U.S. 590, 597 (2016) (quoting Bennett v. Spear, 520 U.S. 154, 177–78). “Each prong of
Bennett must be satisfied independently for agency action to be final.” Sierra Club v. EPA, 955
F.3d 56, 61 (D.C. Cir. 2020) (cleaned up). The Defendants do not contest the first Bennett prong,
so the Court need only consider the second. See Reply & Cross-Opp’n at 25 n.19 (arguing that the
Defendants “do not deny that this lawsuit meets” the first Bennett requirement); Cross-Reply at 14
(making no mention of the first Bennett prong).
Once again framing the Voter List Maintenance Policy as several separate agency actions,
the Defendants argue that “some elements” of the policy do not meet the second Bennett prong.
Cross-Reply at 14. Not so. Each component of the policy carries legal consequences. For instance,
the Civil Rights Division’s demand letters to states have resulted in settlement agreements,
memoranda of understanding, and enforcement litigation. Indeed, DOJ proceeded to sue 30 states
that refused to provide SVRLs. The letters’ legal consequences were not incidental: each is phrased
in mandatory language, and OLC construed the letters as designed to “compel states to turn over
45
statewide voter lists[.]” CRT-3335. The Civil Rights Division’s sharing of SVRL data that it
obtained from complying states also meets the second Bennett element. The nonconsensual sharing
of individuals’ confidential information itself creates legal consequences, without any need for
further action. See League of United Latin Am. Citizens v. Exec. Off. of the President, 818
F. Supp. 3d 34, 112 (D.D.C. 2026) (“[S]haring sensitive records with others outside the agency is
‘final’ because it clearly represents the ‘consummation’ of the agency’s decision-making process
and is an action ‘by which rights or obligations have been determined, or from which legal
consequences will flow.’” (emphasis omitted)), aff’d, No. 25-5476, 2026 WL 1991571 (D.C. Cir.
July 2, 2026); Venetian Casino, 530 F.3d at 931 (“Adopting a policy of permitting employees to
disclose confidential information without notice is surely a ‘consummation of the agency’s
decisionmaking process,’ and ‘one by which [the submitter’s] rights [and the agency’s] obligations
have been determined.’”). Thus, DOJ’s adoption of the Voter List Maintenance Policy constitutes
final agency action reviewable under the APA.
C. Merits
Having satisfied itself that the Plaintiffs have standing and a cause of action under the APA,
the Court turns to the merits. The Plaintiffs seek summary judgment on their APA claims that the
Voter List Maintenance Policy exceeds DOJ’s statutory authority, is arbitrary and capricious, and
is contrary to law under the Privacy Act and the PRA. The Court takes these claims in turn.
1. Excess of Statutory Authority
The APA requires courts to “hold unlawful and set aside agency action” that is “in excess
of statutory jurisdiction, authority, or limitations, or short of statutory right[.]” 5 U.S.C.
§§ 706(2)(A), (C). That is because “[a]n agency . . . literally has no power to act . . . unless and
until Congress authorizes it to do so by statute.” FEC v. Cruz, 596 U.S. 289, 301 (2022) (cleaned
46
up). Here, the Plaintiffs claim that no statute authorizes DOJ’s Voter List Maintenance Policy. The
Defendants retort that the policy is authorized by three statutes—the Civil Rights Act, the NVRA,
and HAVA. They are wrong. In fact, it would turn these voter-protection laws on their head to find
that they authorize DOJ’s unprecedented actions.
a. 1960 Civil Rights Act
Start with the Civil Rights Act of 1960, which Congress enacted to give the federal
government tools to investigate and remedy systematic disenfranchisement of African American
citizens. See H.R. Rep. No. 86-956 at 7 (1959) (“The purpose of [T]itle III is to provide a more
effective protection of the right of all qualified citizens to vote without discrimination on account
of race.”); Evans, 2026 WL 2267774, at *8–9 (describing the enactment of Title III and explaining
that “Congress had its sights set on the maze of voter registration requirements employed by
southern states to disenfranchise their black residents”). It requires an election officer to “retain
and preserve . . . all records and papers which come into his possession relating to any application,
registration, payment of poll tax, or other act requisite to voting in such election[.]” 52 U.S.C.
§ 20701. It also provides criminal penalties for “any person . . . who willfully steals, destroys,
conceals, mutilates, or alters any record or paper required by [Section 20701] to be retained and
preserved[.]” Id. § 20702. And it authorizes the “Attorney General or his representative” to
“demand in writing” the opportunity to “inspect[], reproduc[e], and copy[]” those records. Id.
§ 20703. But critically, to trigger this provision, the demand must “contain a statement of the basis
and the purpose therefor.” Id.
47
The Defendants argue that these provisions authorize the Civil Rights Division’s demands
for state voter rolls. The Court is not convinced. Like other district courts around the country,13
this Court concludes that the Division’s boilerplate Title III demand letters fail at the statutory
threshold because they do not “contain a statement of the basis and the purpose therefor.” Id.
§ 20703.
“When interpreting a statute, we begin with the text.” Lackey v. Stinnie, 604 U.S. 192, 199
(2025). And the text of Section 20703 makes three things clear. First, under Title III, a basis-andpurpose statement is not optional. Instead, a Title III demand “shall contain” it. 52 U.S.C. § 20703
(emphasis added). As the Supreme Court has routinely and consistently recognized, “the use of
the word ‘shall’ ‘creates an obligation impervious to judicial discretion.’” Smith v. Spizzirri, 601
U.S. 472, 476 (2024) (quotation omitted); see also Bufkin v. Collins, 604 U.S. 369, 379 (2025) (“It
is undisputed that the word ‘shall’ imposes a mandatory command.” (citation omitted)).
Accordingly, Title III required the Civil Rights Division’s demands under the Voter List
Maintenance Policy to contain some statement that met the statutory requirement. Second,
Section 20703 refers to “a statement of the basis and the purpose” of the demand. 52 U.S.C.
§ 20703 (emphasis added). “‘And’ . . . is of course a conjunction” that means “along with or
together with.” Pulsifer v. United States, 601 U.S. 124, 133 (2024) (cleaned up). Third, the statute
requires “a statement[.]” 52 U.S.C. § 20703. As the Supreme Court has explained, when preceding
a countable noun, the indefinite article “a” naturally suggests “‘a’ single” statement “containing
the required information[.]” Niz-Chavez v. Garland, 593 U.S. 155, 161 (2021). So Section 20703
13
See, e.g., Amore, 831 F. Supp. 3d at 156–57; Scanlan, 838 F. Supp. 3d, at 162; Oliver, 2026 WL 2031479, at *9–10; Galvin, 830 F. Supp. 3d at 131; Aguilar, 2026 WL 2364502, at *5–6; Warner, 2026 WL 2018877, at *3–6; cf. Bd. of Elections, 2026 WL 1999921, at *8 (noting that DOJ’s Title III demand “states no basis and the purported ‘purpose’ . . . lacks any relation to the purposes for which Title III was enacted” but ultimately declining to reach the issue).
48
obligates DOJ to accompany a Title III demand with a single statement articulating the “the basis
and the purpose” for its request. 52 U.S.C. § 20703; accord, e.g., Benson, 179 F.4th at 483.
The question, then, is what suffices to meet that threshold requirement. The Court begins
with the observation that no matter how “the basis” and “the purpose” are defined, they must have
distinct meanings. “To read the statute as satisfied by a statement of either basis or purpose alone
would run afoul of the ordinary rules of statutory construction by rendering one half of the phrase
superfluous.” Scanlan, 838 F. Supp. 3d at 160 (first citing Antonin Scalia & Bryan Garner,
Reading Law: The Interpretation of Legal Texts at 174 (2012); and then citing William N.
Eskridge, Jr., Interpreting Law: A Primer on How to Read Statutes and the Constitution at 113
(2016)); see also Dep’t of Agric. Rural Dev. Rural Hous. Serv. v. Kirtz, 601 U.S. 42, 53 (2024)
(“Proper respect for Congress cautions courts against lightly assuming that any of the statutory
terms it has chosen to employ are superfluous or void of significance.” (cleaned up)). 14 Moreover,
the “basis” and the “purpose” have distinct ordinary meanings. In 1968—eight years after Title III
was enacted—Black’s Law Dictionary defined “purpose” as “[t]hat which one sets before him to
accomplish; an end, intention, or aim, object, plan, project.” Purpose, Black’s Law Dictionary (4th
rev. ed. 1968). The same dictionary defined “basis” as “groundwork,” “support,” or “foundation.”
