UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLUMBIA
ASYLUM SEEKERS TRYING TO ASSURE THEIR SAFETY, et al.,
Plaintiffs,
v. Case No. 1:23-cv-163-RCL
PATRICK “P.J.” LECHLEITNER, in his official capacity as Acting Director of U.S. Immigration and Customs Enforcement, et al.,
Defendants.
MEMORANDUM OPINION
This case arises out of an incident in which an employee of U.S. Immigration and Customs
Enforcement (ICE), an agency of the Department of Homeland Security, posted to the agency’s
public-facing website information concerning 6,252 noncitizens currently or formerly in ICE
custody. Forty-nine of these individuals have now sued Patrick “P.J.” Lechleitner, in his official
capacity as Acting Director of ICE,1 Alejandro Mayorkas, in his official capacity as Secretary of
Homeland Security, Merrick Garland, in his official capacity as Attorney General of the United
States, and John Doe 1, the ICE employee who allegedly posted the information, in their official
capacity as an ICE employee.
Defendants have moved to dismiss plaintiffs’ First Amended Complaint (FAC), ECF No.
6. The Court concludes it must dismiss the complaint in its entirety. Plaintiffs lack Article III
standing to seek injunctive or declaratory relief, and three of their four claims for damages are
1 Plaintiffs initially named Tae D. Johnson but substituted Mr. Lechleitner as a named party under Federal Rule of Civil Procedure 25(d). See ECF No. 50.
1 barred by sovereign immunity. Plaintiffs also lack Article III standing to pursue the remaining
claim, for violation of the Privacy Act, and in any event have failed to state a claim upon which
relief can be granted.
In dismissing this action, the Court does not downplay the gravity of ICE’s alleged failure
to safeguard the data of vulnerable people in its custody. But for the reasons discussed below, the
Court must GRANT defendants’ motion to dismiss plaintiffs’ complaint in its entirety. Since the
Court will dismiss plaintiffs’ action, it must also DENY AS MOOT plaintiffs’ pending motions
to certify a class and to compel. However, it will GRANT plaintiffs’ motion for leave to file a
document under seal.
I. BACKGROUND
A. Factual Background
Plaintiffs are non-United States citizens who came to the United States to seek asylum and
were then detained by ICE. FAC ¶ 2. They hail from Colombia, the Dominican Republic,
Ecuador, El Salvador, France, Guatemala, Haiti, Honduras, India, Jamaica, Mexico, Nicaragua,
Peru, Tunisia, and Venezuela. Id. ¶ 1. Many fled their native lands to escape “gang violence,
government retaliation, and persecution on the basis of protected grounds.” Id. ¶ 6. By now,
plaintiffs are at various stages in the asylum process. Some have already had their asylum claims
adjudicated, some have submitted an application that is awaiting adjudication, and some have not
yet submitted an application. Id. ¶ 3. Some but not all plaintiffs are still detained by ICE. Id. ¶ 1.
On November 28, 2022, ICE employee John Doe 1 allegedly posted a document containing
the names, other personally identifiable information, and immigration information of 6,252
noncitizens currently or formerly in ICE custody, including plaintiffs, to the agency’s public-
facing website. Id. ¶ 68. For about five hours, the information remained up on the website, where
2 it “was able to be downloaded, copied, captured by screenshot, and otherwise preserved by the
public.” Id. ¶¶ 71–72.
Two days later, ICE acknowledged the release of information and explained that after this
“breach of policy,” “the agency [was] investigating the incident and taking all corrective actions
necessary.” Id. ¶ 73. ICE has since announced a range of mitigation efforts. See Exhibit B, ECF
No. 6-2 (“FAQ”). For one thing, ICE has sought to separately notify each affected individual.2
Id. 2. ICE also delayed the removal of affected noncitizens, initially for 30 days, id., and then
indefinitely “to allow them time to further discuss their options with a legal representative.”
