Doe v. Bonta

Opinion

JANE DOE, et al, Case No.: 22-cv-10-LAB-DEB

Plaintiffs, ORDER: v. 1) GRANTING MOTION TO ROB BONTA, in his capacity as DISMISS, [Dkt. 36]; Attorney General of the State of California, et al, 2) DENYING MOTION FOR Defendants. PRELIMINARY INJUNCTION [Dkt. 26];

3) DENYING EX PARTE RECONSIDERATION [Dkt. 49]; and 4) GRANTING REQUESTS FOR JUDICIAL NOTICE [Dkt. 49-4, 57] Five California registered gun owners have filed suit to prevent Rob Bonta, Attorney General of the State of California, from enforcing a California law that permits the State to disclose their personal identifying information to bona fide research institutions for the ostensible purposes of preventing gun violence, shooting accidents, and suicide. Plaintiffs ask the Court to enjoin the State from sharing their information and to declare the law, California Assembly Bill 173 (“AB 173”), unconstitutional under the Second and Fourteenth Amendments. The gun owners, all of whom are law abiding citizens who passed background checks, raise four claims. First, they argue that AB 173 violates—or at minimum, chills— their Second Amendment right to keep and bear arms. Second, they maintain that disclosing their personal identifying information to non-government researchers violates privacy protections guaranteed to them by the Fourteenth Amendment. Next, they assert that AB 173 violates their right to due process under the Fourteenth Amendment by retroactively expanding access to their restricted personal information. Their final claim, applicable only to applicants for concealed weapon permits (“CCW”) and holders of such permits, is that federal law preempts AB 173 insofar as AB 173 authorizes disclosure of their social security numbers to third parties in derogation of the federal Privacy Act of 1974. This case began with the Plaintiff gun owners seeking the issuance of a temporary restraining order (“TRO”) forbidding enforcement of the law. Tracking the requirements for emergency injunctive relief, Plaintiffs argued they would be irreparably harmed if their personal information was shared with researchers, that they were likely to prevail on the merits of their lawsuit, and that issuance of a TRO was in the public interest. However, the Court declined to issue a TRO, largely on procedural grounds, because Plaintiffs’ request came 108 days after AB 173 took effect and they made no showing of an emergency that would justify immediate judicial intervention. (Dkt. 22 at 3). Plaintiffs then filed a Motion for Preliminary Injunction, mirroring the arguments they raised in their request for a TRO. The Attorney General opposed the motion and filed his own Motion to Dismiss Plaintiffs’ lawsuit. The Court heard argument on both motions on April 5, 2022. In their opposition to the preliminary injunction, Defendants attached the uncontested declaration of Dr. Trent Simmons. Dr. Simmons is the Research Data Supervisor for the California Department of Justice (“DOJ”). He oversees the section of the DOJ responsible for reviewing requests for information relating to gun and ammunition purchases collected by the Department, and his responsibilities include implementing AB 173. (Dkt. 29-4, Simmons Decl. ¶¶ 5–8). In his declaration, Dr. Simmons explains that researchers who apply for access to data that includes the personal identifying information of registered gun owners, gun and ammunition purchasers, and applicants for CCW permits, must explain how the requested information supports a research project, (id. ¶ 10), and must comply with strict data security measures set by the Federal Bureau of Investigations (“FBI”), (id. ¶ 9). Researchers seeking access to state databases containing personal identifying information must detail their data security protocols, confirm they meet the DOJ’s security requirements, and identify the individual researchers who will use the data. (Id. ¶ 12). Each researcher must also complete a fingerprint background check. (Id. ¶¶ 8, 12). Only two research institutions are currently authorized to view gun owner and purchaser information, one operating under the auspices of the University of California at Davis (“UC Davis”) and the other under the auspices of Stanford University. (Id. ¶¶ 15–17, 21–23). Before publishing any material derived from information in the state databases, researchers must provide the DOJ with a pre-publication manuscript at least ten days before publication. (Id. ¶ 14). The DOJ then reviews the manuscript to ensure no personal identifying information is published directly or in such a manner that identities could be reverse engineered. (Id.). Finally, applicants for access to the databases must agree to report any data breaches. (Id. ¶ 23). To date, no researcher has “ever inadvertently disclosed personal identifying information in data obtained from the [DOJ], or any source, to an unauthorized person or the public.” (Id.). In response to the Court’s questions during argument on the preliminary injunction motion, the Deputy Attorney General representing the State confirmed that the above-described restrictions on access to and disclosure of data in DOJ gun databases remain in force. (Dkt. 43, Mot. Hr’g Tr. at 24:23–31:15). The Court took the motions under submission and both parties subsequently submitted supplemental briefing. Since the April 5 hearing, two notable events occurred. First, on June 23, 2022, the Supreme Court issued its opinion in New York State Rifle & Pistol Ass’n, Inc. v. Bruen, 142 S. Ct. 2111 (2022)—the first major Second Amendment case in a decade. In Bruen, the high court jettisoned what had been a widely accepted “two-step” test for evaluating Second Amendment claims, see, e.g., Duncan v. Bonta, 19 F.4th 1087, 1100 (9th Cir. 2021), in favor of a one-step historical test. 142 S. Ct. at 2126–27. The Court held that the constitutionality of a gun law depends on whether the regulation implicates people, conduct, or arms falling within the “plain text” of the Second Amendment. Id. at 2126. If so, the regulation is presumptively unconstitutional and “the government must [then] affirmatively prove that its firearms regulation is part of the historical tradition” of firearms regulation. Id. at 2127. Regulations lacking such a historical pedigree are inconsistent with the Second Amendment and are unconstitutional. Id. at 2129–30 (“When the Second Amendment’s plain text covers an individual’s conduct, the Constitution presumptively protects that conduct.”). Following the Bruen decision, this Court ordered supplemental briefing to address the implications of Bruen for this case. (Dkt. 47). The second notable event occurred on June 27, 2022, when the