EPIC v. Commerce (Census Privacy)
EPIC v. Department of Commerce, No. 18-2711 (D.D.C. filed Nov. 20, 2018), is a lawsuit to block the unlawful collection of personal data concerning citizenship status via the 2020 Census. In March of 2018, the Department of Commerce and U.S. Census Bureau announced the addition of a citizenship question to the decennial census for the first time in 70 years. The controversial question, which members of the public are required by law to answer, would compel the disclosure of personally identifiable information from hundreds of millions of people.
The collection of citizenship status information poses major privacy risks and threatens to undermine the quality of census response data. Yet the Commerce Department and Census Bureau did not conduct a privacy impact assessment prior to initiating the data collection process, as required by the E-Government Act of 2002. As a result, the agencies have failed to disclose key information about the privacy implications of collecting citizenship data and have unlawfully placed the privacy of census respondents at risk.
EPIC's lawsuit, brought under the E-Government Act and the Administrative Procedure Act, seeks to halt the collection of citizenship data and to compel the Commerce Department and Census Bureau to comply with their privacy impact assessment obligations. On January 18, 2019, EPIC filed a motion for a preliminary injunction to block implementation of the citizenship question pending a final ruling on EPIC's claims. "Congress expected that the Bureau would conduct a comprehensive privacy review early in the process, not as the census forms were heading to the printer or delivered to the post office," EPIC told the court.
On February 8, 2019, the district court denied EPIC's motion. The court acknowledged that the Census Bureau must prepare privacy impact assessments which "adequately address the collection of citizenship data in the 2020 Census” and noted that “negative policy consequences” could result “if an agency drags its feet in performing its PIA obligations.” Nevertheless, the court held that the Bureau may drag its feet in conducting the required assessments “until the Bureau mails its first batch of Census questionnaires to the public” in 2020.
On February 12, 2019, EPIC appealed the district court's denial of EPIC's motion for a preliminary injunction. On February 26, the U.S. Court of Appeals for the D.C. Circuit granted EPIC's motion to expedite the appeal. EPIC filed an opening brief on March 1. The government filed a response on April 1, and EPIC filed a reply on April 11. Oral argument is scheduled for May 8, 2019 at 9:30 a.m.
- EPIC to Appropriations Committees: Suspend the Census Citizenship Question: EPIC has sent a statement to the House and Senate regarding the FY2020 appropriations for the Department of Commerce. EPIC urged Congress to require the Census Bureau to remove the citizenship question from the 2020 census, pending the completion of legally required Privacy Impact Assessments. EPIC told the committees that the Census Bureau failed to complete the Privacy Impact Assessments required by Section 208 of the E-Government Act. The Census Bureau concedes that it must complete the impact assessments but has so far failed to do so. "Congress made clear that data collection simply could not occur without the completion of these assessments," EPIC explained to Congress. In EPIC v. Commerce now before the D.C. Circuit Court of Appeals, EPIC argued that the collection of citizenship data without the privacy impact assessments is unlawful. EPIC warned the federal appeals court that, "major privacy risks have not been addressed by the agency." (Apr. 3, 2019) More top news »
The Citizenship Question
In order to determine the apportionment of representatives "among the several States," the Census Clause of the U.S. Constitution, as amended, requires that an "actual Enumeration" of persons be undertaken every ten years "in such Manner as [Congress] shall by Law direct." To implement the Census Clause, Congress has directed the Secretary of Commerce to "take a decennial census of population" and to "determine the inquiries, and the number, form, and subdivisions" of the questionnaires to be used in the Census. The Census Bureau will administer the next Census in 2020. By law, any person who refuses to answer "any of the questions . . . submitted to him in connection with any census"—or who willfully gives a false answer to a census question—is subject to criminal penalties.
On March 26, 2018, Secretary of Commerce Wilbur L. Ross announced that he "ha[d] determined that reinstatement of a citizenship question on the 2020 decennial census [wa]s necessary" and that he was "directing the Census Bureau to place the citizenship question last on the decennial census form." No citizenship question appeared on the 2010 Census, nor has the Census Bureau posed a citizenship question to all census respondents since the 1950 Census. On March 28, 2018, the Census Bureau officially reported to Congress the Bureau's intention to add a citizenship question to the 2020 Census, phrased as follows:
Secretary Ross stated that the addition of the citizenship question was in response to a December 2017 request by the Department of Justice, which purportedly sought citizenship data to enable "more effective enforcement" of the Voting Rights Act. The DOJ's request raised alarm and opposition from members of the U.S. Senate, the attorneys general of at least twenty states, and numerous mayors from across the country. Moreover, Secretary Ross's explanation for his decision is at odds with his subsequent statement that he communicated with Chief White House strategist Steve Bannon and Kansas Secretary of State Kris Kobach about the citizenship question months before the DOJ made a request.
