EPIC v. Mullin

Challenging DHS’s unlawful collection and misuse of records describing the First Amendment activity of legal observers and protesters

Summary

In July 2026, EPIC and three legal observers filed suit against the Department of Homeland Security (DHS) challenging its unlawful collection, maintenance, and misuse of sensitive personal information concerning protected First Amendment activity. The plaintiffs are represented by Democracy Forward and Hagens Berman Sobol Shapiro LLP. The lawsuit was filed in the U.S. District Court for the Southern District of California.

Background

Since January of 2025, the Trump Administration has waged a sprawling campaign to deport migrants across the United States. Seeking to reduce immigration levels in the United States by any means necessary, the Trump Administration launched what it refers to as “the most aggressive and successful immigration enforcement overhaul in modern history.”

In response to DHS’s aggressive implementation of this deportation campaign, the individual plaintiffs exercised their First Amendment rights and peacefully observed immigration enforcement activity. In return, DHS officers photographed or identified each of the individual plaintiffs. Shortly thereafter, DHS revoked their Global Entry benefits. Global Entry is a Trusted Traveler Program that expedites clearance for travelers arriving in the United States from abroad.

DHS did this all while rescinding policies that put internal checks on DHS’ ability to surveil Americans engaged in speech and other First Amendment protected activity. These rescissions have muddled or dismantled many of the restrictions DHS previously maintained on collecting records describing Americans’ First Amendment exercise, such as using facial recognition to capture sensitive personal identifying information of protesters. One by one, these limits have been removed, deemed “outdated,” or labeled “archived.”

As of at least late 2025, DHS began “tracking the names of protesters in an internal database.” According to two ICE officials, the records DHS maintains in the database include protesters’ names, photographs, actions that provoked the government’s suspicion (including legal observation or protest activities), locations, and license plates. These records are believed to be maintained in, or accessible through, one or more DHS systems of records including Automated Targeting System (ATS).

For the past two decades, ATS has served as DHS’s platform for storing, maintaining, accessing, and querying information about the movement of people and goods in and out of the United States. DHS uses ATS to vet travelers, transportation crew members such as pilots and flight attendants, and cargo. ATS allows DHS to compare information against law enforcement, intelligence, and other enforcement data. DHS uses this information to conduct risk-based assessments to make border security decisions, such as when particular people or cargo warrant additional screening while in transit. Records in ATS can be disclosed to other government law enforcement agencies, including federal agencies; state, tribal, local, or foreign government agencies; or multilateral government organizations.

The federal government’s collection, maintenance, and use of personal data is governed by the Privacy Act of 1974. The law was passed by Congress after a decade of public debate over the risks of establishing a centralized national data bank, to restore trust in the government’s obligation to respect Americans’ right to privacy. The Act accomplishes this objective by imposing several checks on the government’s ability to compile and maintain records on individual people. Some checks are procedural, including requirements that the government publish certain information about the systems of records it maintains, known as Systems of Records Notice. Other checks impose substantive limits, including prohibiting the government from collecting records describing how a person exercises their First Amendment rights.

Nothing in the ATS SORN, nor in any other SORN pertaining to a DHS system of records, authorizes the maintenance of information describing U.S. citizens’ or legal permanent residents’ First Amendment expression solely because those citizens or legal permanent residents have engaged in that expression.

Plaintiffs’ Lawsuit

On July 23, 2026, EPIC and three individuals filed suit against DHS.

The complaint alleges that the administration has adopted a secret Protester Surveillance Policy to unlawfully collect, retain, and maintain records describing protected First Amendment activity of protestors. The complaint further alleges that DHS has maintained and accessed those records via ATS, whose records can be disclosed to other government law enforcement agencies.

The complaint describes how DHS’ secret policy violates the Privacy Act, which prohibits the federal government from maintaining records describing how individuals exercise their First Amendment rights except in limited circumstances. The Privacy Act requires that agencies publicly disclose and justify when they collect personal information for new reasons or from new groups of people.

EPIC and the individual plaintiffs are challenging the policy as arbitrary, capricious, and unlawful under the Administrative Procedure Act. The complaint alleges that DHS rescinded longstanding internal privacy safeguards so that it could dramatically expand its collection and maintenance of information about people engaged in protected First Amendment activity.

The complaint also alleges that DHS unlawfully retaliated against the individual plaintiffs when they exercised their First Amendment rights.

The complaint asks the court to declare DHS’s surveillance policy unlawful, vacate it, and prohibit DHS from continuing to collect and maintain records describing individuals’ protected First Amendment activities.

“When our government compiles secret dossiers on everyday people for exercising their constitutional rights, it sends a chilling message: if you speak up, watch your back,” said EPIC Deputy Director and Director of Enforcement John Davisson. “If every protest, every recording, every act of dissent opens us up to surveillance and retribution, privacy and free speech are at risk of collapse. But the laws of this nation don’t permit that, and we won’t either.”

EPIC’s Interest

EPIC routinely monitors, analyzes, and educates the public about the collection, use, retention, and transfer of personal information by federal agencies, including large-scale databases and mass surveillance programs.

For decades, EPIC has made extensive use of public notices and records concerning the collection, use, retention, and transfer of personal information by federal agencies. These include Systems of Records Notices mandated by the Privacy Act and Privacy Impact Assessments mandated by section 208 of the E-Government Act.

Since January 2025, EPIC has closely tracked the Trump administration’s efforts to consolidate and increase its access to personal information maintained by federal and state governments. Over that time, EPIC has published analysis, developed public resources, provided expertise to lawmakers and members of the press, undertaken litigation, and engaged in extensive advocacy concerning the privacy, security, and legal risks of the Trump administration’s data consolidation activities.

Case Documents

EPIC, et al. v. Mullin, No. 3-26-cv-04232 (S.D Cal. Filed July 24, 2026)

• Complaint