EPIC v. Commerce: D.C. Circuit Rules Privacy Impact Assessments Not Available to the Public
June 29, 2019
The D.C. Circuit has issued a decision in EPIC v. Commerce, EPIC’s suit to halt the collection of citizenship data in the 2020 Census over the government’s failure to complete required Privacy Impact Assessments. Under the E-Government Act, federal agencies must make Privacy Impact Assessments “publicly available” before undertaking a new collection of personal data. Yet the D.C. Circuit ruled that the statute does not “vest a general right of information in the public” that would allow parties to obtain information about the government’s data collection practices. The court acknowledged that EPIC can sue on behalf of its members, but concluded that one of the leading privacy organizations in the country did not have a legal basis to obtain Privacy Impact Assessments from the federal government. EPIC may appeal the decision.