Although the Census Bureau's collection of personally identifiable information carries inherent privacy risks, the addition of a citizenship question on the 2020 Census poses a special threat to privacy, personal security, and the accuracy of the census. The citizenship question would compel the release of respondents' citizenship status (and potentially immigration status), which could in turn expose individuals and their family members to investigation, sanction, and deportation.
Secretary Ross's asserted basis for adding the citizenship question was to provide the DOJ with "census block level citizen voting age population ('CVAP') data,"—data that is susceptible to reidentification. The Bureau has indicated that census response data—including individuals' citizenship status information—may be transferred in "[b]ulk" to other federal agencies "[f]or criminal law enforcement activities. In a June 12, 2018 email exchange between DOJ officials, disclosed in the course of litigation against Secretary Ross, DOJ officials "privately discussed the possibility that in the future census information could be shared with law enforcement."
Historically, the misuse of census data has caused grave harm to certain populations. For example, the 1910 census law prohibited the use of information supplied by businesses for non-statistical, non-census purposes, but there was no such prohibition regarding individual citizen data. As a result, during World War I, the Census Bureau did in fact disclose census records to the Department of Justice and local draft boards to help enforce the draft. Similarly, in 1920, the Department of Justice requested census data about individuals’ citizenship for use in deportation cases. In 1930, Congress passed the census law that would become known as Title 13, which prohibited the Census Bureau from publishing any data identifying individuals. However, the Second War Powers Act weakened this restriction and permitted the Census Bureau in 1943 to provide the U.S. Secret Service with the names, addresses, occupations, and citizenship status of every Japanese American residing in the Washington, D.C. area. The Census Bureau also provided the War Department with census-block level data on Japanese Americans residing in western states to facilitate their internment.
In 2004, an EPIC Freedom of Information Act (FOIA) request revealed that the Census Bureau had provided the Department of Homeland Security with a list of cities containing more than 1,000 Arab-American residents and a zip-code level breakdown of Arab-American populations throughout the United States, sorted by country of origin. While the Census Bureau and Customs and Border Protection revised their data request policies following EPIC’s FOIA case, many Americans are justifiably fearful that their census responses will be used against them by other federal agencies, which can lead individuals to provide false or incomplete information.
Under Section 208 of the E-Government Act of 2002, any agency that "initiat[es] a new collection of information that . . . will be collected, maintained, or disseminated using information technology" is required to complete a privacy impact assessment (PIA) before doing so. Specifically, the agency must "(i) conduct a privacy impact assessment; (ii) ensure the review of the privacy impact assessment by the Chief Information Officer, or equivalent official, as determined by the head of the agency; and (iii) if practicable, after completion of the review under clause (ii), make the privacy impact assessment publicly available through the website of the agency, publication in the Federal Register, or other means."
The aim of Congress in enacting the E-Government Act was “[t]o make the Federal Government more transparent and accountable” and “to ensure sufficient protections for the privacy of personal information[.]” Thus, a privacy impact assessment must be "commensurate with the size of the information system being assessed, the sensitivity of information that is in an identifiable form in that system, and the risk of harm from unauthorized release of that information." The PIA must specifically address "(I) what information is to be collected; (II) why the information is being collected; (III) the intended use of the agency of the information; (IV) with whom the information will be shared; (V) what notice or opportunities for consent would be provided to individuals regarding what information is collected and how that information is shared; [and] (VI) how the information will be secured."
Despite these explicit obligations under the E-Government Act, the Census Bureau and Department of Commerce failed to conduct any privacy impact assessment addressing the privacy risks of collecting citizenship status information. According to the Census Bureau, census response data is collected, maintained, and disseminated by at least five different IT systems: CEN05, CEN08, CEN11, CEN13, and CEN05. Yet none of the current PIAs for these systems assess the risks of collecting citizenship information, and three of the five fail to acknowledge that citizenship information will be collected at all. The Census Bureau and Commerce Department have therefore unlawfully ignored the privacy harms caused by the citizenship question.
EPIC has long highlighted the obligation of federal agencies to conduct and publish a privacy impact assessment before any new collection of personal data, and EPIC has brought numerous successful cases seeking the release of PIAs. In EPIC v. DHS, No. 11-2261 (D.D.C. filed Dec. 20, 2011), EPIC obtained a PIA and related records concerning a prior effort by the DHS to track social media users and journalists. In EPIC v. FBI, No. 14-1311 (D.D.C. filed Aug. 1, 2014), EPIC obtained unpublished PIAs from the Federal Bureau of Investigation concerning facial recognition technology. And in EPIC v. DEA, No. 15-667 (D.D.C. filed May 1, 2015), EPIC learned that the Drug Enforcement Administration had failed to produce PIAs for the agency's license plate reader program, a telecommunications records database, and other systems of public surveillance.