Basis, Black’s Law Dictionary (4th rev. ed. 1968); see also Galvin, 830 F. Supp. 3d at 127
14
OLC’s memorandum resists this conclusion, urging that Congress’s use of the phrase “the basis and the purpose,” 52 U.S.C. § 20703, “reflects ‘a lawyerly penchant for doublets (aid and abet, cease and desist, null and void),’” CRT-3351 (quoting King v. Burwell, 576 U.S. 473, 502 (2015) (Scalia, J., dissenting)). Setting aside whether a “lawyerly doublets” canon can be squared with the Supreme Court’s longstanding warnings against reading statutes to contain surplusage—and the fact that “basis” and “purpose” have distinct meanings—the Court is additionally unpersuaded by this argument because Section 20703 requires “a statement of the basis and the purpose” underlying a demand, 5 U.S.C. § 20703, rather than, for instance, a statement of “the basis and purpose.” As the Supreme Court has noted, a grammatical construction that combines a “definite article with a singular noun” typically denotes “a discrete thing[.]” Niz-Chavez v. Garland, 593 U.S. 155, 166 (2021).
49
(summarizing other contemporaneous dictionary definitions). As other courts have recognized, the
ordinary meanings of “basis” and “purpose” make clear that Title III requires DOJ to explain why
it is demanding records from a state (its purpose) and what factual foundation underpins its request
(its basis). See, e.g., Scanlan, 838 F. Supp. 3d, at 160 (“If ‘the purpose’ denotes the investigative
objective of the demand, it follows that ‘the basis’ in this context is the evidentiary or factual
predicate giving rise to the demand in the first place.”); Weber, 816 F. Supp. 3d at 1184; Warner,
2026 WL 2018877, at *4.
Claiming that DOJ has met its Title III obligations, the Defendants point to the following
statement, which is repeated in each of DOJ’s Title III demand letters to states: “[T]he Attorney
General is demanding an electronic copy of [the state’s] complete and current VRL. The purpose
of the request is to ascertain [the state’s] compliance with the list maintenance requirements of the
NVRA and HAVA.” E.g., CRT-2347; CRT-2401; CRT-2412; see Cross-Mot. & Opp’n at 38.
While that statement appears to explain DOJ’s purpose, it fails to articulate its basis. Thus, even
though Title III’s basis requirement may well be a low bar, the Defendants fail to clear it because
the form letters issued under DOJ’s policy fail to articulate any reason to believe that states had
not been complying with their list-maintenance obligations under the NVRA and HAVA. See, e.g.,
Galvin, 830 F. Supp. 3d at 129 (concluding that DOJ’s Title III demand to Massachusetts “offered
no basis—none—and the demand was therefore facially inadequate”); Amore, 831 F. Supp. 3d
at 157 (“Absent from the demand are any factual allegations suggesting that Rhode Island may be
violating the list maintenance requirements of the NVRA and HAVA, let alone the CRA.”).
Urging that they have met Title III’s requirements, the Defendants rely on two Fifth Circuit
cases decided shortly after the passage of the 1960 Civil Rights Act. Neither advances their cause.
First, in United States v. Lynd, the Fifth Circuit approved a Title III demand that relied on a “simple
50
assertion by the Attorney General of the United States that there are reasonable grounds for belief
that certain voters are being discriminatorily denied their voting rights in a given county.” 301
F.2d 818, 822 (5th Cir. 1962). But even assuming that Lynd correctly interpreted Title III, the
SVRL requests issued under the Voter List Maintenance Policy do not meet even its standard
because they fail to assert any factual basis for DOJ’s demands. Next, the Defendants invoke
Coleman v. Kennedy, 313 F.2d 867 (5th Cir. 1963) (per curiam), which they cite as establishing
that “the Attorney General need only ‘identify in a general way the reasons for his demand’” for
federal election records. Cross-Reply at 20 (quoting Coleman, 313 F.2d at 868). But Coleman does
not persuade the Court that the Defendants are correct. The quotation that the Defendants pluck
from Coleman is in fact the Fifth Circuit’s quotation of a single legislator’s statement during the
debate surrounding Title III. See Coleman, 313 F.3d at 868 (“[W]e quote from Senator Keating,
one of the principal spokesmen for the bill in the Senate[.]” (citing 106 Cong. Rec. 7767 (1960))).
And of course, “floor statements by individual legislators rank among the least illuminating forms
of legislative history.” NLRB v. SW Gen., Inc., 580 U.S. 288, 307 (2017). The Court declines to
rely on legislative history to subvert statutory text.
51
Thus, the Voter List Maintenance Policy cannot be justified by Title III, 15 and this Court
joins the unanimous group of district courts that have concluded that the Civil Rights Act of 1960
does not authorize DOJ’s across-the-board demands for SVRLs from 49 states. See supra n.3. 16
b. NVRA and HAVA
The Defendants also argue that the NVRA and HAVA authorize the Voter List
Maintenance Policy. Because DOJ may enforce the NVRA and HAVA through civil lawsuits, see
52 U.S.C. § 20510(a) (NVRA); id. § 21111 (HAVA), the Defendants argue that the statutes
necessarily imply an investigative authority to seek states’ SVRLs to determine whether the
statutes have been violated, see Cross-Reply at 20–21. And they claim that the NVRA and HAVA
authorize DOJ’s processing of the SVRLs and its demands that states remove voters from their
rolls. Cross-Mot. & Opp’n at 39–41; Cross-Reply at 22. Nothing in the NVRA or HAVA supports
the Defendants’ contentions.
15
Other courts have found DOJ’s Title III demands invalid on other grounds. Several courts, for instance, have concluded that Title III categorically excludes demands for the SVRLs because SVRLs do not “come into [the] possession” of state election officials, contra 52 U.S.C. § 20701, and must be modified to remove ineligible voters, contra id. § 20702 (imposing criminal penalties “willfully steals, destroys, conceals, mutilates, or alters” records subject to Title III). See, e.g., Benson, 179 F.4th at 478–82; Evans, 2026 WL 2267774, at *5 (collecting cases and noting that at that point “fifteen courts [had] held that Title III does not authorize the Attorney General to compel state election officials to produce unredacted copies of their states’ voter registration lists”). Following these courts and others, the Plaintiffs have argued that Title III cannot be read to encompass SVRLs. See Reply & Cross-Opp’n at 33. Because this Court finds that DOJ’s Title III demands fail at the threshold, it does not consider the Plaintiffs’ broader textual argument. 16
“[T]he longstanding practice of the government—like any other interpretive aid—can inform a court’s determination of what the law is.” Loper Bright Enters. v. Raimondo, 603 U.S. 369, 386 (2024). And here, past practice confirms the Court’s interpretation of Title III’s statutory threshold. Historically, the Civil Rights Division has used its Title III investigatory authority “to obtain discrete categories of records keyed to a specific, preexisting, and articulated enforcement concern.” Brief of Amici Curiae Former Employees of the U.S. Department of Justice at 11–13, ECF No. 46 (describing Title III requests to further civil rights investigations).
52
Consistent with our constitutional structure, the NVRA and HAVA place states at the helm
of maintaining their voter rolls. Cf. Arizona v. Inter Tribal Council of Ariz., Inc., 570 U.S. 1, 16
(2013) (“[T]he Elections Clause empowers Congress to regulate how federal elections are held,
but not who may vote in them.” (emphasis in original)). The NVRA requires that each state
“conduct a general program that makes a reasonable effort to remove the names of ineligible voters
from the official lists of eligible voters by reason of . . . the death of the registrant; or . . . a change
in the residence of the registrant[.]” 52 U.S.C. § 20507(a)(4). And under HAVA, states must
“ensure that voter registration records in the State are accurate and are updated regularly” and
“make[] a reasonable effort to remove registrants who are ineligible to vote from the official list
of eligible voters.” Id. § 21083(a)(4). Both the NVRA and HAVA empower the Attorney General
to file civil lawsuits to ensure compliance with the statutes. Id. § 20510(a) (“The Attorney General
may bring a civil action in an appropriate district court for such declaratory or injunctive relief as
is necessary to carry out [the NVRA].”); id. § 21111 (“The Attorney General may bring a civil
action against any State or jurisdiction in an appropriate United States District Court for such
declaratory and injunctive relief . . . as may be necessary to carry out the uniform and
nondiscriminatory election technology and administration requirements under [HAVA].”).
