Privacy Cases

EPIC v. Commerce (Census Privacy)

928 F.3d 95 (D.C. Cir. 2019)

US District Court for the District of Columbia

DOWNLOAD EPIC-v-Commerce-Dept-complaint-112018 pdf 543.0KB

EPIC v. Department of Commerce, No. 18-2711 (D.D.C. filed Nov. 20, 2018), is a lawsuit to block the unlawful collection of personal data concerning citizenship status via the 2020 Census. In March of 2018, the Department of Commerce and U.S. Census Bureau announced the addition of a citizenship question to the decennial census for the first time in 70 years. The controversial question, which members of the public are required by law to answer, would have compelled the disclosure of personally identifiable information from hundreds of millions of people.

The collection of citizenship status information poses major privacy risks and threatens to undermine the quality of census response data. Yet the Commerce Department and Census Bureau did not conduct a privacy impact assessment prior to initiating the data collection process, as required by the E-Government Act of 2002. As a result, the agencies failed to disclose key information about the privacy implications of collecting citizenship data and unlawfully placed the privacy of census respondents at risk.

EPIC’s lawsuit, brought under the E-Government Act and the Administrative Procedure Act, sought to halt the collection of citizenship data and to compel the Commerce Department and Census Bureau to comply with their privacy impact assessment obligations. On January 18, 2019, EPIC filed a motion for a preliminary injunction to block implementation of the citizenship question pending a final ruling on EPIC’s claims. “Congress expected that the Bureau would conduct a comprehensive privacy review early in the process, not as the census forms were heading to the printer or delivered to the post office,” EPIC told the court.

On February 8, 2019, the district court denied EPIC’s motion. The court acknowledged that the Census Bureau must prepare privacy impact assessments which “adequately address the collection of citizenship data in the 2020 Census” and noted that “negative policy consequences” could result “if an agency drags its feet in performing its PIA obligations.” Nevertheless, the court held that the Bureau may drag its feet in conducting the required assessments “until the Bureau mails its first batch of Census questionnaires to the public” in 2020.

On February 12, 2019, EPIC appealed the district court’s denial of EPIC’s motion for a preliminary injunction. On February 26, the U.S. Court of Appeals for the D.C. Circuit granted EPIC’s motion to expedite the appeal. EPIC filed an opening brief on March 1. The government filed a response on April 1, and EPIC filed a reply on April 11. Oral argument was held on May 8, 2019. On June 28, 2019, the D.C. Circuit ruled that EPIC lacked Article III standing in the case. The Court counterintuitively held that the E-Government Act—which requires agencies to make privacy impact assessments “publicly available” before undertaking a new collection of data—does not “vest a general right of information in the public.”

On July 11, 2019—following the Supreme Court’s ruling in a related case—President Trump confirmed that the Department of Commerce had permanently withdrawn the citizenship question from the 2020 Census. On August 12, EPIC filed a petition for rehearing, rehearing en banc, or vacatur and remand with the D.C. Circuit. On September 16, the Court denied EPIC’s petition.

EPIC petitioned the U.S. Supreme Court to review the case on December 16, 2019.

Background

The Citizenship Question

In order to determine the apportionment of representatives “among the several States,” the Census Clause of the U.S. Constitution, as amended, requires that an “actual Enumeration” of persons be undertaken every ten years “in such Manner as [Congress] shall by Law direct.” To implement the Census Clause, Congress has directed the Secretary of Commerce to “take a decennial census of population” and to “determine the inquiries, and the number, form, and subdivisions” of the questionnaires to be used in the Census. The Census Bureau will administer the next Census in 2020. By law, any person who refuses to answer “any of the questions . . . submitted to him in connection with any census”—or who willfully gives a false answer to a census question—is subject to criminal penalties.

