EPIC v. Presidential Election Commission

Challenging the unlawful collection of personal voter data

Note: Oral arguments in EPIC v. Commission, No. 17-5171 were held on Tuesday, November 21 before the U.S. Court of Appeals for the D.C. Circuit. A recording of the argument is available here.

Overview

EPIC has filed suit and is seeking a preliminary injunction to block a demand from the Presidential Election Commission for millions of state voter records. The Commission failed to conduct and release a Privacy Impact Assessment—as required by federal law—prior to collecting personal voter data (including SSNs, addresses, dates of birth and other identifying information). The Commission's demand for detailed voter histories also violates millions of Americans' constitutional right to privacy. The Commission has already committed egregious security blunders, including (1) directing state election officials to send voter records to an unsecure web site and (2) proposing to publish partial SSNs that would enable identity theft and financial fraud. EPIC's lawsuit follows a letter from 50 voting experts and 20 privacy organizations urging state election officials to oppose the Commission's demand.

The principal case is EPIC v. Commission, No. 17-1320 (D.D.C. filed July 3, 2017). EPIC filed its complaint and motion for a temporary restraining order on July 3, 2017. Judge Colleen Kollar-Kotelly of the U.S. District Court for the District of Columbia held an initial teleconference that day and set an expedited briefing schedule. After EPIC and the Commission filed briefs, the court held an in-person hearing on July 7. On July 10, the Commission announced that it would suspend the collection of voter data in pending the Court's decision on EPIC's motion.

Three days later, on July 13, 2017, EPIC filed an amended motion for a temporary restraining order and preliminary injunction. The Commission responded on July 17, and EPIC filed a reply later that day. On July 24, the Court denied EPIC's motion for an injunction, concluding that neither the Commission nor the other government actors involved in collecting state voter data were subject to judicial review under the Administrative Procedure Act.

On July 25, 2017, EPIC appealed the district court's preliminary decision to the U.S. Court of Appeals for the District of Columbia Circuit. The appeal is EPIC v. Commission, No. 17-5171 (D.C. Cir. docketed July 27, 2017). EPIC filed an opening brief on August 18. The Commission filed a response on September 15, and EPIC filed a reply on September 22. Oral arguments were held on November 21.

Proceedings are also continuing in the district court. The Commission filed a motion to dismiss EPIC's complaint on September 5, 2017. EPIC filed an opposition on September 19, and the Commission filed a reply on September 26. Following the disclosure and discovery of new facts concerning the Commission's agency status, EPIC moved for leave to file a revised complaint on October 12. The revised complaint explains that the Commission is part of—and subject to the authority of—the General Services Administration. EPIC is also seeking discovery to determine the full scope of the Commission's activities and data collection.

The Commission and its Unlawful Demand for State Voter Data

The Presidential Advisory Commission on Election Integrity ("PACEI" or "Commission") was established by Executive Order on May 11, 2017. The stated purpose of the Commission is to "study the registration and voting processes used in Federal Elections" and to issue a report to the President addressing three specific issues. The Commission is to terminate 30 days after it submits its report to the President. The order establishing the Commission confers no authority to gather personal data or to undertake investigations.

On June 28, 2017, the Vice Chair of the Commission undertook to collect detailed voter histories from all fifty states and the District of Columbia. Such a request had never been made by any federal official in the history of the country. In a letter sent to state election officials, the Commission Vice Chair sought "voter roll data" including:

  • the full first and last names of all registrants, middle names or initials if available
  • addresses
  • dates of birth
  • political party (if recorded in your state)
  • last four digits of social security number if available
  • voter history (elections voted in) from 2006 onward
  • active/inactive status, cancelled status
  • information regarding any felony convictions
  • information regarding voter registration in another state
  • information regarding military status, and
  • overseas citizen information.

According to the U.S. Census Bureau, state voter rolls include the names, addresses, and other personally identifiable information of at least 157 million registered voters.

The Commission's letter to state officials also stated that “any documents that [we]re submitted to the full Commission w[ould] also be made available to the public.” The Commission asked for a response by July 14, 2017. Notably, the “SAFE” URL provided by the Commission for the submission of voter data led election officials to a non-secure website. When the URL was loaded in Google Chrome, a security warning appeared stating: “Your connection is not private. Attackers may be trying to steal your information from [the site proposed by the Commission] (for example, passwords, messages, or credit cards).”

