Asylum Seekers Trying to Assure Their Safety v. Johnson

Opinion

UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLUMBIA

ASYLUM SEEKERS TRYING TO ASSURE THEIR SAFETY, et al.,

Plaintiffs, v. Case No. 1:23-cv-163-RCL

PATRICK “P.J.” LECHLEITNER, in his official capacity as Acting Director of U.S. Immigration and Customs Enforcement, et al.,

Defendants.

MEMORANDUM OPINION

This case arises out of an incident in which an employee of U.S. Immigration and Customs Enforcement (ICE), an agency of the Department of Homeland Security, posted to the agency’s public-facing website information concerning 6,252 noncitizens currently or formerly in ICE custody. Forty-nine of these individuals have now sued Patrick “P.J.” Lechleitner, in his official capacity as Acting Director of ICE,1 Alejandro Mayorkas, in his official capacity as Secretary of Homeland Security, Merrick Garland, in his official capacity as Attorney General of the United States, and John Doe 1, the ICE employee who allegedly posted the information, in their official capacity as an ICE employee.

Defendants have moved to dismiss plaintiffs’ First Amended Complaint (FAC), ECF No.

6. The Court concludes it must dismiss the complaint in its entirety. Plaintiffs lack Article III standing to seek injunctive or declaratory relief, and three of their four claims for damages are

1 Plaintiffs initially named Tae D. Johnson but substituted Mr. Lechleitner as a named party under Federal Rule of Civil Procedure 25(d). See ECF No. 50.

2

barred by sovereign immunity. Plaintiffs also lack Article III standing to pursue the remaining claim, for violation of the Privacy Act, and in any event have failed to state a claim upon which relief can be granted.

In dismissing this action, the Court does not downplay the gravity of ICE’s alleged failure to safeguard the data of vulnerable people in its custody. But for the reasons discussed below, the Court must GRANT defendants’ motion to dismiss plaintiffs’ complaint in its entirety. Since the Court will dismiss plaintiffs’ action, it must also DENY AS MOOT plaintiffs’ pending motions to certify a class and to compel. However, it will GRANT plaintiffs’ motion for leave to file a document under seal.

I. BACKGROUND

A. Factual Background Plaintiffs are non-United States citizens who came to the United States to seek asylum and were then detained by ICE. FAC ¶ 2. They hail from Colombia, the Dominican Republic, Ecuador, El Salvador, France, Guatemala, Haiti, Honduras, India, Jamaica, Mexico, Nicaragua, Peru, Tunisia, and Venezuela. Id. ¶ 1. Many fled their native lands to escape “gang violence, government retaliation, and persecution on the basis of protected grounds.” Id. ¶ 6. By now, plaintiffs are at various stages in the asylum process. Some have already had their asylum claims adjudicated, some have submitted an application that is awaiting adjudication, and some have not yet submitted an application. Id. ¶ 3. Some but not all plaintiffs are still detained by ICE. Id. ¶ 1.

On November 28, 2022, ICE employee John Doe 1 allegedly posted a document containing the names, other personally identifiable information, and immigration information of 6,252 noncitizens currently or formerly in ICE custody, including plaintiffs, to the agency’s public- facing website. Id. ¶ 68. For about five hours, the information remained up on the website, where

3

it “was able to be downloaded, copied, captured by screenshot, and otherwise preserved by the public.” Id. ¶¶ 71–72.

Two days later, ICE acknowledged the release of information and explained that after this “breach of policy,” “the agency [was] investigating the incident and taking all corrective actions necessary.” Id. ¶ 73. ICE has since announced a range of mitigation efforts. See Exhibit B, ECF No. 6-2 (“FAQ”). For one thing, ICE has sought to separately notify each affected individual.2 Id. 2. ICE also delayed the removal of affected noncitizens, initially for 30 days, id., and then indefinitely “to allow them time to further discuss their options with a legal representative.” FAC ¶ 82. ICE also sent “clawback” letters to “all external entities or individuals that may have downloaded, received, or accessed the document” requesting that recipients destroy the document and refrain from using or disclosing the information it contained. FAQ at 4. Finally, ICE has committed to affording all affected noncitizens an opportunity to raise the data breach issue in removal proceedings, so that they can argue for asylum on the basis that the breach created a danger that their persecutors will use the information to target them should they be deported. See FAQ 2–4; FAC ¶ 87.3 B. Procedural Background Plaintiffs filed their complaint in January, 2023. See Complaint, ECF No. 1. On February 17, they filed the First Amended Complaint. See FAC. Plaintiffs bring four claims. First, plaintiffs