FAC ¶ 82. ICE also sent “clawback” letters to “all external entities or individuals that may have
downloaded, received, or accessed the document” requesting that recipients destroy the document
and refrain from using or disclosing the information it contained. FAQ at 4. Finally, ICE has
committed to affording all affected noncitizens an opportunity to raise the data breach issue in
removal proceedings, so that they can argue for asylum on the basis that the breach created a
danger that their persecutors will use the information to target them should they be deported. See
FAQ 2–4; FAC ¶ 87.3
B. Procedural Background
Plaintiffs filed their complaint in January, 2023. See Complaint, ECF No. 1. On February
17, they filed the First Amended Complaint. See FAC. Plaintiffs bring four claims. First, plaintiffs
2 All of the plaintiffs received written notice from ICE. Declaration in Support of Pls.’ Mot. for Class Certification, ECF Nos. 16-1–16-49. 3 Plaintiffs allege that another breach occurred in December 2022. They state that DHS informed the Government of Cuba that some of the 103 Cuban nationals awaiting removal from the United States to Cuba were among the individuals who data was leaked in the November 28 breach—and thus revealed to the Cuban authorities that some of the individuals due to be removed to Cuba had sought asylum. FAC ¶ 78. Plaintiffs allege that forty-six of the individuals had in fact been named in the November leak, and that after the December incident ICE released some or all of the 103 affected individuals. Id. However, plaintiffs have not alleged that any of the plaintiffs belong to this group of forty-six people. Plaintiffs have apparently included this allegation to show DHS and ICE’s laxity on information security, rather than to allege a separate violation of the law.
3 allege that defendants violated the Privacy Act of 1974 because DHS and ICE “did not establish
appropriate administrative, technical, and physical safeguards to prevent the data breach” (First
Claim for Relief). FAC ¶ 119. Second, plaintiffs assert a claim under the Administrative
Procedure Act for a host of reasons, including that “Defendants’ failure to safeguard plaintiffs’
personal information from public disclosure constitutes agency action taken not in accordance with
the law” (Second Claim for Relief). Id. ¶ 127. Third, plaintiffs venture a freestanding claim for
violation of the Accardi doctrine, according to which an administrative agency must follow its own
regulations and procedures (Third Claim for Relief). Id. ¶¶ 133–34; see also United States ex rel.
Accardi v. Shaughnessy, 347 U.S. 260 (1954). Fourth, plaintiffs assert that defendants violated
“equal protection principles of the Fourteenth Amendment, embedded in the Due Process Clause
of the Fifth Amendment” by breaching “affirmative duties of care and protection” (Fourth Claim
for Relief). Id. ¶¶ 147–48 (quoting DeShaney v. Winnebago Cnty. Dep’t of Soc. Servs., 489 U.S.
189, 198 (1989)).
As for remedies, plaintiffs seek money damages, see FAC, Prayer for Relief ¶¶ H–I, as
well as a declaration that the defendants violated the Privacy Act, the APA, and the Constitution.
Id. ¶ B. Plaintiffs also seek wide-ranging injunctive relief against ICE and the Department of
Justice. They ask for the Court to order ICE “to extend the original 30-day stay of removal for all
impacted individuals to one year,” notify those who opted out of the initial stay “that they may
take advantage of the additional stay,” and “cease the removal of Plaintiffs, and others similarly
situated until their asylum and withholding of removal claims can be re-adjudicated, with the
presumption of risk of danger created by the data breach and a presumption that each asylee’s fear
is well-founded.” Id. ¶¶ C–D. In addition, they request that the Court order “DOJ”4 “to rescind
4 The Department of Justice is not a party to this case. The plaintiffs apparently have in mind the Attorney General, who has been named a defendant in his official capacity.
4 removal orders and reopen removal proceedings” for affected individuals, “to extend
accommodations to Plaintiffs and others similarly situated so that the merits of any application for
asylum, withholding of removal, and/or protection under the Convention Against Torture can be
considered or reconsidered in light of the data breach, with the presumption of risk of danger
created by the data breach and a presumption that each asylee’s fear is well-founded,” and “to
instruct immigration judges to take administrative notice to recognize a presumption of risk of
danger created by the data breach and a presumption that each asylee’s fear is well-founded.” Id.
¶¶ C–G.
Defendants moved to dismiss the FAC in its entirety for lack of subject matter jurisdiction
under Federal Rule of Civil Procedure 12(b)(1) and failure to state a claim under Rule 12(b)(6).
See MTD, ECF No. 33. Plaintiffs filed a response, see Pls.’ Opp’n, ECF No. 39, to which
defendants filed a reply, see Defs.’ Reply, ECF No. 45. In addition, the Immigration Reform Law
Institute moved for leave to file an amicus curiae brief, which the Court granted. See IRLI Amicus,
ECF No. 51.5 Plaintiffs have twice filed notices of change in material facts. See ECF No. 46; ECF
No. 49.