DOJ, through its newly launched Firearms Dashboard Portal, publicly exposed the personal identifying information of everyone in the state who had applied for a CCW permit between 2012 and 2021. (Dkt. 49-4, Ex. 2). The information included applicants’ names, dates of birth, addresses, gender, race, driver’s license numbers, and criminal histories. (Id.). In response to this major gaffe, Plaintiffs filed a Motion for Reconsideration of their TRO request. (Dkt. 49). They asked the Court to either grant the TRO or allow them to supplement the record in support of their pending Motion for Preliminary Injunction. (Id.). The Court permitted both parties to file supplemental briefing concerning this development. The Court has read, heard, and considered all of the arguments made in support of and in opposition to Plaintiffs’ Motion for Preliminary Injunction and Motion for Reconsideration and Defendants’ Motion to Dismiss. The Court concludes that Plaintiffs’ First Amended Complaint (“FAC”) fails to state a claim for which relief can be granted. Fed. R. Civ. P. 12(b)(6). Defendants’ Motion to Dismiss is GRANTED, and Plaintiffs’ claims are DISMISSED. With no valid claims remaining to support the Plaintiffs’ request for injunctive relief, Plaintiffs’ Motion for Preliminary Injunction and Motion for Reconsideration are DENIED AS MOOT. A. Procedural History of AB 173 and Plaintiffs’ Contentions In 2016, the California legislature enacted California Penal Code § 14321, which established the Firearm Violence Research Center. 2016 Cal. Stat., ch. 24 § 30 (codified as amended at Cal. Penal Code § 14231). The statute directed that, “subject to the conditions and requirements established elsewhere in [the] statute, state agencies . . . shall provide to the center, upon proper request . . . , the data necessary for the center to conduct its research.” Cal. Penal Code § 14231(c)(2). UC Davis was initially designated to conduct the research and administer the Center. Later, Stanford University was authorized to also conduct research. AB 173 went into effect five years later on September 23, 2021. (Dkt. 28, FAC ¶¶ 72–74). The statute expressly permits the California DOJ to disclose data from state registries known as the Automated Firearms System (“AFS”) and the Dealer Record of Sale System (“DROS”) to the California Firearm Violence Research Center and to other “nonprofit bona fide research institution[s] accredited by the United States Department of Education or the Counsel for Higher Education Accreditation for the study of the prevention of violence.” Cal. Penal Code § 11106(d). The registries, which predate the enactment of AB 173, include the personal identifying information of firearm and ammunition purchasers and applicants for CCW permits, including their names, addresses, places and dates of birth, state driver’s license or other identification numbers, telephone numbers, sex, occupations, physical descriptions, and—only in the case of those who apply or have applied for CCW permits—social security numbers.1 (FAC ¶¶ 54, 59, 64). To prevent public dissemination of this information, AB 173 also revised California Penal Code §§ 14231(c)(3), 11106(d), and 30352(b)(2) to specify: Material identifying individuals shall only be provided for research or statistical activities and shall not be transferred, revealed, or used for purposes other than research or statistical activities, and reports or publications

1 The parties dispute whether the AFS contains social security numbers and CCW permit applications. Plaintiffs assert that the applications, which contain social security numbers, are included in the AFS, pointing to information available on the DOJ’s website, which in turn states that the AFS is “populated” in part with information from CCW permit applications. (Dkt. 26-7 at 2). Defendants provided conflicting accounts. At oral argument on the motion to dismiss, counsel for Defendants, relying on the declaration of a DOJ employee familiar with the AFS and DROS systems, stated that the systems generally don’t contain social security numbers, (Dkt. 43, Mot. Hr’g Tr. at 23:11–24:22; Dkt. 29-6, Lin Decl. ¶ 11); that the CCW permit applications aren’t part of the AFS, (Mot. Hr’g Tr. 82:21–25); and that, to the best of her knowledge, CCW permit applications haven’t yet been transmitted to researchers, (id. at 84:25–85:21). However, the declaration of Professor Garen J. Wintemute, the founding director of the California Firearm Violence Research Center at UC Davis, states that researchers have received CCW permits applications, suggesting that social security numbers have been transmitted to the researchers. (Dkt. 29-1, Wintemute Decl. ¶ 7 (“We have since obtained individually identifiable [CCW permit application] records derived therefrom shall not identify specific individuals. Plaintiffs’ position in this case is that the State’s disclosure to non-government researchers of their personal identification information—which they were compelled to furnish as a precondition to purchasing firearms and ammunition or obtaining a CCW permit—violates the Second Amendment. They argue AB 173 has a chilling effect on their exercise of Second Amendment rights because prospective gun and ammunition purchasers will refrain from purchasing guns and ammunition, and that CCW permit applicants will refrain from applying for or renewing CCW permits to protect their personal identifying information from disclosure to third parties. They also assert that the disclosure provisions of AB 173 violate their Fourteenth Amendment right to informational privacy and due process because the statute retroactively broadened access to their personal information. Finally, they maintain that AB 173 is preempted by the Federal Privacy Act of 1974. (FAC ¶ 92). // // // // // // // // // // // // // // B. Firearms Dashboard Portal Data Exposure The DOJ launched the Firearms Dashboard Portal on June 27, 2022. (Dkt. 49-4, Ex. 1). The press release announcing the launch highlighted the DOJ’s responsibility to balance “its duties to provide gun violence and firearms data to support research efforts while protecting the personal identifying information in the data the [DOJ] collects and maintains.” (Id.) Unfortunately, the DOJ failed to hold that balance true. Coinciding with the June 27 launch of the DOJ Dashboard, confidential personal data of nearly 200,000 Californians was unintentionally exposed to the public. (Dkt. 49-4, Ex. 2). See 2022 Firearms Dashboard Data Exposure, Cal. DOJ: Office of the Attorney General, https://oag.ca.gov/dataexposure (last visited Jan. 12, 2023). The exposed material included confidential personal information (previously described) associated with four sets of firearms-related data: (1) CCW permits and applications; (2) Firearms Safety Certificates; (3) DROS transactions;

