EPIC v. Commission

Challenging the unlawful collection of personal voter data

Overview

EPIC has filed suit and requested a Preliminary Injunction to block a demand from a Presidential Commission for millions of state voter records. The Commission has failed to conduct and release a Privacy Impact Assessment, as required by Federal law, prior to collecting personal voter data (including SSNs, addresses, dates of birth and other identifying information). The Commission’s demand for detailed voter histories also violates millions of Americans' constitutional right to privacy. The Commission has already committed egregious security blunders, including (1) directing state election officials to send voter records to an unsecure web site and (2) proposing to publish partial SSNs that would enable identity theft and financial fraud. EPIC's lawsuit follows a letter from 50 voting experts and 20 privacy organizations urging state election officials to oppose the Commission’s demand.

The principal case is EPIC v. Commission, No. 17-1320 (D.D.C. filed July 3, 2017). EPIC filed its complaint and motion for a temporary restraining order on Monday, July 3. Judge Colleen Kollar-Kotelly of the U.S. District Court for the District of Columbia held an initial teleconference that day and set an expedited briefing schedule. After EPIC and the Commission filed briefs, the court held an in-person hearing on Friday, July 7. On Monday, July 10, the Commission announced that it would suspend the collection of voter data in response to EPIC's lawsuit. EPIC filed an amended motion on Thursday, July 13 for a temporary restraining order and preliminary injunction. The Commission responded on Monday, July 17, and EPIC filed a reply later that day.

On Monday, July 24, the Court denied EPIC's motion for an injunction, concluding that neither the Commission nor the other government actors involved in collecting state voter data are subject to judicial review under the Administrative Procedure Act. On July 27, EPIC appealed the Court's preliminary decision to the U.S. Court of Appeals for the District of Columbia Circuit (EPIC v. Commission, No. 17-5171 (D.C. Cir. docketed July 27, 2017)). Proceedings are continuting in the District Court, as well.

The Commission's Unlawful Demand for State Voter Records

The Presidential Advisory Commission on Election Integrity ("PACEI") was established on May 11, 2017. The stated purpose of the Commission is to "study the registration and voting processes used in Federal Elections" and to issue a report to the President addressing three specific issues. The Commission shall terminate 30 days after it submits its report to the President.

The Commission is charged with “study[ing] the registration and voting processes used in Federal elections.” The Commission Order contains no authority to gather personal data or to undertake investigations.

On June 28, 2017, the Vice Chair of the Commission undertook to collect detailed voter histories from all fifty states and the District of Columbia. Such a request had never been made by any federal official in the history of the country. The Vice Chair stated during a phone call with PACEI members that “a letter w[ould] be sent today to the 50 states and District of Columbia on behalf of the Commission requesting publicly-available data from state voter rolls.” According to the U.S. Census, state voter rolls include the names, addresses, and other personally identifiable information of at least 157 million registered voters.

On June 28, 2017, the Commission sent a letter to election officials for all 50 states and the District of Columbia. In the letter sent to North Carolina Secretary of State Elaine Marshall, the Commission Vice Chair demanded that the states provide "voter roll data" including:

  • the full first and last names of all registrants, middle names or initials if available
  • addresses
  • dates of birth
  • political party (if recorded in your state)
  • last four digits of social security number if available
  • voter history (elections voted in) from 2006 onward
  • active/inactive status, cancelled status
  • information regarding any felony convictions
  • information regarding voter registration in another state
  • information regarding military status, and
  • overseas citizen information

The Commission Letter stated that “any documents that are submitted to the full Commission w[ould] also be made available to the public.” The Commission asked for a response by July 14, 2017. The “SAFE” URL, recommend by the Commission for the submission of voter data, leads election officials to a non-secure site. Regarding this website, Google Chrome states: “Your connection is not private. Attackers may be trying to steal your information from [the site proposed by the Commission] (for example, passwords, messages, or credit cards).”

On July 10, 2017, the Commission announced that it would suspend the collection of voter data during the pendency of EPIC's motion for a preliminary injunction. However, the Commission resumed collection on July 26, 2017, two days after the Court denied EPIC's motion.

The Commission’s Failure to Conduct a Privacy Impact Assessment

Under the E-Government Act of 2002, any agency “initiating a new collection of information that (I) will be collected, maintained, or disseminated using information technology; and (II) includes any information in an identifiable form permitting the physical or online contacting of a specific individual” is required to complete a Privacy Impact Assessment (“PIA”) before initiating such collection. The agency must “(i) conduct a privacy impact assessment; (ii) ensure the review of the privacy impact assessment by the Chief Information Officer, or equivalent official, as determined by the head of the agency; and (iii) if practicable, after completion of the review under clause (ii), make the privacy impact assessment publicly available through the website of the agency, publication in the Federal Register, or other means.”

A Privacy Impact Assessment for a “new collection of information” must be “commensurate with the size of the information system being assessed, the sensitivity of information that is in an identifiable form in that system, and the risk of harm from unauthorized release of that information.” The PIA must specifically address “(I) what information is to be collected; (II) why the information is being collected; (III) the intended use of the agency of the information; (IV) with whom the information will be shared; (V) what notice or opportunities for consent would be provided to individuals regarding what information is collected and how that information is shared; [and] (VI) how the information will be secured.”

Under the Federal Advisory Committee Act (“FACA”), “records, reports, transcripts, minutes, appendixes, working papers, drafts, studies, agenda, or other documents which were made available to or prepared for or by [an] advisory committee shall be available for public inspection and copying at a single location in the offices of the advisory committee or the agency to which the advisory committee reports until the advisory committee ceases to exist.”

EPIC v. Commission Legal Documents


EPIC v. Commission, No. 1:17-cv-01320-CKK (D.D.C. filed July 3, 2017)

EPIC v. Commission, No. 17-5171 (D.C. Cir. docketed July 27, 2017)

Other Documents

Related Litigation


Lasky v. Gardner, No. 226-2017-cv-00340 (N.H. Sup. Ct. filed July 10, 2017)

ACLU v. Trump, No. 17-1351 (D.D.C. filed July 10, 2017)

Lawyers' Committee v. Commission (filed July 10, 2017; appeal docketed July 21, 2017)

 Case No. 17-1354 (D.D.C. filed July 10, 2017)  Case No. 17-5167 (D.C. Cir. filed July 21, 2017)

Public Citizen v. Army, No. 17-1355 (D.D.C. filed July 10, 2017)

Joyner v. Commission, No. 17-22568 (S.D. Fla. filed July 10, 2017)

Marley v. Denney, CV01-17-12594 (Idaho Dist. Ct. filed July 10, 2017)

League of Women Voters of Indiana v. Lawson (Ind. Sup. Ct. filed July 11, 2017)

Common Cause v. Commission, No. 17-1398 (D.D.C. filed July 14, 2017)

NAACP Legal Defense Fund v. Trump, No. 17-5427 (S.D.N.Y. filed July 18, 2017)

League of Women Voters of Texas v. Pablos (filed July 20, 2017)

News

EPIC Resources

Other Resources

Share this page:

Support EPIC

EPIC relies on support from individual donors to pursue our work.

Defend Privacy. Support EPIC.

#Privacy