On March 26, 2018, Secretary of Commerce Wilbur L. Ross announced that he “ha[d] determined that reinstatement of a citizenship question on the 2020 decennial census [wa]s necessary” and that he was “directing the Census Bureau to place the citizenship question last on the decennial census form.” No citizenship question appeared on the 2010 Census, nor has the Census Bureau posed a citizenship question to all census respondents since the 1950 Census. On March 28, 2018, the Census Bureau officially reported to Congress the Bureau’s intention to add a citizenship question to the 2020 Census, phrased as follows:

Secretary Ross stated that the addition of the citizenship question was in response to a December 2017 request by the Department of Justice, which purportedly sought citizenship data to enable “more effective enforcement” of the Voting Rights Act. The DOJ’s request raised alarm and opposition from members of the U.S. Senate, the attorneys general of at least twenty states, and numerous mayors from across the country. Moreover, Secretary Ross’s explanation for his decision was at odds with his subsequent statement that he communicated with Chief White House strategist Steve Bannon and Kansas Secretary of State Kris Kobach about the citizenship question months before the DOJ made a request.

The Privacy Implications of the Citizenship Question

Although the Census Bureau’s collection of personally identifiable information carries inherent privacy risks, the addition of a citizenship question on the 2020 Census posed a special threat to privacy, personal security, and the accuracy of the census. The citizenship question would compel the release of respondents’ citizenship status (and potentially immigration status), which could in turn expose individuals and their family members to investigation, sanction, and deportation.

Secretary Ross’s asserted basis for adding the citizenship question was to provide the DOJ with “census block level citizen voting age population (‘CVAP’) data,”—data that is susceptible to reidentification. The Bureau has indicated that census response data—including individuals’ citizenship status information—may be transferred in “[b]ulk” to other federal agencies “[f]or criminal law enforcement activities. In a June 12, 2018 email exchange between DOJ officials, disclosed in the course of litigation against Secretary Ross, DOJ officials “privately discussed the possibility that in the future census information could be shared with law enforcement.”

Historically, the misuse of census data has caused grave harm to certain populations. For example, the 1910 census law prohibited the use of information supplied by businesses for non-statistical, non-census purposes, but there was no such prohibition regarding individual citizen data. As a result, during World War I, the Census Bureau did in fact disclose census records to the Department of Justice and local draft boards to help enforce the draft. Similarly, in 1920, the Department of Justice requested census data about individuals’ citizenship for use in deportation cases. In 1930, Congress passed the census law that would become known as Title 13, which prohibited the Census Bureau from publishing any data identifying individuals. However, the Second War Powers Act weakened this restriction and permitted the Census Bureau in 1943 to provide the U.S. Secret Service with the names, addresses, occupations, and citizenship status of every Japanese American residing in the Washington, D.C. area. The Census Bureau also provided the War Department with census-block level data on Japanese Americans residing in western states to facilitate their internment.

In 2004, an EPIC Freedom of Information Act (FOIA) request revealed that the Census Bureau had provided the Department of Homeland Security with a list of cities containing more than 1,000 Arab-American residents and a zip-code level breakdown of Arab-American populations throughout the United States, sorted by country of origin. While the Census Bureau and Customs and Border Protection revised their data request policies following EPIC’s FOIA case, many Americans remain justifiably fearful that their census responses will be used against them by other federal agencies, which can lead individuals to provide false or incomplete information.

The Government’s Failure to Publish Required Privacy Impact Assessments

Under Section 208 of the E-Government Act of 2002, any agency that “initiat[es] a new collection of information that . . . will be collected, maintained, or disseminated using information technology” is required to complete a privacy impact assessment (PIA) before doing so. Specifically, the agency must “(i) conduct a privacy impact assessment; (ii) ensure the review of the privacy impact assessment by the Chief Information Officer, or equivalent official, as determined by the head of the agency; and (iii) if practicable, after completion of the review under clause (ii), make the privacy impact assessment publicly available through the website of the agency, publication in the Federal Register, or other means.”

The aim of Congress in enacting the E-Government Act was “[t]o make the Federal Government more transparent and accountable” and “to ensure sufficient protections for the privacy of personal information[.]” Thus, a privacy impact assessment must be “commensurate with the size of the information system being assessed, the sensitivity of information that is in an identifiable form in that system, and the risk of harm from unauthorized release of that information.” The PIA must specifically address “(I) what information is to be collected; (II) why the information is being collected; (III) the intended use of the agency of the information; (IV) with whom the information will be shared; (V) what notice or opportunities for consent would be provided to individuals regarding what information is collected and how that information is shared; [and] (VI) how the information will be secured.”