2 All of the plaintiffs received written notice from ICE. Declaration in Support of Pls.’ Mot. for Class Certification, ECF Nos. 16-1–16-49. 3 Plaintiffs allege that another breach occurred in December 2022. They state that DHS informed the Government of Cuba that some of the 103 Cuban nationals awaiting removal from the United States to Cuba were among the individuals who data was leaked in the November 28 breach—and thus revealed to the Cuban authorities that some of the individuals due to be removed to Cuba had sought asylum. FAC ¶ 78. Plaintiffs allege that forty-six of the individuals had in fact been named in the November leak, and that after the December incident ICE released some or all of the 103 affected individuals. Id. However, plaintiffs have not alleged that any of the plaintiffs belong to this group of forty-six people. Plaintiffs have apparently included this allegation to show DHS and ICE’s laxity on information security, rather than to allege a separate violation of the law.

4

allege that defendants violated the Privacy Act of 1974 because DHS and ICE “did not establish appropriate administrative, technical, and physical safeguards to prevent the data breach” (First Claim for Relief). FAC ¶ 119. Second, plaintiffs assert a claim under the Administrative Procedure Act for a host of reasons, including that “Defendants’ failure to safeguard plaintiffs’ personal information from public disclosure constitutes agency action taken not in accordance with the law” (Second Claim for Relief). Id. ¶ 127. Third, plaintiffs venture a freestanding claim for violation of the Accardi doctrine, according to which an administrative agency must follow its own regulations and procedures (Third Claim for Relief). Id. ¶¶ 133–34; see also United States ex rel. Accardi v. Shaughnessy, 347 U.S. 260 (1954). Fourth, plaintiffs assert that defendants violated “equal protection principles of the Fourteenth Amendment, embedded in the Due Process Clause of the Fifth Amendment” by breaching “affirmative duties of care and protection” (Fourth Claim for Relief). Id. ¶¶ 147–48 (quoting DeShaney v. Winnebago Cnty. Dep’t of Soc. Servs., 489 U.S. 189, 198 (1989)).

As for remedies, plaintiffs seek money damages, see FAC, Prayer for Relief ¶¶ H–I, as well as a declaration that the defendants violated the Privacy Act, the APA, and the Constitution. Id. ¶ B. Plaintiffs also seek wide-ranging injunctive relief against ICE and the Department of Justice. They ask for the Court to order ICE “to extend the original 30-day stay of removal for all impacted individuals to one year,” notify those who opted out of the initial stay “that they may take advantage of the additional stay,” and “cease the removal of Plaintiffs, and others similarly situated until their asylum and withholding of removal claims can be re-adjudicated, with the presumption of risk of danger created by the data breach and a presumption that each asylee’s fear is well-founded.” Id. ¶¶ C–D. In addition, they request that the Court order “DOJ”4 “to rescind

4 The Department of Justice is not a party to this case. The plaintiffs apparently have in mind the Attorney General, who has been named a defendant in his official capacity.

5

removal orders and reopen removal proceedings” for affected individuals, “to extend accommodations to Plaintiffs and others similarly situated so that the merits of any application for asylum, withholding of removal, and/or protection under the Convention Against Torture can be considered or reconsidered in light of the data breach, with the presumption of risk of danger created by the data breach and a presumption that each asylee’s fear is well-founded,” and “to instruct immigration judges to take administrative notice to recognize a presumption of risk of danger created by the data breach and a presumption that each asylee’s fear is well-founded.” Id. ¶¶ C–G.

Defendants moved to dismiss the FAC in its entirety for lack of subject matter jurisdiction under Federal Rule of Civil Procedure 12(b)(1) and failure to state a claim under Rule 12(b)(6). See MTD, ECF No. 33. Plaintiffs filed a response, see Pls.’ Opp’n, ECF No. 39, to which defendants filed a reply, see Defs.’ Reply, ECF No. 45. In addition, the Immigration Reform Law Institute moved for leave to file an amicus curiae brief, which the Court granted. See IRLI Amicus, ECF No. 51.5 Plaintiffs have twice filed notices of change in material facts. See ECF No. 46; ECF No. 49.