But nothing in those statutes empowers DOJ to demand SVRLs from states. The NVRA
contains a limited public disclosure provision that requires states to make available for public
inspection “records concerning the implementation of programs and activities conducted for the
purpose of ensuring the accuracy and currency of official lists of eligible voters.” Id. § 20507(i).
And HAVA has no disclosure provision at all. In other words, nothing “in the NVRA or HAVA
giv[es] the Attorney General special access to state voter registration lists[.]” Evans, 2026 WL
2267774, at *10. “If the Department of Justice wants to enforce HAVA and the NVRA, it must
53
use the pre-suit investigation and enforcement mechanisms that Congress provided in those
statutes—which do not contemplate production of the unredacted computerized list to the Attorney
General so that he might loom over the shoulder of the state election official to point out and
demand the correction of inaccuracies in the list.” United States v. Bellows, 834 F. Supp. 3d 113,
126 (D. Me. 2026). DOJ might think that it is a “forensic accountant using large-scale bank records
to investigate potential fraud.” Cross-Mot. & Opp’n at 40. But it may not take on that role vis-à-vis voter registration records without statutory authorization.
The NVRA and HAVA likewise do not authorize the remainder of the Voter List
Maintenance Policy. Although the NVRA and HAVA empower DOJ to file civil suits to ensure
compliance with those statutes, the Defendants point to no provision of either statute that expressly
authorizes the sharing of unredacted voter rolls containing sensitive personal information with
other federal agencies, such as DHS and its components. Nor do the Defendants identify where
the NVRA and HAVA authorize the federal government to demand the removal of purportedly
ineligible voters. Instead, the NVRA makes clear that “each State” is responsible for “mak[ing] a
reasonable effort to remove the names of ineligible voters,” 52 U.S.C. § 20507(a)(4) (emphasis
added), and expressly tasks states with “provid[ing] that the name of a registrant may not be
removed from the official list of eligible voters except . . . at the request of the registrant[,]” “as
provided by State law[,]” or under the state-administered program of removing ineligible voters,
id. § 20507(a)(3). HAVA sings the same tune. It makes states—not the federal government—
responsible for maintaining SVRLs by removing ineligible voters. See, e.g., id. § 21083(a)(2).
Under both statutory schemes, DOJ’s enforcement role is limited to ensuring that states comply
with their statutory obligations to “make[] a reasonable effort” to remove ineligible voters. Id.
§ 20507(a)(4) (NVRA); see also id. § 21111 (HAVA provision authorizing the Attorney General
54
to bring civil actions to enforce HAVA’s “uniform and nondiscriminatory election technology and
administration requirements”). Therefore, nothing in the NVRA or HAVA authorizes the Voter
List Maintenance Policy.
* * *
In sum, no statute justifies the Civil Rights Division’s unprecedented Voter List
Maintenance Policy. And of course, “[a]dministrative agencies are creatures of statute” that
“possess only the authority that Congress has provided.” NFIB v. OSHA, 595 U.S. 109, 117 (2022).
2. Arbitrary and Capricious
The Plaintiffs next argue that the Voter List Maintenance Policy is arbitrary and capricious.
See 5 U.S.C. § 706(2) (requiring a reviewing court to “hold unlawful and set aside agency action,
findings, and conclusions found to be . . . arbitrary [and] capricious”). The Court agrees.
The APA “requires agencies to engage in reasoned decisionmaking[.]” DHS v. Regents of
the Univ. of Cal. (Regents), 591 U.S. 1, 16 (2020). Agency action is “arbitrary and capricious if
the agency has relied on factors which Congress has not intended it to consider, entirely failed to
consider an important aspect of the problem, offered an explanation for its decision that runs
counter to the evidence before the agency, or is so implausible that it could not be ascribed to a
difference in view or the product of agency expertise.” Motor Vehicle Mfrs. Ass'n of U.S., Inc. v.
State Farm Mut. Auto. Ins. Co., 463 U.S. 29, 43 (1983).
Here, the administrative record demonstrates that DOJ “entirely failed to consider an
important aspect of the problem.” Id.; see also W. Coal Traffic League v. Surface Transp. Bd., 998
F.3d 945, 954 (D.C. Cir. 2021). The Plaintiffs argue that the Defendants “failed to consider the
substantial risk that the Policy would result in the erroneous removal of eligible voters from states’
SVRLs.” Mot. at 40. And the administrative record bears that out. It reflects the Defendants’
55
awareness of the modified SAVE’s inability to accurately identify certain categories of citizens,
see CRT-32 n.2, and their lack of consideration of that risk.
The Defendants offer essentially no response to this claim. They take a shot in the dark in
arguing that the Plaintiffs cannot assert reliance interests “based on DOJ’s previous failure . . . to
enforce the NVRA and HAVA.” Cross-Mot. & Opp’n at 52. But the Plaintiffs do not take issue
with DOJ’s enforcement of the NVRA and HAVA; they attack DOJ’s policy choice to enforce
those statutes by relying on a database with known systematic errors. In that respect, the Voter List
Maintenance Policy presents an obvious risk that U.S. citizens will be wrongfully removed from
voter rolls. And that risk is not hypothetical—that much is clear based on what happened to the
Plaintiff Anthony Nel, see Nel Decl. ¶¶ 13–28, and Common Cause member Bailey Doe, see B.
Doe Decl. ¶¶ 11–31. Moreover, the Defendants cannot deny that the risk of erroneously demanding
that states remove U.S. citizens from their voter rolls is an “important aspect” of the problem that
the Civil Rights Division sought to address through the Voter List Maintenance Policy:
“preserv[ing] and protect[ing] the integrity of the American electoral process[.]” CRT-3330. But
faced with that pitfall in their predetermined approach, this administrative record demonstrates
that the Division chose to look the other way. In other words, the Division entirely failed to
consider the risks that its policy posed to U.S. citizens who hold a fundamental right to vote.
Because the administrative record is “not sufficient to enable” this Court to conclude that
the Voter List Maintenance Policy “was the product of reasoned decisionmaking,” the Court must
set it aside as arbitrary and capricious. State Farm, 463 U.S. at 52. 17
17
The Plaintiffs advance other reasons why the Voter List Maintenance Policy is arbitrary and capricious. Mot. at 37–42. Having found that DOJ failed to consider an important aspect of the problem that it sought to solve, the Court need not reach those additional arguments.
56
3. Contrary to Law (Privacy Act)
The Plaintiffs also contend that the Voter List Maintenance Policy violates the Privacy Act,
including its procedural and substantive protections. And the APA requires courts to “hold
unlawful and set aside agency action” that is “without observance of procedure required by law”
or “otherwise not in accordance with law[.]” 5 U.S.C. § 706(2)(A), (D). Before getting to the
merits of the Plaintiffs’ Privacy Act challenge, the Court will address the Defendants’ contention
that the Plaintiffs cannot rely on the APA to vindicate their rights under the Privacy Act.
Ultimately, the Court concludes that the Plaintiffs’ Privacy Act claim is both properly before it
and meritorious.
a. Other-Adequate-Remedy Bar
The Defendants contend that the Plaintiffs’ Privacy Act claim fails because the APA limits
its cause of action to situations where there is “no other adequate remedy in a court,” 5 U.S.C.