Three other motions are pending. First, plaintiffs moved to certify a class under Federal
Rule of Civil Procedure 23. See ECF No. 16. The Court deferred ruling on that matter. See ECF
No. 36. Second, plaintiffs moved to compel defendants to produce a “certified list of the
administrative record” pursuant to Local Civil Rule 7(n). See ECF No. 34. Defendants filed a
response, see ECF No. 41, and plaintiffs filed a reply, see ECF No. 43. Third, plaintiffs have filed
a sealed motion for leave to file under seal exhibits relating to the second notice of change in
material facts. See ECF No. 47.
5 Because the Court does not reach the merits of plaintiffs’ constitutional claims, it will not consider the arguments advanced by amicus.
5 II. LEGAL STANDARDS
A defendant in a civil action may move to dismiss a complaint under Federal Rule of Civil
Procedure 12(b)(1) for lack of subject-matter jurisdiction. See Fed. R. Civ. P. 12(b)(1). If the
Court lacks subject matter jurisdiction, it must dismiss the claim or action. Fed. R. Civ. P. 12(h)(3).
Article III of the Constitution vests in the federal court authority to adjudicate “Cases” and
“Controversies.” U.S. Const., art. III, § 2. For a lower federal court to have subject-matter
jurisdiction over a case or controversy, Congress must provide such jurisdiction by statute within
the bounds of the Constitution’s grant of jurisdiction. Kokkonen v. Guardian Life Ins. Co. of Am.,
511 U.S. 375, 377 (1994).
A court considering a motion to dismiss for lack of subject matter jurisdiction must take
all the well-pleaded allegations in the complaint as true and draw all reasonable inferences in the
plaintiff’s favor. Doe v. Wash. Metro. Area Transit Auth., 453 F. Supp. 3d 354, 361 (D.D.C. 2020).
“However, those factual allegations receive closer scrutiny than they do in the Rule 12(b)(6)
context,” and the court “may look to documents outside of the complaint in order to evaluate
whether or not it has jurisdiction to entertain a claim.” Id. (internal quotation marks and citations
omitted). It is the “[p]laintiff [who] bears the burden of proving subject matter jurisdiction by a
preponderance of the evidence.” Am. Farm Bureau v. EPA, 121 F. Supp. 2d 84, 90 (D.D.C. 2000).
A defendant in a civil action may also move to dismiss a complaint under Federal Rule of
Civil Procedure 12(b)(6) for “failure to state a claim upon which relief can be granted.” See Fed.
R. Civ. P. 12(b)(6). To survive a Rule 12(b)(6) motion, a complaint must contain sufficient factual
allegations, accepted as true, to “state a claim to relief that is plausible on its face.” Ashcroft v.
Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)).
6 A claim is plausible on its face if it “pleads factual content that allows the court to draw the
reasonable inference that the defendant is liable for the misconduct alleged.” Id. A court
evaluating a Rule 12(b)(6) “motion presumes that the complaint’s factual allegations are true and
construes them liberally in the plaintiff's favor.” Alemu v. Dep’t of For-Hire Vehicles, 327 F.
Supp. 3d 29, 40 (D.D.C. 2018). However, “[a] court need not accept a plaintiff’s legal conclusions
as true, . . . nor must a court presume the veracity of legal conclusions that are couched as factual
allegations.” Id. (citation omitted).
III. DISCUSSION
The Court concludes that it lacks subject matter jurisdiction to entertain this action.
Plaintiffs lack Article III standing to seek injunctive or declaratory relief because they have not
alleged an ongoing or future violation of their rights by defendants. And plaintiffs’ claims for
money damages under the APA, Accardi, and the Due Process Clause are barred by sovereign
immunity because Congress has not consented to such suits. Plaintiffs’ Privacy Act claim fails
because they have not established Article III standing to seek damages under the Act. Even if they
have standing, they have not plausibly alleged a cognizable violation of the statute.
A. Plaintiffs Lack Standing to Seek Injunctive or Declaratory Relief
The Court lacks jurisdiction to entertain plaintiffs’ claims for injunctive or declaratory
relief because plaintiffs lack Article III standing to seek such relief.