Three other motions are pending. First, plaintiffs moved to certify a class under Federal Rule of Civil Procedure 23. See ECF No. 16. The Court deferred ruling on that matter. See ECF No. 36. Second, plaintiffs moved to compel defendants to produce a “certified list of the administrative record” pursuant to Local Civil Rule 7(n). See ECF No. 34. Defendants filed a response, see ECF No. 41, and plaintiffs filed a reply, see ECF No. 43. Third, plaintiffs have filed a sealed motion for leave to file under seal exhibits relating to the second notice of change in material facts. See ECF No. 47.

5 Because the Court does not reach the merits of plaintiffs’ constitutional claims, it will not consider the arguments advanced by amicus.

6

II. LEGAL STANDARDS

C. Federal Rule of Civil Procedure 12(b)(1)

A defendant in a civil action may move to dismiss a complaint under Federal Rule of Civil Procedure 12(b)(1) for lack of subject-matter jurisdiction. See Fed. R. Civ. P. 12(b)(1). If the Court lacks subject matter jurisdiction, it must dismiss the claim or action. Fed. R. Civ. P. 12(h)(3). Article III of the Constitution vests in the federal court authority to adjudicate “Cases” and “Controversies.” U.S. Const., art. III, § 2. For a lower federal court to have subject-matter jurisdiction over a case or controversy, Congress must provide such jurisdiction by statute within the bounds of the Constitution’s grant of jurisdiction. Kokkonen v. Guardian Life Ins. Co. of Am., 511 U.S. 375, 377 (1994).

A court considering a motion to dismiss for lack of subject matter jurisdiction must take all the well-pleaded allegations in the complaint as true and draw all reasonable inferences in the plaintiff’s favor. Doe v. Wash. Metro. Area Transit Auth., 453 F. Supp. 3d 354, 361 (D.D.C. 2020). “However, those factual allegations receive closer scrutiny than they do in the Rule 12(b)(6) context,” and the court “may look to documents outside of the complaint in order to evaluate whether or not it has jurisdiction to entertain a claim.” Id. (internal quotation marks and citations omitted). It is the “[p]laintiff [who] bears the burden of proving subject matter jurisdiction by a preponderance of the evidence.” Am. Farm Bureau v. EPA, 121 F. Supp. 2d 84, 90 (D.D.C. 2000).

D. Federal Rule of Civil Procedure 12(b)(6)

A defendant in a civil action may also move to dismiss a complaint under Federal Rule of Civil Procedure 12(b)(6) for “failure to state a claim upon which relief can be granted.” See Fed. R. Civ. P. 12(b)(6). To survive a Rule 12(b)(6) motion, a complaint must contain sufficient factual allegations, accepted as true, to “state a claim to relief that is plausible on its face.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)).

7

A claim is plausible on its face if it “pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Id. A court evaluating a Rule 12(b)(6) “motion presumes that the complaint’s factual allegations are true and construes them liberally in the plaintiff's favor.” Alemu v. Dep’t of For-Hire Vehicles, 327 F. Supp. 3d 29, 40 (D.D.C. 2018). However, “[a] court need not accept a plaintiff’s legal conclusions as true, . . . nor must a court presume the veracity of legal conclusions that are couched as factual allegations.” Id. (citation omitted).

III. DISCUSSION

The Court concludes that it lacks subject matter jurisdiction to entertain this action.

Plaintiffs lack Article III standing to seek injunctive or declaratory relief because they have not alleged an ongoing or future violation of their rights by defendants. And plaintiffs’ claims for money damages under the APA, Accardi, and the Due Process Clause are barred by sovereign immunity because Congress has not consented to such suits. Plaintiffs’ Privacy Act claim fails because they have not established Article III standing to seek damages under the Act. Even if they have standing, they have not plausibly alleged a cognizable violation of the statute.

A. Plaintiffs Lack Standing to Seek Injunctive or Declaratory Relief The Court lacks jurisdiction to entertain plaintiffs’ claims for injunctive or declaratory relief because plaintiffs lack Article III standing to seek such relief.