§ 704, and the Privacy Act provides its own remedial scheme. This Court has considered and
rejected this argument before, explaining that “courts in this District have precluded APA suits for
Privacy Act violations” only “when they ‘duplicate existing procedures for review of agency
action.’” League of Women Voters, 835 F. Supp. 3d at 120 (quoting Haleem v. DOD, No. 23-cv1471, 2024 WL 230289, at *13–14 (D.D.C. Jan. 22, 2024)); see also Ctr. for Taxpayer Rts., 2026
WL 2635380, at *10 (“[A] statute that provides only ‘doubtful and limited relief’ . . . cannot be
read to displace the APA by implication.” (quoting Bowen v. Massachusetts, 487 U.S. 879, 901
(1988))). But the Privacy Act does not provide relief for violations of its procedural requirements,
see 5 U.S.C. § 552a(e)(4), (11); id. § 552a(g), or provide remedies to enforce its statutory
limitations on disclosure, see id. § 552a(b). Thus, “[r]ather than suggesting a bar on APA review,
the ‘absence of equitable relief’ for these claims in the Privacy Act’s judicial review provisions is
57
easily ‘explained by the availability of such relief under the APA[.]’” League of Women Voters,
835 F. Supp. 3d at 121 (quoting Cooper, 566 U.S. at 303 n.12); see also Doe v. Chao, 540 U.S.
614, 619 n.1 (2004) (“The Privacy Act says nothing about standards of proof governing equitable
relief that may be open to victims of adverse determinations or effects, although it may be that this
inattention is explained by the general provisions for equitable relief within the [APA][.]”). Indeed,
the D.C. Circuit has permitted vacatur relief under the APA to enforce the Privacy Act’s disclosure
provisions. See Doe v. Stephens, 851 F.2d 1457, 1465–67 (D.C. Cir. 1988) (challenging agency
disclosure as not constituting a routine use under 5 U.S.C. § 552a(a)(7), (b)). So have numerous
district courts. See League of Women Voters, 835 F. Supp. 3d at 121 (collecting cases).
More broadly, as the Court has observed elsewhere, “it is unclear whether the APA’s otheradequate-remedy bar even applies to the Privacy Act,” because after a 1966 repeal, “there is in fact
no Administrative Procedure Act, just Title 5,” and when Congress enacted the Privacy Act in
1974, it “placed it in Chapter 5 alongside the APA’s provisions.” Id. Thus, “review under the
Privacy Act might not count as review ‘elsewhere,’ given that both the Privacy Act and the APA
might be properly conceived of as components of the same scheme: Title 5.” Id. at 122 (quoting
V.I. Hous. Fin. Auth. v. FEMA, 151 F.4th 409, 418 (D.C. Cir. 2025)).
In any event, the Privacy Act cannot serve as an adequate remedy for Common Cause, an
organization with no private right of action under the Act. See 5 U.S.C. § 552a(g)(1) (allowing an
“individual” to “bring a civil action” (emphasis added)); AFL-CIO I, 778 F. Supp. 3d at 88
(“[C]ourts in this District and around the country have explained that the Privacy Act’s text permits
no interpretation other than that organizations do not fall within the scope of its civil right of
action.” (cleaned up)); cf. Mohamad v. Palestinian Auth., 566 U.S. 449, 453–54 (2012)
58
(interpreting “individual” in the context of a right-of-action provision to include “natural persons
alone”).
For all these reasons, the Court concludes that the Privacy Act does not displace the
Plaintiffs’ cause of action under the APA.
b. Procedural Requirements
On the merits, the Plaintiffs argue that the Voter List Maintenance Policy violates the
Privacy Act’s procedural requirements. They are correct.
The Privacy Act provides that “[e]ach agency that maintains a system of records shall”
“publish in the Federal Register upon establishment or revision a notice of the existence and
character of the system of records[.]” 5 U.S.C. § 552a(e), (e)(4). Among other things, these
notices—which are known as system of records notices, or SORNs—must include “the categories
of individuals on whom records are maintained in the system” and “each routine use of the records
contained in the system, including the categories of users and the purpose of such use[.]” Id.
§ 552a(e)(4)(B), (D). The Privacy Act further requires notice and “an opportunity for interested
persons to submit written data, views, or arguments to the agency” at least 30 days before “any
new use or intended use of the information in the system[.]” Id. § 552a(e)(11). One purpose of the
Privacy Act’s procedural requirements is to “permit an individual to determine what records
pertaining to him are collected, maintained, used, or disseminated by [federal] agencies.” Privacy
Act of 1974 § 2(b)(1), Pub. L. No. 93-579, 88 Stat. 1896, 1896. “The Privacy Act’s public notice
and comment structure is an essential component of the Act and an essential piece of American
democracy. Americans deserve to know the nature, scope, and routine uses of the records before
they are collected by the federal government[.]” Weber, 816 F. Supp. 3d at 1193.
59
Here, the Civil Rights Division added the SVRLs that it obtained under the Voter List
Maintenance Policy to a system of records titled the “Central Civil Rights Division Index File and
Associated Records”—which the Court refers to as the “Central Index File.” See CRT-3355. The
SORN governing the Central Index File was published in 2003. See Privacy Act of 1974; System
of Records, 68 Fed. Reg. 47610 (Aug. 11, 2003) (2003 SORN); see also CRT-3355. In relevant
part, the 2003 SORN states that the “categories of individuals covered by the system” “may include
. . . [s]ubjects of investigations [and] victims,” among others. 68 Fed. Reg. 47611.
The Defendants argue that the 2003 SORN covers the addition of the SVRLs to the Central
Index File—and therefore satisfies the Privacy Act’s procedural requirements without the need for
a new SORN—because “[p]ersons who appear in a state voter list are [] subjects of DOJ’s
investigation into voter fraud,” while “legitimate voters who appear on those lists are potential
victims of voter fraud.” Cross-Reply at 24 (emphasis added). That reading of the 2003 SORN
defies belief. Taking those contentions in turn, it is nonsensical to say that every American
registered to vote is the subject of a DOJ voter fraud investigation simply because they registered
to vote. No reasonable American would fathom that every voter in every corner of the country is a
subject of a (seemingly perpetual) federal investigation merely for exercising their fundamental
right to vote. To support their novel interpretation of “subject,” the Defendants invoke the Second
Circuit’s reliance on the Justice Manual in American Oversight v. DOJ, 45 F.4th 579 (2d Cir.
2022). There, the court explained that “‘subject’ [is a] term[] of art in the context of DOJ
investigations . . . defined as ‘a person whose conduct is within the scope of the grand jury’s
investigation.’” Id. at 582 n.2 (emphasis added) (quoting DOJ, Justice Manual § 9-11.151 (2020)).
The Defendants elide the words “grand jury” in their briefing, Cross-Mot. & Opp’n at 43, because,
of course, no grand jury was involved in DOJ’s efforts to obtain SVRLs and there is no suggestion
60
that the voters caught in DOJ’s data collection were the subject of any grand jury investigation.
Thus, even accepting the Defendants’ definition of “subject,” the 2003 SORN does not authorize
the actions taken under the Voter List Maintenance Policy. Next, the Defendants claim that
legitimate voters who appear on the SVRL are “potential victims of voter fraud due to the prospect
of ‘unlawful dilution[.]’” Cross-Reply at 24 (emphasis added). That is pure speculation. Nothing
in the administrative record supports that each of the millions of Americans whose data has been
added to the Central Index File is in fact a “victim[]” covered by the 2003 SORN. So that clause
of the 2003 SORN provides no support to DOJ either.
At bottom, the Defendants seem to think that they can collect data on every registered voter
in America without complying with procedural protections that Congress deemed necessary. It is
clear as day that the 2003 SORN does not cover the Voter List Maintenance Policy’s additions to
the Central Index File. Therefore, the Defendants have violated the Privacy Act by augmenting the
Central Index File without issuing a statutorily compliant SORN.
c. Improper Disclosures
Next, the Plaintiffs argue that the disclosure of voting rolls to contractors and other federal
agencies through the Voter List Maintenance Policy violates the Privacy Act. The Court agrees. 18
18
The Plaintiffs mount an inadequate challenge to the Civil Rights Division’s disclosures to states, see Mot. at 29 (stating only that the Division is “defying [the Privacy Act’s] command” that disclosures be within the scope of published SORNs “by allowing DOJ to send its analysis of the SVRLs back to states”), to which the Defendants respond, Cross-Mot. & Opp’n at 45. But when faced with the Defendants’ response, the Plaintiffs provide no greater specificity. See Reply & Cross-Opp’n at 40 (attacking the Defendants’ reliance on Routine Use One to defend DOJ’s disclosures to states). “Mentioning an argument ‘in the most skeletal way, leaving the court to do counsel’s work, create the ossature for the argument, and put flesh on its bones’ is tantamount to failing to raise it.” Am. First Legal Found. v. GAO, 819 F. Supp. 3d 20, 29 (D.D.C. 2026) (quoting Al-Tamimi v. Adelson, 916 F.3d 1, 6 (D.C. Cir. 2019)).