2 The Court GRANTS Plaintiffs’ requests for judicial notice of the DOJ webpages, entitled “Attorney General Bonta Releases New Firearms Data to Increase Transparency and Information Sharing,” (Dkt. 49-4, Ex. 1); “California Department of Justice Alerts Individuals Impacted by Exposure of Personal Information from 2022 Firearms Dashboard,” (Dkt. 49-4, Ex. 2); “California Department of Justice Releases Results of Independent Investigation of Firearms Dashboard Data Exposure,” (Dkt. 57, Ex. 1); and the independent report of the Firearms Dashboard data exposure, (Dkt. 57, Ex. 2). In ruling on a Rule 12(b)(6) motion, courts generally may not look beyond the four corners of the complaint, with the exceptions of documents incorporated by reference into the complaint and any relevant matters subject to judicial notice. See Swartz v. KPMG LLP, 476 F.3d 756, 763 (9th Cir. 2007). An exception applies that permits a court to “judicially notice a fact that is not subject to reasonable dispute because it: (1) is generally known within the trial court’s territorial jurisdiction; or (2) can be accurately and readily determined from sources whose accuracy cannot reasonably be questioned.” Fed. R. Evid. 201(b). Proper subjects of judicial notice include information posted on websites run by government entities. See Daniels-Hall v. Nat’l Educ. Ass’n, 629 F.3d 992, 998–99 (9th Cir. 2010). The material posted on and (4) the Assault Weapons Registry. Id. Of note, social security numbers and financial information were not included in the underlying dataset that was exposed. Id. The information first became accessible to public view on June 27 and remained so until the next day when DOJ removed it and shut down the Firearms Dashboard. Id. To be clear, none of the confidential personal information that was exposed came from the California Firearm Violence Research Center at UC Davis or Stanford University—the two authorized firearms research organizations. A Rule 12(b)(6) motion to dismiss tests the sufficiency of the complaint. Navarro v. Block, 250 F.3d 729, 732 (9th Cir. 2001). “To survive a motion to dismiss, a complaint must contain sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.’” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 547 (2007)). A claim is plausible if the factual allegations supporting it permit “the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Id. The factual allegations need not be detailed; instead, the plaintiff must plead sufficient facts that, if true, “raise a right to relief above the speculative level.” Twombly, 550 U.S. at 545. The plausibility standard is not a “‘probability requirement,’ but it asks for more than a sheer possibility that a defendant has acted unlawfully.” Iqbal, 556 U.S. at 678 (quoting Twombly, 550 U.S. at 556). And courts aren’t required to accept legal conclusions couched as factual allegations. See Twombly, 550 U.S. at 555. Ultimately, a court must determine whether the plaintiff’s alleged facts, if proven, permit the court to grant the requested relief. See Iqbal, 556 U.S. at 666; Fed. R. Civ. P. 8(a)(2). Dismissal is proper “where there is no cognizable legal theory or an absence of sufficient facts alleged to support a cognizable legal theory.” Navarro, 250 F.3d at 732. Plaintiffs have brought only a facial challenge to AB 173—an argument that the law is unconstitutional as it is written. (FAC ¶¶ 44–45). For a facial challenge to survive a motion to dismiss, the complaint must “‘establish[] that no set of circumstances exists under which the [statute] would be valid,’ i.e., that the [statute] is unconstitutional in all of its applications.” Wash. State Grange v. Wash. State Republican Party, 552 U.S. 442, 449 (2008) (quoting United States v. Salerno, 481 U.S. 739, 745 (1987)). “[A] facial challenge must fail where the statute has a plainly legitimate sweep.” Id. (cleaned up). A. Violation of the Second Amendment or the Right of Privacy? Resolving the competing motions in this case presents a threshold question: Do the arguments for and against AB 173 raise a genuine Second Amendment dispute, a privacy dispute, or both? The answer to this question informs the legal standard to be applied. B. Second Amendment Challenge If this is principally a Second Amendment case, then the Court must resolve the issues in conformity with Bruen. 142 S. Ct. at 1231. The Supreme Court based its analysis in Bruen on a textual review of the Second Amendment in light of the historical setting and tradition at the time the Amendment was enacted. Applying that analysis here, the Court must first determine whether the information sharing provision of AB 173 is covered by the plain text of the Second Amendment. Assuming it is, Bruen demands that there must be a historical analogue—a tradition of similar firearm regulation—that supports the practice. But preliminarily, it’s important to underscore what Bruen didn’t do. Bruen didn’t undo all preexisting gun regulations. Licensing requirements, fingerprinting, background checks, and mandatory gun safety training courses exist in many states and operate as prerequisites to exercising the right to possess and carry firearms. The legitimacy of these longstanding and common regulations was recognized in District of Columbia v. Heller, 554 U.S. 446, 336 (2008) and in McDonald v. Chicago, 561 U.S. 742, 786 (2010)—a point acknowledged by Bruen. In his majority opinion in Bruen, Justice Thomas confirmed that the constitution permits state licensing regimes to require gun licensing and background checks as long as the requirements don’t have the effect of preventing law-abiding citizens from exercising their Second Amendment rights. Bruen, 142 S. Ct. at 2138 n.9.3 Justices Alito and Kavanaugh echoed this point in their concurring opinions. Justice Alito wrote that Bruen decides nothing about “the requirements that must be met to buy a gun,” and doesn’t “disturb anything that we said in [Heller or McDonald] about restrictions that may be imposed on the possession or carrying of guns.” Id. at 1257. Similarly, Justice Kavanaugh, joined by the Chief Justice, affirmed that, under Heller, “the Second Amendment allows a ‘variety’ of gun regulations,” including such “presumptively lawful regulatory measures” as “requir[ing] a [gun] license applicant to undergo fingerprinting, a background check, a mental health records check, and training in firearms handling and in laws regarding the use of force, among other possible requirements.” Id. at 2162.