“The doctrine of standing implements” the requirement of an Article III case or controversy “by insisting that a litigant ‘prove that he has suffered a concrete and particularized injury that is fairly traceable to the challenged conduct, and is likely to be redressed by a favorable judicial decision.’” Carney v. Adams, 141 S. Ct. 493, 498 (2020) (quoting Hollingsworth v. Perry, 570 U.S. 693, 704 (2013)). A litigant may have standing to pursue certain forms of relief but not others. See, e.g., Friends of the Earth, Inc. v. Laidlaw Env’t Servs. (TOC), Inc., 528 U.S. 167, 185

8

(2000) (“[A] plaintiff must demonstrate standing separately for each form of relief sought.”). “[A]t the pleading stage, a plaintiff must allege facts demonstrating each element” of standing. Friends of Animals v. Jewell, 828 F.3d 989, 992 (D.C. Cir. 2016). If the plaintiff lacks standing, the court lacks subject matter jurisdiction. Haase v. Sessions, 835 F.2d 902, 906 (D.C. Cir. 1987). Here, defendants correctly argue that “Plaintiffs lack standing to seek declaratory and injunctive relief because they allege a past legal harm (the inadvertent disclosure), not an ongoing alleged violation or imminent future violation.” MTD at 1.

To the extent plaintiffs seek injunctive and declaratory relief, this case is squarely controlled by Supreme Court and D.C. Circuit precedent. In City of Los Angeles v. Lyons, a plaintiff brought a civil rights action against the City of Los Angeles and certain police officers, alleging that L.A. police had subjected him to an unconstitutional chokehold after stopping him for a traffic violation, and that L.A. had authorized police officers to routinely apply unwarranted chokeholds. 461 U.S. 95, 97–98 (1983). Lyons sought damages as well as injunctive and declaratory relief. Id. at 98. The Supreme Court held that because Lyons was not immediately threatened by the prospect of another chokehold, he had “failed to demonstrate a case or controversy . . . that would justify the equitable relief sought.” Id. at 105. In coming to this conclusion, the Court emphasized that “[p]ast exposure to illegal conduct does not in itself show a present case or controversy regarding injunctive relief . . . if unaccompanied by any continuing, present adverse effects.” Id. at 102 (quoting O’Shea v. Littleton, 414 U.S. 488, 495–96 (1974)) (alternation in original).

Applying Lyons, the D.C. Circuit has explained that “[t]o pursue an injunction or a declaratory judgment,” plaintiffs “must allege a likelihood of future violations of their rights by” the defendant, “not simply future effects from past violations.” Fair Emp. Council of Greater

9

Washington, Inc. v. BMC Mktg. Corp., 28 F.3d 1268, 1273 (D.C. Cir. 1994); see also Dearth v. Holder, 641 F.3d 499, 501 (D.C. Cir. 2011) (“In a case of this sort, where the plaintiffs seek declaratory and injunctive relief, past injuries alone are insufficient to establish standing. Rather, Dearth must show he is suffering an ongoing injury or faces an immediate threat of injury.”); Black Lives Matter D.C. v. Trump, 544 F. Supp. 3d 15, 36 (D.D.C. 2021) (applying holding of Fair Emp. Council of Greater Washington), aff’d sub nom. Buchanan v. Barr, 71 F.4th 1003 (D.C. Cir. 2023).

Here, plaintiffs do not seek injunctive or declaratory relief to remedy future violations of their rights by the defendants. Plaintiffs argue that they have “never alleged the injury was the publishing of their [personally identifiable information] itself,” but rather that the leak put plaintiffs in danger by providing their “persecutors with information that makes it easier for Plaintiffs to be located today or in the future.” See Pls.’ Opp’n at 10–11; FAC ¶¶ 6, 120–22, 131. But that means plaintiffs do not “allege a likelihood of future violations of their rights by” the governmental defendants, but instead seek relief addressed at “future effects” (i.e., harm by third parties) “from past violations” by ICE. See Fair Emp. Council of Greater Washington, 28 F.3d at 1273. And although plaintiffs suggest they may suffer emotional distress from the future effects of the leak, FAC ¶ 122, “[t]he emotional consequences of a prior act simply are not a sufficient basis for an injunction absent a real and immediate threat of future injury by the defendant.” Lyons, 461 U.S. at 107 n.8.