More recently, in EPIC v. Presidential Advisory Commission on Election Integrity, No. 17-1320 (D.D.C. filed July 3, 2017), EPIC challenged the failure of the Presidential Advisory Commission on Election Integrity to undertake and publish a PIA prior to the collection of state voter data. EPIC's suit led the now-defunct Commission to suspend its data collection and later delete all of the voter information that had been illegally obtained. In EPIC v. DHS, No. 18-1268 (D.D.C. filed May 30, 2018), EPIC is currently seeking to block the development of a Department of Homeland Security system designed to monitor journalists. EPIC's suit led the DHS to admit that it had not conducted a privacy impact assessment, as required by law.
EPIC has also been a longtime advocate of robust privacy protections for census respondents. EPIC was directly involved in the 2004 effort to revise the Census Bureau “sensitive data” policy after an EPIC FOIA lawsuit revealed that the DHS had acquired data on Arab Americans from the Census Bureau after 9/11. In formal comments to the Census Bureau and a statement to the Senate Committee on Homeland Security and Government Affairs, EPIC opposed the decision to add a citizenship question to the 2020 census. And in October 2018, EPIC filed an amicus brief in New York v. Department of Commerce, a separate case challenging the citizenship question. EPIC explained the special privacy risks of collecting citizenship status information and highlighted the Census Bureau's failure to conduct an adequate privacy impact assessment. On January 15, 2019, the court in that case ruled that the decision to add the citizenship question was unlawful under the Administrative Procedure Act and enjoined the government from including the question on the 2020 Census.
EPIC v. Dep't of Commerce, No. 18-2711 (D.D.C. filed Nov. 20, 2018)
- EPIC Complaint (Nov. 20, 2018)
- EPIC Motion for a Preliminary Injunction & Memorandum (Jan. 18, 2019)
- Proposed Order
- Exhibit List
- Exhibit 1
- Exhibit 2
- Exhibit 3
- Exhibit 4
- Exhibit 5
- Exhibit 6
- Exhibit 7
- Exhibit 8
- Exhibit 9
- Exhibit 10
- Exhibit 11
- Exhibit 12
- Exhibit 13
- Exhibit 14
- Exhibit 15
- Exhibit 16
- Exhibit 17
- Exhibit 18
- Exhibit 19
- Order Scheduling Hearing (Jan. 18, 2019)
- Revised Hearing Schedule (Jan. 22, 2019)
- Government Motion for Stay or Extension (Jan. 22, 2019)
- Order Denying Stay and Granting Extension in Part (Jan. 23, 2019)
- Government's Opposition to Motion for a Preliminary Injunction (Jan. 30, 2019)
- EPIC Reply in Support of Motion for a Preliminary Injunction (Feb. 5, 2019)
- Minute Order Concerning Hearing (Feb. 6, 2019)
- Memorandum Opinion (Feb. 8, 2019)
- Government's Motion to Dismiss (Mar. 11, 2019)
- EPIC's Opposition to Motion to Dismiss (Apr. 1, 2019)
- Government Reply in Support of Motion to Dismiss (Apr. 11, 2019)
EPIC v. Dep't of Commerce, No. 19-5031 (D.C. Cir. appeal docketed Feb. 21, 2019)
- EPIC Motion to Expedite Briefing Schedule (Feb. 21, 2019)
- Government Response to Motion to Expedite Briefing Schedule (Feb. 22, 2019)
- Order Granting Expedited Briefing Schedule (Feb. 26, 2019)
- EPIC Opening Brief (Mar. 1, 2019)
- Order Scheduling Oral Argument (Mar. 12, 2019)
- Government Brief (Apr. 1, 2019)
- EPIC Reply (Apr. 8, 2019)
- Corinne Ramey, Census Can’t Ask About Citizenship, Judge Rules, Wall Street Journal (Jan. 15, 2019)
- Tara Bahrampour, Judge denies Trump administration request for emergency halt to census citizenship trial, Wash. Post (Nov. 20, 2018)
- Tara Bahrampour, EPIC Challenges Citizenship Question on 2020 Census, Bloomberg Law (Nov. 20, 2018)
- California v. Ross, No. 18-1865 (N.D. Cal. filed March 26, 2018)
- New York v. Dep’t of Commerce, No. 18-2921 (S.D.N.Y. filed Apr. 3, 2018)
- Kravitz v. Dep't of Commerce, No. 18-1041 (D. Md. filed Apr. 11, 2018)
- City of San Jose v. Ross, No. 18-2279 (N.D. Cal. filed Apr. 17, 2018)
- La Union del Pueblo Entero v. Ross, No. 18-1570 (D. Md. filed May 31, 2018)
- New York Immigration Coal. v. Dep't of Commerce, No. 18-5025 (S.D.N.Y. filed June 6, 2018)