61
“An agency violates the [Privacy] Act when it ‘discloses’ information in the form of a
‘record’ from a ‘system of records’ and the disclosure is not pursuant to a valid exception under
the Act.” Chichakli v. Tillerson, 882 F.3d 229, 233 (D.C. Cir. 2018) (quoting 5 U.S.C. § 552a(b)).
The Defendants do not contest that the sharing of SVRL data constitutes “disclosures” under the
Privacy Act. See Cross-Mot. & Opp’n at 43–45. But they say that the disclosures are permitted
under the Act’s routine use and law enforcement exceptions. See id.
i. Routine Use Exception
The Court starts with the routine use exception. See 5 U.S.C. § 552a(b)(3). “To fit within
the confines of [that] exception to the Privacy Act, an agency’s disclosure of a record must be both
(i) ‘for a purpose which is compatible with the purpose for which it was collected’ and (ii) within
the scope of a routine use notice published by the agency.” Ames v. DHS, 861 F.3d 238, 240 (D.C.
Cir. 2017) (first quoting 5 U.S.C. § 552a(a)(7); and then citing id. § 552a(e)(4)(D)). And “when
an agency publishes the routine uses for a record, it must include ‘the purposes of such use’” to
“provide adequate notice of the purposes for which” the agency may disclose information. Tran v.
Dep’t of Treasury, 351 F. Supp. 3d 130, 136 (D.D.C. 2019) (quoting 5 U.S.C. § 552a(e)(4)(D)),
aff’d, 798 F. App’x 649 (D.C. Cir. 2020); see also Britt v. Naval Investigative Serv., 886 F.2d 544,
548 (3d Cir. 1989) (interpreting the Privacy Act to require that a routine use provide “adequate
notice to individuals as to what information concerning them will be released and the purposes of
such release” and noting Congress’s intent, reflected in the legislative history, that there be
“meaningful public notice”). The 2003 SORN enumerates 15 routine uses, 68 Fed. Reg. 47611–
12, of which the Defendants invoke three.
First, the Defendants argue that the eighth routine use permits disclosure to DOJ
contractors. Routine Use Eight describes disclosures “[t]o contractors, grantees, experts,
62
consultants, students, and others performing or working on a contract, service, grant, cooperative
agreement, or other assignment for the Federal Government, when necessary to accomplish an
agency function related to this system of records[.]” 68 Fed. Reg. 47612. But here, the Defendants
have not claimed—much less met their burden to show—that disclosure to DOJ contractors is
“necessary to accomplish an agency function[.]” Id. Indeed, the administrative record reveals only
that DOJ has entered a contract “for purposes of providing information technology and automated
litigation support services[.]” CRT-3325. The Defendants’ briefing is equally unilluminating,
stating only that the contractors involved are “assisting in maintenance of the Central Index File[.]”
Cross-Mot. & Opp’n at 43. Thus, on this record, the Court cannot conclude that disclosure to
contractors is “necessary” within the meaning of Routine Use Eight. And even if DOJ’s paltry
evidentiary showing passed muster under Routine Use Eight, it is difficult to see how that routine
use could provide the “meaningful public notice” of the terms and purposes of disclosure that the
Privacy Act requires, Britt, 886 F.2d at 548, since any disclosure to any contractor for any purpose
would be allowable. Thus, while the Defendants may well be able to meet their burden on another
record, for now they have not shown that Routine Use Eight shields disclosures to contractors in
this instance.
Moreover, even if DOJ’s disclosures of SVRLs to its contractors were permitted by
Routine Use Eight, they are straightforwardly forbidden by Title III, as the Plaintiffs note. Reply
& Cross-Opp’n at 33. After all, Title III provides:
Unless otherwise ordered by a court of the United States, neither the Attorney
General nor any employee of the Department of Justice, nor any other
representative of the Attorney General, shall disclose any record or paper produced
pursuant to this chapter, or any reproduction or copy, except to Congress and any
committee thereof, governmental agencies, and in the presentation of any case or
proceeding before any court or grand jury.
63
52 U.S.C. § 20704. And here, the complying states produced their SVRLs following a Title III
demand. 19 Thus, Title III’s prohibition on disclosure covers those records. The Defendants’ only
argument to the contrary rests on a simple misreading of Section 20704. They baldly claim that
the statute “does not prohibit DOJ from sharing data with its contractors, who are ‘other
representative[s] of the Attorney General’ that can access records disclosed by States.” CrossReply at 20 n.7 (alteration in original) (quoting 52 U.S.C. § 20704). But of course, Section 20704
does not allow the Attorney General’s “representatives” to access records; it forbids them from
19
To be clear, the Defendants have not argued that Section 20704 does not apply to the SVRLs collected by the Civil Rights Division under its Voter List Maintenance Policy. But that concession aside, the administrative record independently makes clear that each of the 18 complying states produced their SVRLs after the Division invoked its (purported) Title III authority to demand them. See CRT-3255 (confirming transmission of Alabama’s SVRL to the Civil Rights Division pursuant to the NVRA, HAVA, and Title III); CRT-2 (memorandum of understanding between DOJ and Alaska stating that Alaska’s SVRL was requested by DOJ under Title III, among other authorities); CRT-2412 (“Pursuant to the foregoing authorities, including the CRA, the Attorney General is demanding an electronic copy of Arkansas’s complete and current VRL.”); CRT-1437 (letter from Florida Secretary of State transmitting Florida’s SVRL under Title III and noting the disclosure restrictions of 52 U.S.C. § 20704); CRT-2692 (letter to Indiana invoking Title III to demand Indiana’s SVRL); CRT-3259 (letter from Iowa Secretary of State turning over Iowa’s SVRL after “conclud[ing] that it is likely that the U.S. Attorney General has authority under the Civil Rights Act of 1960 . . . to demand voter registration data”); CRT-2711 (Title III demand to Kansas); CRT-2744 (Title III demand to Louisiana); CRT-3261 (letter from Mississippi Secretary of State disclosing Mississippi’s SVRL under Title III); CRT-2872–74 (Title III demand to Montana); CRT-3265 (letter from Nebraska Secretary of State transmitting Nebraska’s SVRL under the NVRA, HAVA, and Title III); CRT-3126–28 (letter from Ohio Secretary of State transmitting Ohio’s SVRL under the NVRA, HAVA, and Title III, and noting Ohio’s expectation that DOJ would comply with Section 20704); CRT-11 (settlement agreement requiring production of Oklahoma’s SVRL in Title III case between DOJ and Oklahoma); CRT-19 (resolution of the South Carolina Election Commission authorizing disclosure of South Carolina’s SVRL following DOJ’s request under the NVRA, HAVA, and Title III); CRT-1995 (letter from South Dakota’s Secretary of State disclosing South Dakota’s SVRL and noting South Dakota’s “understanding that all federal data privacy laws, including, but not limited to, . . . Section 304 of the CRA, 52 U.S.C. § 20704, will be strictly followed”); CRT-3138 (Title III demand to Tennessee); CRT2037 (memorandum of understanding between DOJ and Texas invoking DOJ’s Title III authority); CRT-3404 (letter from Wyoming’s Secretary of State disclosing Wyoming’s SVRL based on Wyoming’s view “that disclosure of the requested records is proper under the Civil Rights Act” and noting DOJ’s assurances that “federal privacy protections, including the application of Section 304 of the Civil Rights Act, apply to these records”).
64
disclosing records obtained under Title III. See 52 U.S.C. § 20704. So the Defendants’ argument
holds no water at all. In sum, DOJ’s disclosures of SVRLs to its contractors exceed the bounds of
Routine Use Eight and transgress Title III’s limitations on disclosure.
Second, the Defendants argue that they can disclose records to federal agencies under the
2003 SORN’s first routine use. Cross-Mot. & Opp’n at 44. Routine Use One states:
In the event that a record in this system, either alone or in conjunction with other
information, indicates a violation or potential violation of law—criminal, civil, or
regulatory in nature—the relevant records may be referred to the appropriate
Federal, State, local, foreign, or Tribal law enforcement authority or other
appropriate agency charged with the responsibility for investigating or prosecuting
such violation or charged with enforcing or implementing such law[.]