Perhaps sensing a need to tie their harm to future action by the defendants rather than third parties, plaintiffs justify their standing to seek injunctive and declaratory relief because “DHS must be held accountable to end what appears to be a Department-wide culture of disregarding the privacy of asylum seekers.” Pls.’ Opp’n at 11 (quoting FAC ¶ 8). But under Lyons, standing to seek such relief cannot be premised on a desire to hold the government “accountable” for harmful

10

practices, even if widespread. See Lyons, 461 U.S. at 108 (noting that although L.A. police may continue to use illegal chokeholds, “it is surely no more than speculation to assert” that Lyons himself would face the risk of a chokehold in the future).

Finally, plaintiffs cannot evade Lyons by recasting their allegations about past violations as a challenge to ongoing agency failures. Plaintiffs object to “ICE’s failure to sufficiently address the harm the agency caused” and “DOJ’s failure to account for the harms to Plaintiffs and proceed with removal processes despite those harms.” See FAC ¶¶ 129–30. But they have not explained how either of these failures to adequately “address” or “account for” the harm plaintiffs experienced in the data breach are themselves violations of plaintiffs’ rights. And if “the injury ICE’s victims face was not incurred in the moment of Defendants’ unlawful act,” Pls.’ Opp’n at 10, then it is unclear how ICE’s inadequate mitigation of the non-injury could itself be an injury sufficient for Article III standing. And even if plaintiffs had alleged an injury from the data breach itself, inadequate mitigation of the effects of a past harm is not necessarily itself a continuing harm. Indeed, plaintiffs do not allege that the mitigation efforts themselves violate any specific legal right; plaintiffs simply label these responses “not in accordance with the law” and “an abuse of discretion.” See FAC ¶¶ 129–30.

In light of Lyons and its progeny, plaintiffs lack standing to seek injunctive or declaratory relief. The Court, then, may not entertain these requests for relief.

11

B. Sovereign Immunity Bars Plaintiffs’ Claims Under the APA, Accardi, and the Due Process Clause, But Not Plaintiffs’ Claims under the Privacy Act

Plaintiffs’ claims for damages fare only slightly better. Sovereign immunity bars plaintiffs’

claims under the APA, Accardi, and the Due Process Clause. However, it does not bar plaintiffs’ claims under the Privacy Act.

“Absent [consent by the federal government] the doctrine of sovereign immunity shields the federal government from suit” by depriving courts of jurisdiction. Tri-State Hosp. Supply Corp. v. United States, 341 F.3d 571, 575 (D.C. Cir. 2003). Sovereign immunity does not just protect employers; it also “bar[s] suits for money damages against officials in their official capacity absent a specific waiver by the government.” Clark v. Libr. of Cong., 750 F.2d 89, 103 (D.C. Cir. 1984). Since plaintiffs have sued the defendants in their official capacity, sovereign immunity clearly bars all of plaintiffs’ claims for money damages, except for the Privacy Act claim—as plaintiffs concede, see Pls.’ Opp’n at 16–17 (“[I]f Defendants wish to use the sovereign immunity defense to only pay damages exclusively to ROE #3, and other victims from predominantly white European countries, when most of their victims are Black and Brown and from predominantly non-white countries in the Global South, plaintiffs concede that is something they can lawfully do.”).

First, plaintiffs’ APA claim is clearly barred by sovereign immunity. In 1976, Congress amended the APA to effect a broad waiver of sovereign immunity for certain suits against federal agencies “seeking relief other than money damages.” See 5 U.S.C. § 702 (emphasis added). Here, plaintiffs are seeking money damages from the United States, which is plainly beyond the scope of the APA’s waiver of sovereign immunity. Second, even if plaintiffs have a cause of action under Accardi, any such suit for money damages would be barred by sovereign immunity because plaintiffs have failed to identify a Congressional waiver of sovereign immunity for such claims.

12

Third, “it is well settled ‘that Congress has not waived immunity for suits seeking monetary damages that arise under the Constitution.’” Scinto v. Fed. Bureau of Prisons, 608 F. Supp. 2d 4, 9 (D.D.C.) (quoting Zinda v. Johnson, 463 F. Supp. 2d 45, 48–49 (D.D.C. 2006), aff’d, 352 F. App’x 448 (D.C. Cir. 2009). Therefore, the Court lacks jurisdiction to entertain plaintiffs’ claims for money damages under the APA, Accardi, or the Constitution.