Despite these explicit obligations under the E-Government Act, the Census Bureau and Department of Commerce failed to conduct any privacy impact assessment addressing the privacy risks of collecting citizenship status information. According to the Census Bureau, census response data is collected, maintained, and disseminated by at least five different IT systems: CEN05, CEN08, CEN11, CEN13, and CEN05. Yet none of the PIAs for these systems assessed the risks of collecting citizenship information, and three of the five failed to acknowledge that citizenship information would be collected at all. The Census Bureau and Commerce Department therefore unlawfully ignored the privacy harms caused by the citizenship question.

EPIC’s Interest

EPIC has long highlighted the obligation of federal agencies to conduct and publish a privacy impact assessment before any new collection of personal data, and EPIC has brought numerous successful cases seeking the release of PIAs. In EPIC v. DHS, No. 11-2261 (D.D.C. filed Dec. 20, 2011), EPIC obtained a PIA and related records concerning a prior effort by the DHS to track social media users and journalists. In EPIC v. FBI, No. 14-1311 (D.D.C. filed Aug. 1, 2014), EPIC obtained unpublished PIAs from the Federal Bureau of Investigation concerning facial recognition technology. And in EPIC v. DEA, No. 15-667 (D.D.C. filed May 1, 2015), EPIC learned that the Drug Enforcement Administration had failed to produce PIAs for the agency’s license plate reader program, a telecommunications records database, and other systems of public surveillance.

More recently, in EPIC v. Presidential Advisory Commission on Election Integrity, No. 17-1320 (D.D.C. filed July 3, 2017), EPIC challenged the failure of the Presidential Advisory Commission on Election Integrity to undertake and publish a PIA prior to the collection of state voter data. EPIC’s suit led the now-defunct Commission to suspend its data collection and later delete all of the voter information that had been illegally obtained. In EPIC v. DHS, No. 18-1268 (D.D.C. filed May 30, 2018), EPIC succeeding in blocking the development of a Department of Homeland Security system designed to monitor journalists.

EPIC has also been a longtime advocate of robust privacy protections for census respondents. EPIC was directly involved in the 2004 effort to revise the Census Bureau “sensitive data” policy after an EPIC FOIA lawsuit revealed that the DHS had acquired data on Arab Americans from the Census Bureau after 9/11. In formal comments to the Census Bureau and a statement to the Senate Committee on Homeland Security and Government Affairs, EPIC opposed the decision to add a citizenship question to the 2020 census. And in October 2018, EPIC filed an amicus brief in New York v. Department of Commerce, a separate case challenging the citizenship question. EPIC explained the special privacy risks of collecting citizenship status information and highlighted the Census Bureau’s failure to conduct an adequate privacy impact assessment. On January 15, 2019, the court in that case ruled that the decision to add the citizenship question was unlawful under the Administrative Procedure Act and enjoined the government from including the question on the 2020 Census. On June 27, 2019, the U.S. Supreme Court affirmed that decision in part and kept the lower court’s injunction in place, leading the administration to permanently withdraw the citizenship question from the census.

EPIC v. Dep’t of Commerce, No. 18-2711 (D.D.C. filed Nov. 20, 2018)

EPIC v. Dep’t of Commerce, No. 19-5031 (D.C. Cir. appeal docketed Feb. 21, 2019)

EPIC v. Dep’t of Commerce, No. 19-5031 (D.C. Cir. appeal docketed Feb. 21, 2019)

Other Documents

News

News

The Fight for Privacy Continues

November 6, 2024

Census Bureau Director Defends Use of Differential Privacy

December 1, 2022

EPIC Urges OSTP to Prioritize Differential Privacy

July 11, 2022

See All News

The Fight for Privacy Continues

November 6, 2024

See All News

Support Our Work

EPIC's work is funded by the support of individuals like you, who allow us to continue to protect privacy, open government, and democratic values in the information age.

Donate