“The doctrine of standing implements” the requirement of an Article III case or
controversy “by insisting that a litigant ‘prove that he has suffered a concrete and particularized
injury that is fairly traceable to the challenged conduct, and is likely to be redressed by a favorable
judicial decision.’” Carney v. Adams, 141 S. Ct. 493, 498 (2020) (quoting Hollingsworth v. Perry,
570 U.S. 693, 704 (2013)). A litigant may have standing to pursue certain forms of relief but not
others. See, e.g., Friends of the Earth, Inc. v. Laidlaw Env’t Servs. (TOC), Inc., 528 U.S. 167, 185
7 (2000) (“[A] plaintiff must demonstrate standing separately for each form of relief sought.”). “[A]t
the pleading stage, a plaintiff must allege facts demonstrating each element” of standing. Friends
of Animals v. Jewell, 828 F.3d 989, 992 (D.C. Cir. 2016). If the plaintiff lacks standing, the court
lacks subject matter jurisdiction. Haase v. Sessions, 835 F.2d 902, 906 (D.C. Cir. 1987). Here,
defendants correctly argue that “Plaintiffs lack standing to seek declaratory and injunctive relief
because they allege a past legal harm (the inadvertent disclosure), not an ongoing alleged violation
or imminent future violation.” MTD at 1.
To the extent plaintiffs seek injunctive and declaratory relief, this case is squarely
controlled by Supreme Court and D.C. Circuit precedent. In City of Los Angeles v. Lyons, a
plaintiff brought a civil rights action against the City of Los Angeles and certain police officers,
alleging that L.A. police had subjected him to an unconstitutional chokehold after stopping him
for a traffic violation, and that L.A. had authorized police officers to routinely apply unwarranted
chokeholds. 461 U.S. 95, 97–98 (1983). Lyons sought damages as well as injunctive and
declaratory relief. Id. at 98. The Supreme Court held that because Lyons was not immediately
threatened by the prospect of another chokehold, he had “failed to demonstrate a case or
controversy . . . that would justify the equitable relief sought.” Id. at 105. In coming to this
conclusion, the Court emphasized that “[p]ast exposure to illegal conduct does not in itself show
a present case or controversy regarding injunctive relief . . . if unaccompanied by any continuing,
present adverse effects.” Id. at 102 (quoting O’Shea v. Littleton, 414 U.S. 488, 495–96 (1974))
(alternation in original).
Applying Lyons, the D.C. Circuit has explained that “[t]o pursue an injunction or a
declaratory judgment,” plaintiffs “must allege a likelihood of future violations of their rights by”
the defendant, “not simply future effects from past violations.” Fair Emp. Council of Greater
8 Washington, Inc. v. BMC Mktg. Corp., 28 F.3d 1268, 1273 (D.C. Cir. 1994); see also Dearth v.
Holder, 641 F.3d 499, 501 (D.C. Cir. 2011) (“In a case of this sort, where the plaintiffs seek
declaratory and injunctive relief, past injuries alone are insufficient to establish standing. Rather,
Dearth must show he is suffering an ongoing injury or faces an immediate threat of injury.”); Black
Lives Matter D.C. v. Trump, 544 F. Supp. 3d 15, 36 (D.D.C. 2021) (applying holding of Fair Emp.
Council of Greater Washington), aff’d sub nom. Buchanan v. Barr, 71 F.4th 1003 (D.C. Cir. 2023).
Here, plaintiffs do not seek injunctive or declaratory relief to remedy future violations of
their rights by the defendants. Plaintiffs argue that they have “never alleged the injury was the
publishing of their [personally identifiable information] itself,” but rather that the leak put
plaintiffs in danger by providing their “persecutors with information that makes it easier for
Plaintiffs to be located today or in the future.” See Pls.’ Opp’n at 10–11; FAC ¶¶ 6, 120–22, 131.
But that means plaintiffs do not “allege a likelihood of future violations of their rights by” the
governmental defendants, but instead seek relief addressed at “future effects” (i.e., harm by third
parties) “from past violations” by ICE. See Fair Emp. Council of Greater Washington, 28 F.3d at
1273. And although plaintiffs suggest they may suffer emotional distress from the future effects
of the leak, FAC ¶ 122, “[t]he emotional consequences of a prior act simply are not a sufficient
basis for an injunction absent a real and immediate threat of future injury by the defendant.” Lyons,
461 U.S. at 107 n.8.
Perhaps sensing a need to tie their harm to future action by the defendants rather than third
parties, plaintiffs justify their standing to seek injunctive and declaratory relief because “DHS must
be held accountable to end what appears to be a Department-wide culture of disregarding the
privacy of asylum seekers.” Pls.’ Opp’n at 11 (quoting FAC ¶ 8). But under Lyons, standing to
seek such relief cannot be premised on a desire to hold the government “accountable” for harmful
9 practices, even if widespread. See Lyons, 461 U.S. at 108 (noting that although L.A. police may
continue to use illegal chokeholds, “it is surely no more than speculation to assert” that Lyons
himself would face the risk of a chokehold in the future).