As for plaintiffs’ claims for damages under the Privacy Act, however, defendants concede that this statute does indeed waive sovereign immunity. MTD at 21; see In re U.S. Office of Pers. Mgmt. Data Sec. Breach Litig. (OPM Breach Litig.), 928 F.3d 42, 61 (D.C. Cir. 2019) (“The Privacy Act waives sovereign immunity by expressly authorizing a cause of action for damages against federal agencies that violate its rules protecting the confidentiality of private information in agency records.”).

C. Plaintiffs Lack Article III Standing to Sue Under the Privacy Act Plaintiffs have failed to establish Article III standing to bring their Privacy Act claim.

Alternatively, even if they have standing they have failed to state a claim upon which relief can be granted.

1. Plaintiffs Lack Standing to Sue Under the Privacy Act Since plaintiffs say their injury is not the leak of their information but instead the risk that persecutors will one day use this information to target them, they have failed to sufficiently allege Article III standing to pursue a remedy under the Privacy Act.

“To qualify for standing, a claimant must present an injury that is [1] concrete, particularized, and actual or imminent; [2] fairly traceable to the defendant’s challenged behavior; and [3] likely to be redressed by a favorable ruling.” Davis v. Fed. Election Comm’n, 554 U.S. 724, 733 (2008). If the purported injury were the disclosure of private information, plaintiffs might have standing. As the Supreme Court recently observed, one example of an intangible harm that

13

is nonetheless concrete is “disclosure of private information.” TransUnion LLC v. Ramirez, 141 S. Ct. 2190, 2204 (2021) (citing Davis, 554 U.S. at 733). It would seem that plaintiffs suffered a concrete, particularized, and actual injury, redressable through damages, when ICE released private information related to them. One could argue that this harm is fairly traceable at least to John Doe #1, the Director of ICE, and the Secretary of Homeland Security.

However, plaintiffs have expressly disclaimed reliance on the breach itself as their injury.

See Pls.’ Opp’n at 10 (“Plaintiffs never alleged the injury was the publishing of their [personally identifiable information] itself . . . . [T]he injury ICE’s victims face was not incurred in the moment of Defendants’ unlawful act”). Instead, plaintiffs argue that “[a]s a result of Defendants’ actions, Plaintiffs have an enhanced risk of injury” in the future from persecutors who may have greater ability and motivation to harm them because of the breach. See Pls.’ Opp’n at 10–11; FAC ¶¶ 6, 120–22, 131. Plaintiffs do not have Article III standing based on the future risk that persecutors will harm them because they have not met their burden to allege facts demonstrating any of the three elements of standing. See Friends of Animals, 828 F.3d at 992.

First, an injury must be “actual or imminent, not ‘conjectural’ or ‘hypothetical.’” Lujan v.

Defs. of Wildlife, 504 U.S. 555, 560 (1992) (quoting Whitmore v. Arkansas, 495 U.S. 149, 155 (1990)). A theory based on a “speculative chain of possibilities” does not suffice. See Clapper v. Amnesty Int’l USA, 568 U.S. 398, 414 (2013). Here, plaintiffs’ theory of future injury is “riddled with contingencies and speculation.” Trump v. New York, 141 S. Ct. 530, 535 (2020). For instance, they state that they will be at increased risk of retaliation even within the United States, FAC ¶ 121, without offering facts to indicate a realistic possibility of asylees being tracked down and attacked by persecutors on American soil. And although plaintiffs state that they “face a real risk of persecution and/or death if they are forced to return to their home countries where, as a

14

result of the data breach, the foreign governments may know or learn that they sought asylum in the U.S.,” id. ¶ 120, they do not explain why foreign persecutors would subject them to additional harm for having sought asylum in the United States.

Another problem for plaintiffs is causation. “[T]he injury has to be ‘fairly . . . trace[able]