On July 3, 2017, EPIC filed a complaint and motion for a temporary restraining order to halt the Commission's collection of state voter information. On July 10, 2017, the Commission announced that it would suspend the collection of voter data during the pendency of EPIC's motion. However, the Commission resumed collection on July 26, 2017, two days after the Court denied EPIC's motion.

The Commission’s Failure to Conduct a Privacy Impact Assessment

Under the E-Government Act of 2002, any agency “initiating a new collection of information that (I) will be collected, maintained, or disseminated using information technology; and (II) includes any information in an identifiable form permitting the physical or online contacting of a specific individual” is required to complete a Privacy Impact Assessment (“PIA”) before initiating such collection. The agency must “(i) conduct a privacy impact assessment; (ii) ensure the review of the privacy impact assessment by the Chief Information Officer, or equivalent official, as determined by the head of the agency; and (iii) if practicable, after completion of the review under clause (ii), make the privacy impact assessment publicly available through the website of the agency, publication in the Federal Register, or other means.”

A Privacy Impact Assessment for a “new collection of information” must be “commensurate with the size of the information system being assessed, the sensitivity of information that is in an identifiable form in that system, and the risk of harm from unauthorized release of that information.” The PIA must specifically address “(I) what information is to be collected; (II) why the information is being collected; (III) the intended use of the agency of the information; (IV) with whom the information will be shared; (V) what notice or opportunities for consent would be provided to individuals regarding what information is collected and how that information is shared; [and] (VI) how the information will be secured.”

Under the Federal Advisory Committee Act (“FACA”), “records, reports, transcripts, minutes, appendixes, working papers, drafts, studies, agenda, or other documents which were made available to or prepared for or by [an] advisory committee shall be available for public inspection and copying at a single location in the offices of the advisory committee or the agency to which the advisory committee reports until the advisory committee ceases to exist.”

The Commission's refusal to comply with these provisions of the E-Government Act and the Federal Advisory Committee Act is the primary basis for EPIC's lawsuit.

EPIC v. Commission Litigation Documents


EPIC v. Commission, No. 1:17-cv-01320-CKK (D.D.C. filed July 3, 2017)

EPIC v. Commission, No. 17-5171 (D.C. Cir. docketed July 27, 2017)

EPIC Letter to State Election Officials

On July 3, 2017, EPIC—joined by more than 50 privacy experts and 20 civil liberties organizations—sent a letter to the National Association of State Secretaries urging state election officials to oppose the Commission’s request for state voter data.

EPIC Freedom of Information Act Requests

On September 11, 2017, EPIC filed three Freedom of Information Act requests to the Department of Homeland Security, the Executive Office for U.S. Attorneys, and the Social Security Administration seeking details of the Commission's attempts to obtain sensitive, personal data from other federal agencies. At the Commission's first meeting, Vice Chair Kris W. Kobach tasked Commission staff with "trying to collect whatever data there is that's already in the possession of the federal government that might be helpful to us," including data protected by the Privacy Act.

Related Litigation

At least fourteen other lawsuits have been filed concerning the work of the Commission, nine of them in federal court and five in state court.

Lasky v. Gardner, No. 226-2017-cv-00340 (N.H. Sup. Ct. filed July 10, 2017)

On July 6, 2017, the ACLU of New Hampshire and two state legislators filed suit against New Hampshire Secretary of State William Gardner to block the state from unlawfully disclosing voter information to the Commission. On August 7, 2017, Gardner announced that New Hampshire would submit scanned images of voter rolls to the Commission rather than a digitally searchable index.

ACLU v. Trump, No. 17-1351 (D.D.C. filed July 10, 2017)

On July 10, 2017, the ACLU filed suit against President Trump and the Presidential Election Commission for violating the Commission’s transparency requirements and failing to ensure an ideologically balanced membership. The ACLU also moved for a preliminary injunction to force the Commission to comply with its legal obligations as an advisory committee. The Court denied that motion on July 18, 2017. A stay was granted in the case on September 8, 2017.