Finally, plaintiffs cannot evade Lyons by recasting their allegations about past violations
as a challenge to ongoing agency failures. Plaintiffs object to “ICE’s failure to sufficiently address
the harm the agency caused” and “DOJ’s failure to account for the harms to Plaintiffs and proceed
with removal processes despite those harms.” See FAC ¶¶ 129–30. But they have not explained
how either of these failures to adequately “address” or “account for” the harm plaintiffs
experienced in the data breach are themselves violations of plaintiffs’ rights. And if “the injury
ICE’s victims face was not incurred in the moment of Defendants’ unlawful act,” Pls.’ Opp’n at
10, then it is unclear how ICE’s inadequate mitigation of the non-injury could itself be an injury
sufficient for Article III standing. And even if plaintiffs had alleged an injury from the data breach
itself, inadequate mitigation of the effects of a past harm is not necessarily itself a continuing harm.
Indeed, plaintiffs do not allege that the mitigation efforts themselves violate any specific legal
right; plaintiffs simply label these responses “not in accordance with the law” and “an abuse of
discretion.” See FAC ¶¶ 129–30.
In light of Lyons and its progeny, plaintiffs lack standing to seek injunctive or declaratory
relief. The Court, then, may not entertain these requests for relief.
10 B. Sovereign Immunity Bars Plaintiffs’ Claims Under the APA, Accardi, and the Due Process Clause, But Not Plaintiffs’ Claims under the Privacy Act
Plaintiffs’ claims for damages fare only slightly better. Sovereign immunity bars plaintiffs’
claims under the APA, Accardi, and the Due Process Clause. However, it does not bar plaintiffs’
claims under the Privacy Act.
“Absent [consent by the federal government] the doctrine of sovereign immunity shields
the federal government from suit” by depriving courts of jurisdiction. Tri-State Hosp. Supply
Corp. v. United States, 341 F.3d 571, 575 (D.C. Cir. 2003). Sovereign immunity does not just
protect employers; it also “bar[s] suits for money damages against officials in their official capacity
absent a specific waiver by the government.” Clark v. Libr. of Cong., 750 F.2d 89, 103 (D.C. Cir.
1984). Since plaintiffs have sued the defendants in their official capacity, sovereign immunity
clearly bars all of plaintiffs’ claims for money damages, except for the Privacy Act claim—as
plaintiffs concede, see Pls.’ Opp’n at 16–17 (“[I]f Defendants wish to use the sovereign immunity
defense to only pay damages exclusively to ROE #3, and other victims from predominantly white
European countries, when most of their victims are Black and Brown and from predominantly
non-white countries in the Global South, plaintiffs concede that is something they can lawfully
do.”).
First, plaintiffs’ APA claim is clearly barred by sovereign immunity. In 1976, Congress
amended the APA to effect a broad waiver of sovereign immunity for certain suits against federal
agencies “seeking relief other than money damages.” See 5 U.S.C. § 702 (emphasis added). Here,
plaintiffs are seeking money damages from the United States, which is plainly beyond the scope
of the APA’s waiver of sovereign immunity. Second, even if plaintiffs have a cause of action
under Accardi, any such suit for money damages would be barred by sovereign immunity because
plaintiffs have failed to identify a Congressional waiver of sovereign immunity for such claims.
11 Third, “it is well settled ‘that Congress has not waived immunity for suits seeking monetary
damages that arise under the Constitution.’” Scinto v. Fed. Bureau of Prisons, 608 F. Supp. 2d 4,
9 (D.D.C.) (quoting Zinda v. Johnson, 463 F. Supp. 2d 45, 48–49 (D.D.C. 2006), aff’d, 352 F.
App’x 448 (D.C. Cir. 2009). Therefore, the Court lacks jurisdiction to entertain plaintiffs’ claims
for money damages under the APA, Accardi, or the Constitution.
As for plaintiffs’ claims for damages under the Privacy Act, however, defendants concede
that this statute does indeed waive sovereign immunity. MTD at 21; see In re U.S. Office of Pers.