to the challenged action of the defendant, and not . . . th[e] result [of] the independent action of some third party not before the court.’” Lujan, 504 U.S. at 560–61 (alterations in the original) (quoting Simon v. Eastern Ky. Welfare Rights Organization, 426 U.S. 26, 41–42 (1976)). To establish a sufficient chain of causation between the governmental act and the conduct of third parties, a plaintiff’s theory of standing cannot “rest on mere speculation about the decisions of third parties” but instead must rely “on the predictable effect of Government action on the decisions of third parties.” See Dep’t of Com. v. New York, 139 S. Ct. 2551, 2566 (2019); see also Clapper, 568 U.S. at 414 (noting the Supreme Court’s “usual reluctance to endorse standing theories that rest on speculation about the decisions of independent actors”); Allen v. Wright, 468 U.S. 737, 753, 759 (1984) (concluding that an “alleged injury is not fairly traceable to the assertedly unlawful conduct of the” government when the link between the injury and the government’s conduct involves an attenuated “chain of causation” involving third parties). In this case, plaintiffs’ theory that the data breach will lead persecutors to target them relies on several intervening steps, including the persecutors being willing and able to target them for having sought asylum and the persecutors obtaining access to the leaked information. At each stage, plaintiffs can only speculate about what the third parties will do. Plaintiffs have therefore not established that the “predictable effect” of ICE’s data breach “on the decisions of third parties” will result in injury to plaintiffs. See Dep’t of Com., 139 S. Ct. at 2566.

15

For similar reasons, it is not “‘likely,’ as opposed to merely ‘speculative,’ that the injury will be ‘redressed by a favorable decision.’” Lujan, 504 U.S. at 561 (quoting Simon, 426 U.S. at 38, 43). While money damages could be used to pay for such protective steps as purchasing security systems, see FAC ¶ 121, and such mitigation measures as counseling, id. ¶ 122, plaintiffs have not alleged that they will likely do any of these things, only that they “may” do so.

By asserting the risk of future harm by third parties as their injury, plaintiffs have failed to establish Article III standing to pursue a claim under the Privacy Act.

2. Even If Plaintiffs Could Establish Standing, They Have Not Plausibly Alleged a Violation of the Privacy Act

Were standing no obstacle, plaintiffs’ Privacy Act claim would still fail because plaintiffs have not adequately alleged a violation of the statute. For every plaintiff except Roe #3, the statute does not authorize recovery of damages for the violation alleged. For Roe #3, the complaint fails to adequately allege key elements of the claim.

The Privacy Act provides that “[n]o agency shall disclose any record which is contained in a system of records by any means of communication to any person, or to another agency, except pursuant to a written request by, or with the prior written consent of, the individual to whom the record pertains” in the absence of exceptions not relevant in this case. See 5 U.S.C. § 552a(b). Plaintiffs state that “[o]n information and belief, DHS and ICE specifically, did not establish appropriate administrative, technical, and physical safeguards to prevent the data breach.” FAC ¶ 119.

The first problem for plaintiffs is that “the Privacy Act protects only ‘individuals.’” Soto v. United States Dep’t of State, 244 F. Supp. 3d 207, 208 (D.D.C. 2017) (citing 5 U.S.C. §§ 552a(b)–(f)). And it defines an individual to be “a citizen of the United States or an alien lawfully admitted for permanent residence.” 5 U.S.C. § 552a(a)(2). To be sure, the Judicial

16

Redress Act expanded the right to pursue claims under the Privacy Act to citizens of designated foreign countries or regional economic integration organizations. See Judicial Redress Act of 2015, Pub. L. No. 114-126, 130 Stat. 282 (2016). The Attorney General is authorized to make such designations. Judicial Redress Act, § 2(d)(1); see also 82 Fed. Reg. 7860 (Jan. 23, 2017). However, plaintiffs acknowledge that none of the plaintiffs are citizens of designated countries except for plaintiff Roe #3, who is a citizen of France. Pls.’ Opp’n at 16; FAC ¶¶ 17, 97, 118, 143. Accordingly, in response to defendants’ Motion to Dismiss, plaintiffs conceded “Plaintiffs ROE #1-#2, and ROE #4-#49 do not state viable Privacy Act claims.” Pls.’ Opp’n at 17.6 However, plaintiffs still maintain that Roe #3 states a viable claim.