Lawyers' Committee v. Commission (D.D.C. filed July 10, 2017; D.C. Cir. appeal docketed July 21, 2017)

On July 10, 2017, the Lawyers’ Committee for Civil Rights Under Law filed suit against the Presidential Election Commission for violating the Commission’s transparency requirements. The Lawyers’ Committee also moved for a preliminary injunction to force the Commission to comply with its legal obligations as an advisory committee. The Court denied that motion on July 18, 2017. The Lawyers’ Committee appealed the Court's decision on July 19, 2017. Proceedings are also continuing in the District Court. On September 29, 2017, the Government—following a discovery motion by the Lawyers' Committee—filed a document index and two declarations with key information about the Commission's records.

 Case No. 17-1354 (D.D.C. filed July 10, 2017)  Case No. 17-5167 (D.C. Cir. appeal docketed July 21, 2017)

Public Citizen v. Army, No. 17-1355 (D.D.C. filed July 10, 2017)

On July 10, 2017, Public Citizen filed suit against the U.S. Department of the Army to block the Commission’s collection of voter data using the Army’s “Safe Access File Exchange” (SAFE). After the Commission announced that it would no longer use the SAFE system to collect voter data, Public Citizen voluntarily dismissed its complaint on July 25, 2017.

Joyner v. Commission, No. 17-22568 (S.D. Fla. filed July 10, 2017)

On July 10, 2017, the ACLU of Florida, the Florida Immigrant Coalition, two Florida elected officials, and three Florida voters filed suit against the Floriday the Commission for failing to meet its statutory obligations as an advisory committee, for breaching the constitutional separation of powers, and for violating several other federal statutes. The plaintiffs also sued Florida Secretary of State Ken Detzner for violating state law. The plaintiffs moved for a temporary restraining order against the Commission to block it from collecting state voter data. The Court denied that motion on July 20, 2017. Detzner filed a motion to dismiss on Aug. 14, 2017, and the plaintiffs filed a response on Sep. 28, 2017. The Commission filed a separate motion to dismiss on Oct. 20, 2017.

Marley v. Denney, No. CV01-17-12594 (Idaho Dist. Ct. filed July 11, 2017)

On July 11, 2017, the Idaho Democratic Party filed suit against Idaho Secretary of State Lawerence Denney to block the state from transferring voter data to the Commission. The parties reached a settlement under which Idaho would (1) decline to respond to the Commission’s initial data request, and (2) give the Idaho Democratic Party 10 days’ notice before responding to any subsequent Commission requests for state voter data.

League of Women Voters of Indiana v. Lawson, No. 45D02-1707-PL-00047 (Ind. Sup. Ct. filed July 11, 2017)

On July 11, 2017, the League of Women Voters of Indiana and the Indiana NAACP, working with the Brennan Center for Justice, filed suit against Indiana Secretary of State Connie Lawson to block the state from unlawfully transferring voter data to the Commission.

Common Cause v. Commission, No. 17-1398 (D.D.C. filed July 14, 2017)

On July 14, 2017, Common Cause filed suit against the Commission, the Department of Homeland Security, and the Social Security Administration arguing that the Commission’s collection of voter data violated the Privacy Act’s prohibition on maintaining records related to the exercise of First Amendment rights. Common Cause also moved for a temporary restraining order and/or preliminary injunction to block the Commission from obtaining any voter information. The Court denied that motion on August 1, 2017. Common Cause filed an amended complaint on September 13, 2017.

NAACP Legal Defense Fund v. Trump, No. 17-5427 (S.D.N.Y. filed July 18, 2017)

On July 18, 2017, the NAACP Legal Defense Fund and the Ordinary People Society filed suit against President Trump and the Commission for violations of the Fifth Amendment right to Equal Protection; the Fifteenth Amendment prohibition on race-based denials of voting rights; legal limits on the President’s powers; the Federal Advisory Committee Act; and the Administrative Procedure Act.

League of Women Voters of Texas v. Pablos (Tex. Dist. Ct. filed July 20, 2017; Tex. App. appeal filed Oct. 10, 2017)

On July 20, 2017, the League of Women Voters of Texas and Texas NAACP, working with the Brennan Center for Justice, filed suit against Texas Secretary of State Rolando Pablos and others to block the state from unlawfully transferring voter data to the Commission. On October 3, 2017, the Travis County District Court granted the plaintiffs' motion for a temporary restraining order and halted the state's planned data transfer. On October 10, 2017, the defendants petitioned for a writ of mandamus from the Texas Court of Appeals and sought temporary relief from that court. The Court of Appeals stayed proceedings in the district court but extended the Temporary Restraining Order against the transfer of voter data.