3 Bruen also didn’t repeal existing prohibitions under federal and state laws governing who may possess a firearm. As examples, it is illegal under federal law for persons in the following categories to possess a firearm: a person convicted of a crime punishable by imprisonment for more than one year, 18 U.S.C. § 922(g)(1); a fugitive from justice, § 922(g)(2); an unlawful user of, or one addicted to, a controlled substance, § 922(g)(3); a person adjudicated as a mental defective or committed to a mental institution, § 922(g)(4); a person illegally or unlawfully in the United States, § 922(g)(5); a person dishonorably discharged from the Armed Forces, § 922(g)(6); U.S. citizens who have renounced their citizenship, § 922(g)(7); a person subject to a domestic violence restraining order issued after a hearing on notice, § 922(g)(8); and a person convicted of a misdemeanor domestic violence crime, § 922(g)(9). State laws have expanded these categories. All of these laws necessarily contemplate collecting personal information from gun and ammunition purchasers and CCW permit applicants, monitoring gun and ammunition sales, running criminal and mental health What one gleans from these qualifications is that there is a difference between prohibiting a right and regulating the right; so long as the regulation of the right to keep and bear arms doesn’t amount to a prohibition of the right, the regulation is permissible. Read together, Heller, McDonald, and Bruen establish that “the Second Amendment is neither a regulatory straightjacket nor a regulatory blank check.” Id. at 2133 (quoting Heller, 554 U.S. at 626). Rather, the cases collectively confirm that the Second Amendment permits laws and regulations that precondition the right to keep and bear arms on the obligation to comply with such ministerial tasks as providing personal identifying information and submitting to a background check—provided that the overall regulatory regime is neither overly discretionary nor overly burdensome. See id. at 2138 n.9 (“[B]ecause any permitting scheme can be put toward abusive ends, we do not rule out constitutional challenges to shall-issue regimes where, for example, lengthy wait times in processing license applications or exorbitant fees deny ordinary citizens their right to public carry.”). Laws requiring gun owners to comply with such ministerial tasks are presumptively valid and don’t violate the plain text of the Second Amendment. Therein lies the rub in this case. Under Bruen, the first step in assessing whether a regulation violates the Second Amendment is to determine whether the plain text of the Second Amendment covers the conduct regulated by the challenged law. Id. at 2126. While Plaintiffs acknowledge the legitimacy of these regulatory prerequisites to gun ownership and possession, and expressly disclaim any purpose “to contest the statutory and regulatory scheme governing the collection of personal information in connection with firearms and ammunition transactions,” (Dkt. 24 at 3), they maintain that disclosure of such information to third party researchers denies ordinary citizens the right to keep and bear arms. Central to Plaintiffs’ Second Amendment claims is the premise that sharing their personal information with outside gun research organizations jeopardizes their personal privacy and physical security. Plaintiffs hypothesize that if their identities are publicly revealed, they will be harassed, subjected to reprisals, and exposed to heightened risks of their homes being burglarized or becoming victims of violence. (FAC ¶¶ 81–82). Notwithstanding that DOJ protocols and the California Penal Code forbid any approved research organization from publicly disseminating the personal information of gun owners, Plaintiffs argue that their information may still be hacked. They also surmise that renegade researchers— hostile to their Second Amendment rights—could surreptitiously release their information to the public. (Id. ¶¶ 84–85). Either possibility, according to Plaintiffs, presents a threat of infringement to their Second Amendment rights. The trouble with both arguments is that they are entirely speculative and predictive of harm that is completely attenuated from the plain text and core protections of the Second Amendment. Starting with the possibility of hacking, to date, there has been no claim—not to mention any evidence—that personal information supplied by the DOJ to either the UC Davis or Stanford research organizations has been hacked. And the probability of hacking, though it can never be completely foreclosed, has been greatly reduced by the requirement that all bona fide research organizations follow strict data security protection protocols set by the FBI and DOJ. Even without such protocols in place, the Court is dubious that the threat of hacking alone is sufficient to state a Second Amendment infringement claim. The only personal information to which the research organizations have access is information previously collected by the DOJ. No doubt recognizing the State’s incontrovertible right to collect personal information from gun owners, Plaintiffs haven’t argued—nor could they—that the mere collection of such information violates their Second Amendment rights by improperly subjecting them to the threat of hacking. Nor have they presented evidence that there is any greater threat that data will be hacked from the research organizations than from the DOJ itself. Indeed, the only known unauthorized disclosure of gun owner data was the June 27 mishap for which the DOJ was entirely at fault. Plaintiffs’ other fear—that dissident researchers might intentionally breach DOJ protocols by publicly leaking their personal information—is equally unsubstantiated. Again, to state the obvious, the possibility of a recusant, ideologically motivated employee gaining access to Plaintiffs’ personal information isn’t a risk that is peculiar to the UC Davis and Stanford gun research organizations. No doubt there are state employees, perhaps even some within the DOJ, with ideological axes to grind. But the mere possibility of misbehavior by a rogue activist isn’t sufficient to prove that Plaintiffs