68 Fed. Reg. 47611. According to the Defendants, Routine Use One authorizes disclosures to ICE
(a component of DHS) because it is responsible for investigating immigration-law violations and
“the voter lists indicate the presence of aliens[.]” Cross-Mot. & Opp’n at 44. But ICE’s
responsibility for immigration enforcement is not dispositive. The record reflects that the Civil
Rights Division is “disclosing entire SVRLs with records of millions of voters” to ICE. Reply &
Cross-Opp’n at 40; see Cross-Mot. & Opp’n at 44 (arguing that the Division can disclose “the
voter lists” to ICE and explaining that ICE requested “the entirety of the voter rolls”); CRT-3398
(letter from ICE requesting that “the Department of Justice provide HSI with the public Statewide
Voter Registration Lists (SVRLs) in its possession”). And Routine Use One authorizes disclosure
only “[i]n the event that a record . . . indicates a violation or potential violation of law[.]”
68 Fed. Reg. 47611. The Defendants cannot rely on that routine use for mass disclosures to ICE
with no indication whatsoever that there has been a violation of immigration law. And it should
come as no surprise to the Civil Rights Division that registering to vote, on its own, does not
indicate voter fraud.
65
Third, the Defendants contend that the second routine use permits disclosures to USCIS.
Routine Use Two provides:
In the course of the administration by [the Civil Rights Division] of a federally
mandated program, or the investigation or litigation of a case or matter, a record
may be disseminated to a Federal, State or local agency . . . if there is reason to
believe that such agency, individual or organization possesses information or has
the expertise in an official or technical capacity to assist in the administration of
such program or to analyze information relating to the investigation, trial or hearing
and the dissemination is reasonably necessary to elicit such assistance, information
or expert analysis[.]
68 Fed. Reg. 47611. According to the Defendants, the Civil Rights Division requested USCIS’s
expertise—gained from its management of SAVE—to aid in the Division’s investigations of
potential NVRA and HAVA violations. Cross-Mot. & Opp’n at 45. And the record, which includes
the memorandum of agreement establishing the Division’s dissemination of information to USCIS,
shows that USCIS agreed to provide “operating instructions,” “point of contact information for
questions or problems,” and “access to training and information” for the SAVE database. CRT33. The Court agrees that this type of technical assistance would “assist in the administration” of
“investigation[s] or litigation,” 68 Fed. Reg. 47611, but the Defendants do not explain why USCIS
needs access to entire SVRLs to provide it. And again, the plain text of the routine use seems to
contemplate the disclosure of individual records for a specific “investigation, trial or hearing,” id.,
not wholesale disclosure of millions of voter registration records. So Routine Use Two does not
help the Defendants either.
ii. Law Enforcement Exception
The Defendants separately invoke the Privacy Act’s law enforcement exception to justify
the Civil Rights Division’s disclosures to ICE. That exception allows disclosure to a state or federal
agency “for a civil or criminal law enforcement activity if the activity is authorized by law, and if
the head of the agency or instrumentality has made a written request to the agency which maintains
66
the record specifying the particular portion desired and the law enforcement activity for which the
record is sought[.]” 5 U.S.C. § 552a(b)(7). The Defendants point to a letter from the acting head
of ICE to the head of DOJ’s Civil Rights Division, stating that HSI (an ICE component) was
“undertaking a Voter Fraud Initiative to ensure the integrity of the electoral process within its
authority” and “formally request[ing] the Department of Justice provide HSI with the public
Statewide Voter Registration Lists (SVRLs) in its possession, in order for HSI to conduct
appropriate investigation of potential violations of federal election law.” CRT-3398. This letter,
the Defendants say, checked all the boxes: (1) it was written by ICE’s acting head, (2) it requested
the portion of records desired—i.e., all SVRLs in DOJ’s possession, and (3) it described ICE’s
planned law enforcement activities. Cross-Mot. & Opp’n at 44. The Defendants are correct about
the first and the third, but not the second. The law enforcement exception does not permit the
disclosure of all SVRLs.
The phrase “particular portion” is most naturally read as encompassing part, not all, of a
set of records. As the Supreme Court explained in interpreting the phrase “portion, split, or
percentage” in a different statute, the phrase “‘portion’ or ‘percentage’ can be used to include the
entirety, or 100 percent. But that is not the normal meaning of ‘portion’ . . . as dictionary
definitions uniformly show.” Freeman v. Quicken Loans, Inc., 566 U.S. 624, 633–34 (2012)
(citations omitted). The Court relied on definitions of “portion” as “[a]n allotted part; a share; a
parcel; a division in a distribution[;] . . . [a] part of a whole,” as “[t]he part (of anything) allotted
or belonging to one person; a share[;] . . . [a] part of any whole,” and as “[a] section or quantity
within a larger thing; a part of a whole[.]” Id. at 634 n.6 (first quoting Webster’s New International
Dictionary at 1924 (2d ed. 1954); then quoting 12 Oxford English Dictionary at 154–55 (2d ed.
1989); and then quoting American Heritage Dictionary at 1373 (5th ed. 2011)); see also Portion,
67
Cambridge Dictionary, https://dictionary.cambridge.org/us/dictionary/english/portion (“[A] part
or share of something larger[.]”). It follows, then, that an agency may not use the law enforcement
exception to turn over all records in its possession.
The legislative history of the Privacy Act confirms this common sense understanding of
the exception. Congress explained that unlike the routine use exception, the law enforcement
exception was intended to “requir[e] that the agency rule on each request on a case-by-case basis”
to ensure that “secret law enforcement access . . . w[ould] only be permitted in the most exigent
and essential circumstances. In each such case, the agency must find that such circumstances exist
and that the law enforcement agency has described the information requested in sufficient
particularly [sic] to meet the requirements of the [law enforcement exception].” S. Rep. No. 93-1183 at 73 (1974). If “portion” were read to include “whole,” the “particular portion” requirement
in the exception would be little more than window dressing. “When reading statutes, [courts]
presume that Congress did not include words that have no effect, and so [courts] generally avoid
a reading that renders some words altogether redundant.” Solar Energy Indus. Ass’n v. FERC, 154
F.4th 863, 868 (D.C. Cir. 2025) (cleaned up). Heeding that instruction here, the Court declines to
depart from the ordinary meaning of the phrase “particular portion.” It concludes that the law
enforcement exception does not encompass ICE’s request for the entirety of the SVRLs in DOJ’s
possession.
* * *
In sum, the Defendants’ disclosure of voting rolls to contractors and other federal agencies
through the Voter List Maintenance Policy violates the Privacy Act.
68
d. Accuracy Protections
Next up are the Privacy Act’s accuracy requirements. Under the Privacy Act, an agency
must “maintain all records which are used by the agency in making any determination about any
individual with such accuracy, relevance, timeliness, and completeness as is reasonably necessary
to assure fairness to the individual in the determination.” 5 U.S.C. § 552a(e)(5). The Privacy Act
also mandates that agencies “make reasonable efforts to assure that such records are accurate,
complete, timely, and relevant for agency purposes” before “disseminating” them “to any person
other than a[] [federal] agency.” Id. § 552a(e)(6). And it tasks agencies with “establish[ing]
appropriate . . . safeguards . . . to insure the security and confidentiality of records and to protect
against any anticipated threats or hazards to their security or integrity which could result in
substantial harm, embarrassment, inconvenience, or unfairness.” Id. § 552a(e)(10).