 Case No. D-1-GN-17-003451 (Tex. Dist. Ct. filed July 20, 2017)  Case No. 03-17-00662-CV (Tex. App. appeal filed Oct. 10, 2017)

League of United Latin American Citizens of Utah v. Cox (Utah Dist. Ct. filed July 26, 2017)

On July 26, 2017, the League of United Latin American Citizens of Utah and the League of Women Voters of Utah, working with the Brennan Center for Justice, filed suit against Utah Lieutenant Governor Spencer Cox to block the state from unlawfully transferring voter data to the Commission.

Brennan Center v. Department of Justice, No. 17-6335 (S.D.N.Y. filed Aug. 21, 2017)

On August 21, 2017, the Brennan Center for Justice and the Protect Democracy Project filed a Freedom of Information Act (FOIA) suit against the Department of Justice, the Department of Homeland Security, and the Office of Management and Budget to compel the disclosure of records pertaining to the Commission.

United to Protect Democracy v. Commission, No. 17-2016 (D.D.C. filed Sep. 29, 2017)

On September 29, 2017, United to Protect Democracy filed suit against the Commission, the Office of Management and Budget (OMB), and OMB Director Mick Mulvaney. The suit alleges that the Commission and OMB violated the Paperwork Reduction Act (PRA) and Administrative Procedure Act by failing to follow procedures regulating the government's collection of data. On October 11, 2017, Protect Democracy moved for a preliminary injunction to halt the Commission's collection and use of data until the Commission complies with the PRA.

Dunlap v. Commission, No. 17-2361 (D.D.C. filed Nov. 9, 2017)

On November 9, 2017, Maine Secretary of State and Commission Member Matthew Dunlap filed suit against the Commission and nine related government defendants seeking—among other remedies—"any and all correspondence between Commission members in the possession of the Commission[.]" The suit follows an October 17, 2017 letter from Dunlap to Commission Designated Federal Officer Andrew Kossack seeking the same records—a letter to which Dunlap did not receive a reply. Dunlap alleges that the Commission has violated the Federal Advisory Committee Act and Administrative Procedure Act by denying him meaningful participation in Commission proceedings, by refusing to disclose Commission records, and by conducting activities prior to the filing of the Commission’s charter on June 23, 2017. On November 16, 2017, Dunlap moved for a preliminary injunction to compel the Commission to comply with its FACA obligations.

Other Documents

  • Presidential Executive Order on the Establishment of Presidential Advisory Commission on Election Integrity (May 11, 2017), Exec. Order No. 13,799, 82 Fed. Reg. 22,389
  • Letter from Kris W. Kobach, Vice Chair, PACEI, to Hon. Elaine Marshall, Secretary of State, North Carolina (June 28, 2017)
  • Letter from T. Christian Herren, Jr., Chief, Voting Section, Civil Rights Division, U.S. Dep't of Justice, to Hon. Kim Westbrook Strach, Exec. Dir., State Bd. of Elections, North Carolina (June 28, 2017)
  • Notice of July 19 PACEI Meeting, 82 Fed. Reg. 31,063 (July 5, 2017)
  • Letter from Kris W. Kobach, Vice Chair, PACEI, to New York State Board of Elections (July 26, 2017)
  • Letter from Commissioner Matthew Dunlap to Andrew Kossack, Desginated Federal Officer, Presidential Advisory Commission on Election Integrity (Oct. 17, 2017)
  • Letter from Members of the Senate Judiciary Committee to Attorney General Jeff Sessions (Oct. 17, 2017)
  • Letter from Sens. Michael F. Bennet, Amy Klobuchar, & Cory A. Booker to U.S. Government Accountability Office (Oct. 18, 2017)
  • Letter from Katherine Siggerud, U.S. Government Accountability Office, to Sen. Michael F. Bennet (Oct. 25, 2017)
  • Letter from Senators Whitehouse et al. to Nancy Berryhill, Social Security Administration (Nov. 9, 2017)

News

EPIC Resources

Other Resources

Share this page:

Support EPIC

EPIC relies on support from individual donors to pursue our work.

Defend Privacy. Support EPIC.

#Privacy