will be deterred from exercising their Second Amendment rights. This tenuous possibility existed when Plaintiffs first supplied their personal information to the State so they could lawfully acquire firearms, purchase ammunition, or obtain a CCW permit. Unfortunately, rogue actors are a problem every society must grapple with in this technological age. See In re Crawford, 194 F.3d 954, 959 (9th Cir. 1999) (“Enhanced risk, in fact, obtains anytime the government requires an individual to deposit identifying information in the public record.”). Additionally, the speculative possibility of hacking or insider malfeasance existed prior to the adoption of AB 173 and didn’t prevent Plaintiffs from acquiring firearms and ammunition or obtaining or renewing CCW permits. Before AB 173’s adoption, all five Plaintiffs in this case were registered California gun owners and one was granted a CCW permit. The limited disclosure of private information for research purposes permitted by AB 173 doesn’t expose Plaintiffs to any novel risks or impose new burdens on them. Nor do these disclosures amount to an “abusive” practice that prevents Plaintiffs from acquiring additional firearms or ammunition or applying for or renewing a CCW permit in the future. Plaintiffs’ alternative argument is that even if AB 173 doesn’t directly violate the Second Amendment, disclosure of their personal information to the research organizations chills their exercise of the right. A “chilling effect” on the exercise of a constitutional right occurs when a person seeking to engage in constitutionally protected activity is deterred from doing so by government regulations not specifically prohibiting the protected activity. The test is an objective one that asks whether a person of ordinary firmness would be deterred from exercising the protected right. See O'Brien v. Welty, 818 F.3d 920, 933 (9th Cir 2016) (applying test to claim of First Amendment retaliation). In support of this argument, Plaintiffs Jane Doe, John Doe No. 2, and John Doe No. 3 submitted declarations asserting that the disclosure of their personal information to third-party researchers has dissuaded them from exercising their Second Amendment rights. (Dkt. 26-9; 26-11; 26-12). But considering the categorical prohibition on publicly disseminating any personal identifying information that the DOJ has imposed on the research organizations, the enhanced risks Plaintiffs fear are no more likely than the risks posed by many other California laws that compel citizens to furnish publicly available personal information. These include property title and land ownership registries, electoral rolls, and court documents. See, e.g., Cal. Gov’t Code § 6253 (providing a right of public access to records of state and local public agencies); § 6252(e) (defining “public records” as “any writing containing information relating to the conduct of the public’s business prepared, owned, used, or retained by any state or local agency regardless of physical form or characteristics”); see also Publicly Available Records: Records Available Online or Through a Different Process, City of San Diego: Communications, https://www.sandiego.gov/communications/public- records-requests/records-available (last visited Jan. 12, 2023) (listing various records available for public inspection). Applications for CCW permits and records of issuance of such permits are likewise considered public documents open to inspection in California unless the public interest clearly weighs against their disclosure. See Cal. Gov’t Code § 6255. The pervasiveness of such publicly available personal information weighs strongly against the objective reasonableness of Plaintiffs’ “chilling effect” claim.4 For these reasons, the Plaintiffs’ Second Amendment facial challenge to AB 173 fails. Permitting gun owners’ information to be shared under strict privacy protection protocols for legitimate research purposes is merely a limited extension of the “presumptively lawful regulatory measures” that permit states to collect information from gun and ammunition purchasers and CCW permit applicants in the first place. Ancillary regulations like these don’t restrict conduct covered by the plain text of the Second Amendment and are permissible. C. Fourteenth Amendment Challenges Plaintiffs next contend that the information disclosure provisions of AB 173 violate the privacy and due process guarantees of the Fourteenth Amendment. Their argument is two-fold. First, relying on the right to informational privacy recognized in the Fourteenth Amendment, Plaintiffs reprise their position that permitting disclosure of their personal information to third-party researchers violates their right to privacy. Second, they maintain that AB 173 violates the Fourteenth Amendment guarantee of due process by retroactively expanding the purpose for which their personal information was collected and by broadening access to the information. 1. Alleged Violation of Right to Informational Privacy The Ninth Circuit has recognized a constitutional right to informational privacy. In re Crawford, 194 F.3d at 958 & n.4. At the core of this right is the “individual[’s] interest in avoiding disclosure of personal matters.” Id. at 958 4 The Doe declarations also allude to the “potentiality” of dissemination of their personal information “to the broader public.” (Dkt. 26-9 at 4; 26-11 at 4). But considering the DOJ prohibitions previously discussed, this conjectural risk must also be discounted by the improbability of its occurrence. In re Crawford, 194 F.2d (quoting Doe v. Attorney General, 941 F.2d 720, 795 (9th Cir. 1991)). The scope of protection extends to “inherently sensitive or intimate information,” the disclosure of which could “lead directly to injury, embarrassment or stigma.” Id. at 960. But the right “is not absolute; rather, it is a conditional right which may be infringed upon a showing of proper governmental interest.” Doe, 941 F.2d at 796. Plaintiffs’ claim of informational privacy requires the Court to weigh their asserted privacy interests against the government’s professed interests in disclosure. Id. Relevant considerations include: (1) the type of