The Plaintiffs contend that the Defendants have violated these provisions by failing to make
“reasonable efforts” to ensure that the Civil Rights Division’s Central Index File is accurate. The
argument goes like this: DOJ is using the modified SAVE database to update its records, and given
that SAVE does not always accurately reflect the voter eligibility status of individuals, SAVE is
introducing errors into the Central Index File. Mot. at 31–32. Indeed, the record reflects that
SAVE’s ability to verify citizenship—and particularly the citizenship of acquired or naturalized
citizens—is limited. See, e.g., CRT-32; Hill Decl. Ex. 17 at 216 (SSA-AR-44) (Statement of Work
between SSA and USCIS noting that “some . . . citizenship information in SSA’s records might
not be current” because “[t]here is no obligation for an individual to report to SSA a change in
their citizenship or immigration status until they request a replacement card or file a claim for a
Social Security benefit” and acknowledging that “SSA is not the custodian of U.S. citizenship
records”); Hill Decl. Ex. 18 at 237 (SSA-AR-0103) (same); Hill Decl. Ex. 19 at 245–46 (2023
69
letter from SSA stating that “the citizenship SSA maintains merely represents a snapshot of the
individual’s citizenship status at the time of their interaction with SSA,” acknowledging that
“SSA’s records do not provide definitive information about an individual’s citizenship status,” and
noting that “SSA’s assessment of its citizenship data indicates that approximately ¼ of those
records do not have an indication of citizenship present”); Hill Decl. Ex 20 at 253–54 (2006 report
from SSA’s Office of Inspector General stating that the auditors were “particularly concerned with
the extent of incorrect citizenship information in SSA’s Numident file for the foreign-born U.S.
citizens and non-U.S. citizens [auditors] tested” and finding that seven percent of people classified
as noncitizens by SSA were in fact citizens—totaling approximately 3.3 million people (footnote
omitted)).
And those defects are known to the Defendants. See, e.g., CRT-32 & n.2 (memorandum of
agreement between USCIS and DOJ’s Civil Rights Division acknowledging that modified “SAVE
may only be able to verify acquired U.S. citizen in certain situations”); Hill Decl. Ex. 17 at 216
(SSA-AR-44) (noting the potential inaccuracy of SSA citizenship records); Hill Decl. Ex. 18
at 237 (SSA-AR-0103) (same). Based on the administrative record, the Court can only conclude
that the Defendants’ choice to update the Central Index File—a law enforcement database—with
inaccurate information was fundamentally unreasonable.
This is particularly true given what is at stake. The Civil Rights Division uses the Central
Index File to further its investigations. See, e.g., 68 Fed. Reg. 47611 (explaining that the purposes
of the Central Index File are to “maintain[] names of [Civil Rights] Division employees and their
case investigation assignments, names of defendants or investigation targets, victims, witnesses or
potential witnesses, or other persons or organizations as they relate to potential or actual cases,
investigations, and matters of concern to [the Civil Rights Division]”). The database is an
70
important feature of the Voter List Maintenance Policy, which seeks to identify individuals for
termination from state voter rolls. Those consequences are not hypothetical. The “substantial harm,
embarrassment, inconvenience, or unfairness,” 5 U.S.C. § 552a(e)(10), that could result from
misidentification is borne out by the record. The Plaintiff Anthony Nel, an acquired citizen, attests
that his voter registration was cancelled because of an erroneous SAVE result. Nel Decl. ¶¶ 13–
26, Ex. 1. The same happened to Common Cause member Bailey Doe, a naturalized citizen. B.
Doe Decl. ¶¶ 5, 11–17, 22–27, Ex. 2. And Alex Doe (also an acquired citizen) was required to
provide documentary proof of citizenship following an erroneous SAVE result. A. Doe Decl. ¶¶ 5–
14, 17–19, Ex. 1.
The Defendants insist that the Privacy Act does not demand perfection, and they note that
Congress authorized SAVE’s creation and use by other agencies. Cross-Mot. & Opp’n at 45–46.
True enough, but the Privacy Act uncontroversially requires agencies to “make reasonable efforts
to assure that [] records are accurate, complete, timely, and relevant” before disclosing them
outside the federal government—including to states. 5 U.S.C. § 552a(e)(6). On this record, the
Defendants have not done that. Because they have taken no steps to ensure the accuracy of the
Central Index File, they have violated the Privacy Act.
e. First Amendment Protected Records
Rounding out their Privacy Act claims, the Plaintiffs claim that the Defendants’ storage
and dissemination of SVRLs pursuant to the Voter List Maintenance Policy violate the Act’s
stricture that agencies must “maintain no record describing how any individual exercises rights
guaranteed by the First Amendment unless expressly authorized by statute or by the individual
about whom the record is maintained or unless pertinent to and within the scope of an authorized
71
law enforcement activity[.]” 5 U.S.C. § 552(e)(7). The Privacy Act defines “maintain” to
“include[] maintain, collect, use, or disseminate[.]” Id. § 552a(a)(3).
The Defendants do not appear to contest that SVRLs are First Amendment protected
records. See Cross-Mot. & Opp’n at 46–47 (arguing that DOJ has not violated Section 552(e)(7)
because its requests and maintenance of the SVRLs were “expressly authorized by statute” and
related to an “authorized law enforcement activity”); Cross-Reply at 25–26 (same). That comes as
no surprise given that “voter registration, participation in elections, as well as party affiliation are
all types of political expression protected by the First Amendment.” Weber, 816 F. Supp. 3d
at 1193 (first citing Buckley v. Am. Const. L. Found., Inc., 525 U.S. 182, 195 (1999); and then
citing Rutan v. Republican Party of Ill., 497 U.S. 62, 69 (1990)); see also Eu v. San Francisco
Cnty. Democratic Cent. Comm., 489 U.S. 214, 224 (1989) (“Freedom of association means . . .
that an individual voter has the right to associate with the political party of her choice[.]” (citing
Tashjian v. Republican Party of Conn., 479 U.S. 208, 214 (1986))). Instead, the Defendants offer
two responses. They first reassert their argument that maintenance of the SVRLs under the Voter
List Maintenance Policy is “expressly authorized by” the Civil Rights Act, the NVRA, and HAVA.
Cross-Reply at 25 (quoting 5 U.S.C. § 552a(e)(7)). The Court has already rejected that argument.
See supra Discussion § C.1. But even if those statutes authorized DOJ to obtain SVRLs from
states, they do not authorize DOJ to disseminate the SVRLs, which Section 552(e)(7)
independently prohibits. Cf. Cruz, 596 U.S. at 301 (“An agency . . . literally has no power to act
. . . unless and until Congress authorizes it to do so by statute.” (cleaned up)). So the Defendants’
statutory-authority argument fails.
Second, the Defendants contend that the Voter List Maintenance Policy is “within the
scope of an authorized law enforcement activity[.]” 5 U.S.C. § 552(e)(7). To be sure, the D.C.
72
Circuit has construed the phrase “law enforcement activity” “broadly” when interpreting
Section 552(e)(7). Maydak v. United States, 363 F.3d 512, 517 (D.C. Cir. 2004). It has held, for
instance, that it “includes an authorized criminal, intelligence, or administrative investigation.” Id.
(characterizing Nagel v. Dep’t of Health, Educ. & Welfare, 725 F.2d 1438, 1441 n.3 (D.C. Cir.
1984)). But the D.C. Circuit has also “require[d] greater specificity” from agencies relying on the
law enforcement exception to ensure that agencies do not “simply . . . invok[e] a need to maintain
records for generic investigative and informative purposes.” Maydak, 363 F.3d at 517.
Here, the Defendants invoke little more than “generic investigative . . . purposes.” Id. They
seek to investigate every single registered voter without any specific reason to believe that they
committed voter fraud or that their state violated the NVRA or HAVA. The Defendants resist this
conclusion, complaining that the “Plaintiffs apparently want DOJ to investigate States based on no
information whatsoever about whether their list maintenance activities are reasonable and
effective.” Cross-Reply at 25. They are wrong. No one—and perhaps least of all the Plaintiffs—
wants DOJ to set out on that sort of fishing expedition. Instead, DOJ may continue to investigate
violations of the NVRA and HAVA within the confines of its statutory authorities—including by
acting on specific complaints, as the record demonstrates that it has done in certain instances. See,
e.g., CRT-2432; CRT-3226–27. But DOJ cannot evade the Privacy Act’s free-speech protections
by attempting a dragnet investigation of the entire country. There is no doubt that DOJ’s Voter
List Maintenance Policy violates the Privacy Act’s prohibition on maintaining records of protected
First Amendment activity.
4. Contrary to Law (PRA)
Finally, the Plaintiffs argue that the Defendants have violated the PRA, which requires that
agencies comply with certain procedural requirements when they “conduct or sponsor [a]
73
collection of information[.]” 44 U.S.C. § 3507(a). And again, courts must “hold unlawful and set
aside” agency action that is “otherwise not in accordance with law” or “without observance of
procedure required by law.” 5 U.S.C. §§ 706(2)(A), (D).