But even Roe #3’s Privacy Act claim must fail because the FAC does not plausibly allege a claim under the Act. The D.C. Circuit has explained that “[t]o unlock the Privacy Act’s waiver of sovereign immunity and state a cognizable claim for damages, a plaintiff must allege that (i) the agency ‘intentional[ly] or willful[ly]’ violated the Act’s requirements for protecting the confidentiality of personal records and information; and (ii) she sustained ‘actual damages’ (iii) ‘as a result of’ that violation.” OPM Breach Litig., 928 F.3d at 62 (alterations in the original) (quoting 5 U.S.C. § 552a(g)(4)). In this context, “willfulness means more than ‘gross negligence.’” Id. (quoting Maydak v. United States, 630 F.3d 166, 179 (D.C. Cir. 2010)). Therefore, “[a]llegations . . . that errors were ‘inadvertent[]’ will not suffice.” Id. (alteration in the original) (quoting Maydak, 630 F.3d at 180). As for “actual damages,” that refers only “to proven pecuniary or economic harm.” Id. at 64 (citing Federal Aviation Admin. v. Cooper, 566 U.S. 284,

6 Plaintiffs at first acknowledged that only Roe #3 had a statutory right to pursue civil remedies under the Privacy Act but contended that “other Plaintiffs are deserving of the same rights as ROE #3 under the Accardi doctrine.” FAC ¶ 143. But courts cannot disregard federal statutes to serve general notions of fairness. Any contention to the contrary pushes the boundary of what can be considered “a nonfrivolous argument for extending, modifying, or reversing existing law or for establishing new law.” See Fed. R. Civ. P. 11(b)(2).

17

298–299 (2012)). This “actual pecuniary loss” “must be specially pleaded and proved.” Cooper, 556 U.S. at 295.

Here, plaintiffs have failed to adequately allege either willfulness or actual damages. There is nothing in plaintiffs’ complaint to suggest that “the agency’s security failures were ‘in flagrant disregard of [their] rights under the Act,’ were left in place ‘without grounds for believing them to be lawful,’ or were ‘so patently egregious and unlawful that anyone undertaking the conduct should have known it unlawful.’” OPM Breach Litig., 928 F.3d at 63 (quoting Maydak, 630 F.3d at 179). Indeed, plaintiffs do not attempt to argue that they have alleged facts showing willfulness. In arguing that their complaint alleged a willful violation, plaintiffs cite only two passages, which read: “Whether the actions of Defendant JOHN DOE 1 were intentional or willful?” and “What caused ICE to release a statement determining the data breach was ‘unintentional’ before the conclusion [of] its investigation?” Pls.’ Opp’n 17 (quoting FAC ¶¶ 110(b), 110(h)). These passages are drawn from the “Common Questions of Law and Fact” section in which the plaintiffs seek to establish the existence of a class. But there is a difference between a mere question and a factual allegation. To survive a motion to dismiss, a plaintiff’s complaint must “contain sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.’” Iqbal, 556 U.S. at 678 (quoting Twombly, 550 U.S. at 570). Plaintiffs have both styled and labeled these sentences as questions. These are not rhetorical or suggestive questions, but instead take the form of open questions whose answers are unknown to plaintiffs. They are not “factual matter” that the Court must accept in considering whether plaintiffs have adequately pleaded a claim. Plaintiffs have therefore failed to allege the willfulness element necessary for a claim under the Privacy Act.

Neither have plaintiffs alleged that Roe #3 incurred actual damages. Plaintiffs state that they “face[]”actual damages because the data breach will make it easier for persecutors to locate

18

them, thus “imposing a lifetime of added security needs that will be expensive to meet.” FAC ¶ 120. In particular, they may need to “adopt a nomadic lifestyle,” “purchase security systems, change door and window locks, private mailboxes or obtain other protection to ensure their physical safety,” and “incur costs related to legally changing their name.” Id. ¶ 121. They “may also require counseling to process their experience.” Id. ¶ 122. But this litany consists only of speculative, future costs. Plaintiffs speak of costs they “may” need to incur in the future, not costs that Roe #3 has already experienced. Plaintiffs have thus failed to allege “proven pecuniary or economic harm.” See OPM Breach Litig., 928 F.3d at 64.

Therefore, even if Roe #3 has standing, plaintiffs have failed to adequately plead the only claim over which the Court has subject matter jurisdiction.

D. Plaintiffs’ Pending Motions to Certify a Class and to Compel Are Moot “Under Article III of the United States Constitution,” a federal court “‘may only adjudicate actual, ongoing controversies.’” D.C. v. Doe, 611 F.3d 888, 894 (D.C. Cir. 2010) (quoting Honig v. Doe, 484 U.S. 305, 317 (1988)). As the Court concludes that it must dismiss this action for lack of subject matter jurisdiction and failure to state a claim, plaintiffs’ pending motions to certify a class and to compel do not concern an ongoing controversy. They must therefore be denied as moot.