record; (2) the information contained in the record; (3) the potential for harm from any subsequent nonconsensual disclosure; (4) the injury from disclosure to the relationship in which the record was generated; (5) the adequacy of safeguards to prevent unauthorized disclosure; (6) the degree of need for access; and (7) the public interest in access. Id. (quoting United States v. Westinghouse Elec. Corp., 638 F.2d 570, 578 (3d Cir. 1980)). “[T]he government has the burden of showing that ‘its use of the information [advances] a legitimate state interest and that its actions are narrowly tailored to meet [that] legitimate interest.’” Id. “In most cases, it will be the overall context, rather than the particular item of information, that will dictate the tipping of the scales.” In re Crawford, 194 F.3d at 959. Plaintiffs contend that the biographical information that gun and ammunition purchasers and CCW permit applicants must disclose, such as their names, addresses, dates of birth, and driver’s license numbers—when considered in combination with their status as known gun owners—is confidential information protected by the Fourteenth Amendment. Their specific fear is that non-government researchers may publicly identify them as firearms owners, which in turn might subject them to harassment, threats of physical violence, and the theft of their firearms. Prudent analysis of the relevant considerations listed above doesn’t support their argument. The gun and ammunition purchase records collected by the DOJ are routine ministerial records required by federal and California law. See, e.g., 18 U.S.C. § 923(g)(1)(A)(4) (requiring licensed firearm importers, manufacturers, and dealers to maintain records of firearms sales); Cal. Penal Code § 28100 (requiring firearms dealers to maintain a record of all firearms sales); Cal. Penal Code § 30352(b)(1) (requiring the DOJ to maintain a record of all ammunition sales in a database called the Ammunition Purchase Records File). And the Ninth Circuit has previously held that Plaintiffs’ interest in maintaining confidential the fact of their gun ownership is minimal. See Silveira v. Lockyer, 312 F.3d 1052, 1092 (9th Cir. 2002) (finding minimal the plaintiffs’ interests in maintaining confidential the fact of their assault weapon ownership). The privacy interest in CCW permits is similarly minimal, as these records have been deemed public records in California since 1957. See CBS Inc. v. Block, 42 Cal. 3d 646, 655 (1986). Nothing in the nature of these types of records is stigmatizing, embarrassing, or likely to lead directly to injury. Cf. Doe, 941 F.2d 780 (holding records of HIV-status and AIDS diagnosis protected by the right to privacy); Whalen v. Roe, 429 U.S. 589 (1977) (same for medical information). The nature of the information contained in the records—biographical information that is generally available in many other public registries—is likewise unremarkable. The parties dispute whether social security numbers are included in the data,5 but even if so, the inclusion of this information doesn’t necessarily violate Plaintiffs’ right of informational privacy. In re Crawford, 194 F.3d at 960 (finding social security numbers disclosed to the public in bankruptcy filings not protected). Finally, Plaintiffs’ contention that their biographical information and their status as known gun owners in combination poses a threat to them is unsupported. Other federal courts have held the right to privacy doesn’t protect “one’s name, address, and status as a firearm licensee,” Doe No. 1 v. Putnam

Cty., 344 F. Supp. 3d 518, 541 (S.D.N.Y. 2018); see also Burke v. Vision Gov’t Sols., Inc., 433 F. Supp. 3d 380, 392 (D. Conn. 2020) (finding no Fourteenth Amendment right to privacy in one’s status as a firearm permit holder), so considering this factor in combination with disclosure of Plaintiffs’ biographical information adds nothing to the required balancing of interests. The potential for harm from disclosure of Plaintiff’s personal information— especially social security numbers—isn’t trivial. In re Crawford, 194 F.3d at 958 (noting danger of rampant identity theft). But this factor must necessarily be considered in tandem with another factor: the adequacy of safeguards to prevent unauthorized disclosure. To reiterate, no data security system is failproof. And while neither party has presented the Court with concise data on the prevalence of hacking, there is no dispute that the UC Davis and Stanford research organizations employ safeguards designed to prevent disclosure of shared information to unscrupulous third parties. It is likewise undisputed that, to date, there have been no incidents or reports of hacking of the organizations’ databases. Considering that both research organizations follow DOJ and FBI computer security and protection protocols, the speculative possibility of a data breach occurring at UC Davis or Stanford is no more likely than one occurring at the DOJ, where the data originates. The risk of unauthorized disclosure has been mitigated to the extent reasonably possible. The final two factors, the degree of need for access and the public interest in access, should also be considered together. The legislative findings and declarations supporting AB 173, (Dkt. 36 at 14); Cal. Penal Code § 14230(a), identify California’s interest in the public health and safety challenges posed by firearm violence. The findings take note of the multiple forms of firearm violence, highlighting the rising rate of suicides, as well as homicides and accidental deaths. (Dkt. 36 at 14); § 14230(a), (b); see also Mai v. United States, 952 F.3d 1106, 1120–21 (9th Cir. 2020) (discussing suicide as a form of “gun violence”). The California legislature specifically found that, because of limited research, “[t]oo little is known about firearm violence and its prevention.” (Dkt. 36 at 14); § 14230(e). These findings constitute an express statutory mandate and an articulated public policy supporting the restricted disclosure provisions of the statute. See Doe, 941 F.2d at 796. While the State’s interests are served in the first instance by collecting data from gun owners, the California