Mgmt. Data Sec. Breach Litig. (OPM Breach Litig.), 928 F.3d 42, 61 (D.C. Cir. 2019) (“The
Privacy Act waives sovereign immunity by expressly authorizing a cause of action for damages
against federal agencies that violate its rules protecting the confidentiality of private information
in agency records.”).
C. Plaintiffs Lack Article III Standing to Sue Under the Privacy Act
Plaintiffs have failed to establish Article III standing to bring their Privacy Act claim.
Alternatively, even if they have standing they have failed to state a claim upon which relief can be
granted.
1. Plaintiffs Lack Standing to Sue Under the Privacy Act
Since plaintiffs say their injury is not the leak of their information but instead the risk that
persecutors will one day use this information to target them, they have failed to sufficiently allege
Article III standing to pursue a remedy under the Privacy Act.
“To qualify for standing, a claimant must present an injury that is [1] concrete,
particularized, and actual or imminent; [2] fairly traceable to the defendant’s challenged behavior;
and [3] likely to be redressed by a favorable ruling.” Davis v. Fed. Election Comm’n, 554 U.S.
724, 733 (2008). If the purported injury were the disclosure of private information, plaintiffs might
have standing. As the Supreme Court recently observed, one example of an intangible harm that
12 is nonetheless concrete is “disclosure of private information.” TransUnion LLC v. Ramirez, 141
S. Ct. 2190, 2204 (2021) (citing Davis, 554 U.S. at 733). It would seem that plaintiffs suffered a
concrete, particularized, and actual injury, redressable through damages, when ICE released
private information related to them. One could argue that this harm is fairly traceable at least to
John Doe #1, the Director of ICE, and the Secretary of Homeland Security.
However, plaintiffs have expressly disclaimed reliance on the breach itself as their injury.
See Pls.’ Opp’n at 10 (“Plaintiffs never alleged the injury was the publishing of their [personally
identifiable information] itself . . . . [T]he injury ICE’s victims face was not incurred in the moment
of Defendants’ unlawful act”). Instead, plaintiffs argue that “[a]s a result of Defendants’ actions,
Plaintiffs have an enhanced risk of injury” in the future from persecutors who may have greater
ability and motivation to harm them because of the breach. See Pls.’ Opp’n at 10–11; FAC ¶¶ 6,
120–22, 131. Plaintiffs do not have Article III standing based on the future risk that persecutors
will harm them because they have not met their burden to allege facts demonstrating any of the
three elements of standing. See Friends of Animals, 828 F.3d at 992.
First, an injury must be “actual or imminent, not ‘conjectural’ or ‘hypothetical.’” Lujan v.
Defs. of Wildlife, 504 U.S. 555, 560 (1992) (quoting Whitmore v. Arkansas, 495 U.S. 149, 155
(1990)). A theory based on a “speculative chain of possibilities” does not suffice. See Clapper
v. Amnesty Int’l USA, 568 U.S. 398, 414 (2013). Here, plaintiffs’ theory of future injury is “riddled
with contingencies and speculation.” Trump v. New York, 141 S. Ct. 530, 535 (2020). For
instance, they state that they will be at increased risk of retaliation even within the United States,
FAC ¶ 121, without offering facts to indicate a realistic possibility of asylees being tracked down
and attacked by persecutors on American soil. And although plaintiffs state that they “face a real
risk of persecution and/or death if they are forced to return to their home countries where, as a
13 result of the data breach, the foreign governments may know or learn that they sought asylum in
the U.S.,” id. ¶ 120, they do not explain why foreign persecutors would subject them to additional
harm for having sought asylum in the United States.