The Defendants do not attempt to show compliance with the PRA’s procedural
requirements, so the only question is whether the Voter List Maintenance Policy involved a
“collection of information” under the PRA. The statute defines the “collection of information” as
“the obtaining, causing to be obtained, soliciting, or requiring the disclosure to third parties or the
public, of facts or opinions by or for an agency, regardless of form or format, calling for . . .
answers to identical questions posed to, or identical reporting or recordkeeping requirements
imposed on, ten or more persons[.]” 44 U.S.C. § 3502(3). The phrase “person” includes states. Id.
§ 3502(10). And the PRA excludes the “collection of information” “during the conduct of a
Federal criminal investigation or prosecution,” “a civil action to which the United States or any
official or agency thereof is a party[,]” or “an administrative action or investigation involving an
agency against specific individuals or entities[.]” Id. § 3518(c)(1). But the PRA applies to “the
collection of information during the conduct of general investigations . . . undertaken with
reference to a category of individuals or entities such as a class of licensees or an entire industry.”
Id. § 3518(c)(2).
The Defendants rest their opposition to the PRA’s applicability on three theories. First,
they claim that because the letters sent to states were not “identical,” no collection of information
covered by the PRA took place. Cross-Mot. & Opp’n at 48. To be sure, the administrative record
reveals differences among the letters that DOJ sent to every state. But the Voter List Maintenance
Policy clearly imposed an identical reporting requirement on each state by demanding that each
state produce its SVRL. See Cross-Mot. & Opp’n at 5–6, 8. Variation in the letters’ additional
74
questions or requests does not alter the fact that each letter asks for a common piece of data: the
state’s voter rolls. Cf. Hyatt v. OMB, 998 F.3d 423, 429 n.4 (9th Cir. 2021) (noting that a collection
of information under the PRA does not require the use of “standardized forms”). So the
Defendants’ first line of defense does not excuse their noncompliance with the PRA.
Second, the Defendants argue that the letters are not covered by the PRA because they do
not pose “questions” under Section 3502(3). Cross-Mot. & Opp’n at 48. The Parties go back and
forth on the meaning of that word in the statute. Reply & Cross-Opp’n at 45; Cross-Reply at 26.
But the Court need not resolve their dispute because the Voter List Maintenance Policy imposes
an identical “reporting” requirement on all states, which brings the policy into the ambit of the
PRA anyway.
And as the Plaintiffs correctly note, even if the NVRA or HAVA imposes the
recordkeeping requirements under which states maintain their voter rolls, nothing in those statutes
requires states to report or otherwise provide their voter rolls to DOJ. See Reply & Cross-Opp’n
at 45 & n.24. Thus, the Voter List Maintenance Policy purports to require states to report
information to DOJ, imposing a new collection of information without observance of the PRA’s
procedures.
Finally, the Defendants seek refuge in Section 3518(c)’s safe harbor for investigative or
enforcement activity. But they find no shelter there because the Voter List Maintenance Policy is
a “general investigation” under Section 3518(c)(2). The Defendants argue otherwise, relying on
the OLC memorandum’s description of a “general investigation” as “an investigation of the group
as a group rather than a widespread investigation of such a group or industry’s members.” CrossReply at 26 (citing CRT-3362). That reading stretches the statute’s text beyond recognition. The
Voter List Maintenance Policy—which was self-admittedly designed to “assess states’ VRLs,”
75
e.g., CRT-2; CRT-2037—is an investigation of the entire class of entities regulated by the NVRA
and HAVA. The policy is in no sense directed against “specific individuals or entities.” Contra
44 U.S.C. § 3518(c)(1)(B)(ii). Instead, it was “undertaken with reference to” all states, “a category
of individuals or entities.” Id. § 3518(c)(2). Thus, the Defendants cannot escape the reach of the
PRA; they plainly violated the statute when they obtained and compiled SVRLs under the Voter
List Maintenance Policy without complying with the PRA’s procedural requirements. 20
REMEDIES
The APA requires that a “reviewing court shall . . . hold unlawful and set aside agency
action” that is in excess of statutory authority, contrary to law, unconstitutional, arbitrary and
capricious, or procedurally defective. 5 U.S.C. § 706(2)(A)–(D) (emphasis added). Having
concluded that the Voter List Maintenance Policy exceeds DOJ’s statutory authority in numerous
respects, is arbitrary and capricious, and is contrary to law, the Court must set it aside. Cf. Ctr. for
Biological Diversity v. Zeldin, 171 F.4th 356, 382 (D.C. Cir. 2026) (“When an agency’s action is
unlawful, vacatur is the normal remedy.” (cleaned up)). 21
The Defendants say that this Court must “narrowly tailor[]” its relief under the APA in
accordance with what they describe as “equitable limitations.” Cross-Mot. & Opp’n at 53–55.
They argue that in crafting a remedy, this Court “may administer complete relief between the
parties,” but nothing more. Cross-Mot. & Opp’n at 53–54 (quoting Trump v. CASA, Inc., 606 U.S.
20
Because the Court concludes that the Voter List Maintenance Policy is unlawful on statutory grounds, it need not reach the Plaintiffs’ constitutional claims. United States v. Gaffney, 812 F. Supp. 3d 49, 81 (D.D.C. 2025) (“[C]ourts ‘ought not to pass on questions of constitutionality unless such adjudication is unavoidable.’” (quoting Matal v. Tam, 582 U.S. 218, 231 (2017))). 21
The Plaintiffs sought injunctive relief in the alternative. See Mot. at 43. Because vacatur of the challenged policy is appropriate, the Court does not address the propriety of additional injunctive relief. Cf. Monsanto Co. v. Geertson Seed Farms, 561 U.S. 139, 165 (2010) (stating that a court reviewing agency action under the APA should not issue injunctive relief unless doing so would have “meaningful practical effect independent of [] vacatur” of the challenged action).
76
831, 851 (2025)). But such a limitation is entirely absent from the text of the APA. See Refugee &
Immigrant Ctr. for Educ. & Legal Servs. v. Noem, 793 F. Supp. 3d 19, 104 (D.D.C. 2025), aff’d
sub nom. Refugee & Immigrant Ctr. for Educ. & Legal Servs. v. Mullin, 174 F.4th 81 (D.C. Cir.
2026). Although CASA articulated the complete relief principle on which the Defendants rely, it
expressly declined to “resolve[] the distinct question whether the Administrative Procedure Act
authorizes federal courts to vacate federal agency action.” 606 U.S. at 847 n.10. And even after
CASA, the D.C. Circuit has noted that “[t]he Supreme Court regularly, repeatedly, and recently has
applied Section 706[] to provide universal relief under the APA.” Make the Rd. New York v. Noem,
No. 25-5320, 2025 WL 3563313, at *36 (D.C. Cir. Nov. 22, 2025) (statement of Millett and
Childs, JJ.) (first citing Regents, 591 U.S. at 36 & n.7; then citing Whitman, 531 U.S. at 486; and
then citing Bd. of Governors of Fed. Reserve Sys. v. Dimension Fin. Corp., 474 U.S. 361, 364–365
(1986)); see also Corner Post, Inc. v. Bd. of Governors of Fed. Rsrv. Sys., 603 U.S. 799, 838 (2024)
(Kavanaugh, J., concurring) (explaining that the APA authorizes universal vacatur of unlawful
agency actions). So even after CASA, the “ordinary” remedy for unlawful agency action remains
that the actions “are vacated—not that their application to the individual petitioners is proscribed.”
Harmon v. Thornburgh, 878 F.2d 484, 495 n.21 (D.C. Cir. 1989).
Accordingly, the Court sets aside and vacates DOJ’s Voter List Maintenance Policy.
77
CONCLUSION
For the foregoing reasons, the Court grants the Plaintiffs’ Motion for Partial Summary
Judgment, ECF No. 29, and denies the Defendants’ Cross-Motion for Summary Judgment and
Motion to Dismiss, ECF No. 32.
A separate order will issue.
SPARKLE L. SOOKNANAN
United States District Judge
Date: October 9, 2026
78