legislature reasonably assumes that analysis of the collected data by trained researchers may also prove helpful in advancing the State’s objectives. These findings are sufficient to meet the State’s burden of showing that its use of the information in the manner prescribed advances a legitimate state interest. The State has also demonstrated that disclosure of the information to the research organizations is narrowly tailored to meet the State’s legitimate state interest in preventing gun violence. The essential concern underlying Plaintiffs’ lawsuit isn’t the confidential dissemination of their personal information to small groups of vetted researchers. Rather, Plaintiffs’ core concern is that their personal identifying information will somehow make its way into the public square, which will lead to negative consequences. The strict security precautions enacted by DOJ are designed to prevent such an occurrence. Forbidding the research organizations from publicly disseminating shared data absent DOJ approval, requiring background checks of those with access to the data, and mandating strict security protocols governing access to the data repositories all help to protect unauthorized disclosure of Plaintiffs’ information. Balancing the relevant factors, the Court finds that the disclosure provisions of AB 173 don’t violate Plaintiffs’ Fourteenth Amendment right to informational privacy. 2. Alleged Violation of Due Process Plaintiffs argue that AB 173 violates the Fourteenth Amendment guarantee of due process because it retroactively expands the purposes for which information collected from them could be used and broadens access to their personal information. According to Plaintiffs, when they originally provided personal information to DOJ to lawfully purchase firearms and ammunition, or to apply to obtain a CCW permit, two California statutes, Penal Code §§ 11106 and 30352, declared that such information would be used “only for enumerated law enforcement purposes such as assisting with criminal investigations, arrests, and prosecutions.”6 (Dkt. 26 at 32). Plaintiffs contend they relied on these statutory assurances and assert that permitting bona fide researchers to access their information isn’t an authorized “law enforcement purpose.” To begin, it isn’t obvious that the California Penal Code sections Plaintiffs cite evince the intent of the California legislature to limit access to the AFS database in the manner they suggest. Plaintiffs maintain that before the amendments effected by AB 173, § 11106 expressly limited disclosure of their personal information “only to a limited class of statutorily defined governmental actors and agencies, and only for law enforcement purposes.” (Dkt. 28 ¶ 140).7 In

6 Record support for this statement isn’t apparent. The materials Plaintiffs point to—Exhibits 11, 12, and 13 to the FAC—don’t contain the limiting language they recite. For example, although DOJ’s Privacy Policy Statement, attached as Exhibit 11, states “[w]e only use or disclose personal information for the specified purposes [the information was collected for],” it goes on to disclaim that the privacy policy is subject to change at any time without notice. (FAC, Ex. 11 at 3–4). Similarly, the privacy notice attached to the Personal Firearms Eligibility Check Application and Firearms Ownership Report, Exhibits 12 and 13 respectively, provides that personal information may be disclosed to “other persons . . . when necessary to perform their legal duties, and their use of your information is compatible and complies with state law, such as for . . . regulatory purposes.” (Id. Ex. 12 at 5; Ex. 13 at 5). Moreover, the list of valid disclosures under California Penal Code § 11105 includes such non-law enforcement purposes as disclosure to health officers for the prevention of disease, § 11105(b)(14), and disclosure to public transportation agencies “for the purpose of oversight and enforcement policies with respect to its contracted providers.” § 11105(b)(25). fact, the pre-AB 173 version of § 11106 didn’t expressly limit the purposes for which information could be shared to just those enumerated in the statute’s text. Instead, § 11106 delegated authority to the Attorney General and directed him to, “upon proper application therefor, furnish the information to the officers referred to in Section 11105.” Cal. Penal Code § 11106(b)(3) (eff. Jan. 1, 2021 to Sept. 22, 2021). Section 11105, in turn, authorized the Attorney General to provide access to a broad swath of criminal and non-criminal information—including the AFS database—to state and local officials and to other listed entities for a variety of law enforcement purposes and some other purposes.8 See Cal. Penal Code § 11105 (listing officers and entities). But for the sake of considering Plaintiffs’ due process argument, the Court will assume that AB 173 retroactively broadened the scope of access to the AFS data base. Nonetheless, the flaw in Plaintiffs’ due process argument is that retroactive changes to a statute, standing alone, don’t violate due process. See Landgraf v. USI Film Prods., 511 U.S. 244, 269 & n.21 (1994) (“A statute does not operate ‘retrospectively’ merely because it is applied in a case arising from conduct antedating the statute’s enactment or upsets expectations based in prior law.”) (citation omitted). To be sure, legislative prospectivity remains the appropriate default rule. Id. at 272. But the constitutional impediments to retroactive civil legislation are now modest, id., and unless a statutory change violates a specific