Another problem for plaintiffs is causation. “[T]he injury has to be ‘fairly . . . trace[able]
to the challenged action of the defendant, and not . . . th[e] result [of] the independent action of
some third party not before the court.’” Lujan, 504 U.S. at 560–61 (alterations in the original)
(quoting Simon v. Eastern Ky. Welfare Rights Organization, 426 U.S. 26, 41–42 (1976)). To
establish a sufficient chain of causation between the governmental act and the conduct of third
parties, a plaintiff’s theory of standing cannot “rest on mere speculation about the decisions of
third parties” but instead must rely “on the predictable effect of Government action on the
decisions of third parties.” See Dep’t of Com. v. New York, 139 S. Ct. 2551, 2566 (2019); see also
Clapper, 568 U.S. at 414 (noting the Supreme Court’s “usual reluctance to endorse standing
theories that rest on speculation about the decisions of independent actors”); Allen v. Wright, 468
U.S. 737, 753, 759 (1984) (concluding that an “alleged injury is not fairly traceable to the
assertedly unlawful conduct of the” government when the link between the injury and the
government’s conduct involves an attenuated “chain of causation” involving third parties). In this
case, plaintiffs’ theory that the data breach will lead persecutors to target them relies on several
intervening steps, including the persecutors being willing and able to target them for having sought
asylum and the persecutors obtaining access to the leaked information. At each stage, plaintiffs
can only speculate about what the third parties will do. Plaintiffs have therefore not established
that the “predictable effect” of ICE’s data breach “on the decisions of third parties” will result in
injury to plaintiffs. See Dep’t of Com., 139 S. Ct. at 2566.
14 For similar reasons, it is not “‘likely,’ as opposed to merely ‘speculative,’ that the injury
will be ‘redressed by a favorable decision.’” Lujan, 504 U.S. at 561 (quoting Simon, 426 U.S. at
38, 43). While money damages could be used to pay for such protective steps as purchasing
security systems, see FAC ¶ 121, and such mitigation measures as counseling, id. ¶ 122, plaintiffs
have not alleged that they will likely do any of these things, only that they “may” do so.
By asserting the risk of future harm by third parties as their injury, plaintiffs have failed to
establish Article III standing to pursue a claim under the Privacy Act.
2. Even If Plaintiffs Could Establish Standing, They Have Not Plausibly Alleged a Violation of the Privacy Act
Were standing no obstacle, plaintiffs’ Privacy Act claim would still fail because plaintiffs
have not adequately alleged a violation of the statute. For every plaintiff except Roe #3, the statute
does not authorize recovery of damages for the violation alleged. For Roe #3, the complaint fails
to adequately allege key elements of the claim.
The Privacy Act provides that “[n]o agency shall disclose any record which is contained in
a system of records by any means of communication to any person, or to another agency, except
pursuant to a written request by, or with the prior written consent of, the individual to whom the
record pertains” in the absence of exceptions not relevant in this case. See 5 U.S.C. § 552a(b).
Plaintiffs state that “[o]n information and belief, DHS and ICE specifically, did not establish
appropriate administrative, technical, and physical safeguards to prevent the data breach.” FAC
¶ 119.
The first problem for plaintiffs is that “the Privacy Act protects only ‘individuals.’” Soto
v. United States Dep’t of State, 244 F. Supp. 3d 207, 208 (D.D.C. 2017) (citing 5 U.S.C.
§§ 552a(b)–(f)). And it defines an individual to be “a citizen of the United States or an alien
lawfully admitted for permanent residence.” 5 U.S.C. § 552a(a)(2). To be sure, the Judicial
15 Redress Act expanded the right to pursue claims under the Privacy Act to citizens of designated
foreign countries or regional economic integration organizations. See Judicial Redress Act of
2015, Pub. L. No. 114-126, 130 Stat. 282 (2016). The Attorney General is authorized to make
such designations. Judicial Redress Act, § 2(d)(1); see also 82 Fed. Reg. 7860 (Jan. 23, 2017).
However, plaintiffs acknowledge that none of the plaintiffs are citizens of designated countries
except for plaintiff Roe #3, who is a citizen of France. Pls.’ Opp’n at 16; FAC ¶¶ 17, 97, 118, 143.
Accordingly, in response to defendants’ Motion to Dismiss, plaintiffs conceded “Plaintiffs ROE
#1-#2, and ROE #4-#49 do not state viable Privacy Act claims.” Pls.’ Opp’n at 17.6 However,
plaintiffs still maintain that Roe #3 states a viable claim.
But even Roe #3’s Privacy Act claim must fail because the FAC does not plausibly allege
a claim under the Act. The D.C. Circuit has explained that “[t]o unlock the Privacy Act’s waiver
of sovereign immunity and state a cognizable claim for damages, a plaintiff must allege that (i) the
agency ‘intentional[ly] or willful[ly]’ violated the Act’s requirements for protecting the
confidentiality of personal records and information; and (ii) she sustained ‘actual damages’ (iii)
‘as a result of’ that violation.” OPM Breach Litig., 928 F.3d at 62 (alterations in the original)
(quoting 5 U.S.C. § 552a(g)(4)). In this context, “willfulness means more than ‘gross
negligence.’” Id. (quoting Maydak v. United States, 630 F.3d 166, 179 (D.C. Cir. 2010)).