§ 11106 or § 11105. Regardless, the Court disagrees with Plaintiffs’ narrow interpretation of the phrase. Legislators, prosecutors, judges—even cops on the beat—possess no special prowess or general expertise that permits them to identify workable approaches to preventing gun violence, gun accidents, and gun suicides. But perhaps researchers do. It is therefore quintessentially a “law enforcement purpose” for the state to enlist assistance from trained researchers and research organizations to study these problems and to suggest solutions based on their review of pertinent firearm data. provision of the Constitution, “the potential unfairness of retroactive civil legislation is not a sufficient reason for a court to fail to give a statute its intended scope,” id. at 267. For Plaintiffs’ retroactivity challenge to succeed, they must first demonstrate that AB 173 “attaches new legal consequence to events completed before its enactment.” Id. at 270. A new legal consequence is one that imposes a new “liability or penalty.” Pinnock v. Int’l House of Pancakes Franchisee, 844 F. Supp. 574, 584 (S.D. Cal. 1993). Plaintiffs must also demonstrate that, in enacting AB 173, the California legislature “acted in an arbitrary and irrational way.” Pension Ben. Guar. Corp. v. R.A. Gray & Co., 467 U.S. 717, 729 (1984). The latter issue is reviewed under the rational basis standard. See Gadda v. State Bar of Cal., 511 F.3d 933, 938 (9th Cir. 2007). To survive rational basis review, “the statute must be based on ‘a legitimate legislative purpose furthered by rational means.’” Campanelli v. Allstate Life Ins. Co., 322 F.3d 1086, 1100 (9th Cir. 2003) (quoting Gen. Motors Corp. v. Romein, 503 U.S. 181, 191 (1992)); see also Pension Ben. Guar. Corp., 467 U.S. at 729 (“Provided that the retroactive application of a statute is supported by a legitimate legislative purpose furthered by rational means, judgments about the wisdom of such legislation remain within the exclusive province of the legislative and executive branches”). Having rejected Plaintiffs’ argument that the limited nonpublic disclosure of their personal information to bona fide research organizations violates their right to informational privacy, the Court is unable to identify any other new legal consequence, liability, or penalty that AB 173 imposes on Plaintiffs. Considering the required DOJ protocols and data security measures that are in place, Plaintiffs haven’t established that the risk of public dissemination of their information, as well as all of the attendant harms they dread, are any greater simply because AB 173 adds an additional category to the comprehensive list of disclosures authorized by Penal Code § 11105. Even assuming that AB 173 attaches new legal consequences to the record keeping regulations governing gun and ammunition purchases and CCW permit applications, Plaintiffs’ due process claim still fails because they haven’t shown that the California legislature acted in an arbitrary and irrational way. Pension Ben. Guar. Corp., 467 U.S. at 729. By establishing the Firearms Violence Research Center and authorizing the Center to conduct research into the prevention of gun violence, gun accidents, and firearm-related suicide, the California legislature sought to further the State’s interest in public health and safety. See Cal. Penal Code § 14230(e). As explained above, granting vetted researchers access to study protected firearms data as a means of implementing § 14230 serves a legitimate legislative purpose in a rational and narrowly tailored manner. While AB 173 may have expanded non-public access to Plaintiffs’ personal information, this post factum expansion was neither arbitrary nor irrational. Plaintiffs’ argument regarding Penal Code § 30352, which establishes record keeping requirements for ammunition vendors, is similarly inapt. Before being amended by AB 173, § 30352 required ammunition venders to electronically notify the DOJ of all ammunition sales, and further provided that the information was subject to disclosure under § 11105. See Cal. Penal Code § 30352(b) (eff. Jan. 1, 2021 to Sept. 22, 2021). The only material change to § 30352 effected by AB 173 was to permit ammunition sales information to be disclosed to the gun research organizations in the same manner and under the same DOJ protocols that apply to all other database information. Compare id. with § 30352(b)(2) (eff. Sept. 22, 2021). For the reasons discussed above, such disclosure doesn’t violate Plaintiffs’ due process rights. Because AB 173 doesn’t unconstitutionally expand the limited purposes for which gun and ammunition purchaser and CCW application data may be collected or shared, the Court rejects Plaintiffs’ due process claim. // D. Preemption under the Federal Privacy Act Plaintiffs’ last claim concerns only applicants for CCW permits and holders of these permits. They argue that federal law preempts AB 173 insofar as AB 173 authorizes disclosure of their social security numbers to third parties in derogation of the Privacy Act of 1974. (FAC ¶¶ 152–61). The argument relies on the notice requirement contained in section 7(b) of the Privacy Act, Pub. L. No. 93-579, § 7(b) 88 Stat. 1896, 1909, reprinted in 5 U.S.C. § 552a note, which provides: Any Federal, State, or local government agency which requests an individual to disclose his social security account number shall inform that individual whether that disclosure is mandatory or voluntary, by what statutory or other authority such number is solicited, and what uses will be made of it. Plaintiffs’ argument misapprehends the text of AB 173 by conflating the statutory language with a section of the CCW application form used by the DOJ. The parties agree that the DOJ form application for obtaining a CCW permit includes a box for applicants to list their social security numbers. The form doesn’t specify whether disclosure of one’s social security number is mandatory or voluntary. However, nothing in the text of AB 173 requires CCW applicants to furnish this information. In fact, the text of the statute doesn’t even mention social security numbers. Contrary to Plaintiffs’ argument, there is no conflict between the text of AB 173 and that of the Federal Privacy Act implicating a statutory preemption issue.9 For the forgoing reasons, the Court GRANTS Defendant’s Motion to Dismiss, and DISMISSES Plaintiffs’ FAC in its entirety. To the extent Plaintiffs 9 The Court expresses no view whether the CCW application form currently used wish to amend their claims, they may do so by filing a motion for leave to amend by February 10, 2023, in accordance with the Southern District's Civil Local Rules and this Court’s Civil Standing Order. > lDated: January 12, 2023 lau A. (Buywy Hon. Larry Alan Burns United States District Judge