Therefore, “[a]llegations . . . that errors were ‘inadvertent[]’ will not suffice.” Id. (alteration in the
original) (quoting Maydak, 630 F.3d at 180). As for “actual damages,” that refers only “to proven
pecuniary or economic harm.” Id. at 64 (citing Federal Aviation Admin. v. Cooper, 566 U.S. 284,
6 Plaintiffs at first acknowledged that only Roe #3 had a statutory right to pursue civil remedies under the Privacy Act but contended that “other Plaintiffs are deserving of the same rights as ROE #3 under the Accardi doctrine.” FAC ¶ 143. But courts cannot disregard federal statutes to serve general notions of fairness. Any contention to the contrary pushes the boundary of what can be considered “a nonfrivolous argument for extending, modifying, or reversing existing law or for establishing new law.” See Fed. R. Civ. P. 11(b)(2).
16 298–299 (2012)). This “actual pecuniary loss” “must be specially pleaded and proved.” Cooper,
556 U.S. at 295.
Here, plaintiffs have failed to adequately allege either willfulness or actual damages. There
is nothing in plaintiffs’ complaint to suggest that “the agency’s security failures were ‘in flagrant
disregard of [their] rights under the Act,’ were left in place ‘without grounds for believing them to
be lawful,’ or were ‘so patently egregious and unlawful that anyone undertaking the conduct
should have known it unlawful.’” OPM Breach Litig., 928 F.3d at 63 (quoting Maydak, 630 F.3d
at 179). Indeed, plaintiffs do not attempt to argue that they have alleged facts showing willfulness.
In arguing that their complaint alleged a willful violation, plaintiffs cite only two passages, which
read: “Whether the actions of Defendant JOHN DOE 1 were intentional or willful?” and “What
caused ICE to release a statement determining the data breach was ‘unintentional’ before the
conclusion [of] its investigation?” Pls.’ Opp’n 17 (quoting FAC ¶¶ 110(b), 110(h)). These
passages are drawn from the “Common Questions of Law and Fact” section in which the plaintiffs
seek to establish the existence of a class. But there is a difference between a mere question and a
factual allegation. To survive a motion to dismiss, a plaintiff’s complaint must “contain sufficient
factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.’” Iqbal, 556
U.S. at 678 (quoting Twombly, 550 U.S. at 570). Plaintiffs have both styled and labeled these
sentences as questions. These are not rhetorical or suggestive questions, but instead take the form
of open questions whose answers are unknown to plaintiffs. They are not “factual matter” that the
Court must accept in considering whether plaintiffs have adequately pleaded a claim. Plaintiffs
have therefore failed to allege the willfulness element necessary for a claim under the Privacy Act.
Neither have plaintiffs alleged that Roe #3 incurred actual damages. Plaintiffs state that
they “face[]”actual damages because the data breach will make it easier for persecutors to locate
17 them, thus “imposing a lifetime of added security needs that will be expensive to meet.”
FAC ¶ 120. In particular, they may need to “adopt a nomadic lifestyle,” “purchase security
systems, change door and window locks, private mailboxes or obtain other protection to ensure
their physical safety,” and “incur costs related to legally changing their name.” Id. ¶ 121. They
“may also require counseling to process their experience.” Id. ¶ 122. But this litany consists only
of speculative, future costs. Plaintiffs speak of costs they “may” need to incur in the future, not
costs that Roe #3 has already experienced. Plaintiffs have thus failed to allege “proven pecuniary
or economic harm.” See OPM Breach Litig., 928 F.3d at 64.
Therefore, even if Roe #3 has standing, plaintiffs have failed to adequately plead the only
claim over which the Court has subject matter jurisdiction.
D. Plaintiffs’ Pending Motions to Certify a Class and to Compel Are Moot
“Under Article III of the United States Constitution,” a federal court “‘may only adjudicate
actual, ongoing controversies.’” D.C. v. Doe, 611 F.3d 888, 894 (D.C. Cir. 2010) (quoting Honig
v. Doe, 484 U.S. 305, 317 (1988)). As the Court concludes that it must dismiss this action for
lack of subject matter jurisdiction and failure to state a claim, plaintiffs’ pending motions to certify
a class and to compel do not concern an ongoing controversy. They must therefore be denied as
moot.