Doe v. Bonta

• Court: District Court, S.D. California
• Decided: January 12, 2023
• Docket: 3:22-cv-00010
• Status: Unknown

Opinion

1 2 3 4 5 6 7 8 UNITED STATES DISTRICT COURT 9 SOUTHERN DISTRICT OF CALIFORNIA 10 11 JANE DOE, et al, Case No.: 22-cv-10-LAB-DEB

12 Plaintiffs, ORDER: 13 v. 1) GRANTING MOTION TO 14 ROB BONTA, in his capacity as DISMISS, [Dkt. 36]; Attorney General of the State of 15 California, et al, 2) DENYING MOTION FOR 16 Defendants. PRELIMINARY INJUNCTION 17 [Dkt. 26];

18 3) DENYING EX PARTE 19 MOTION FOR RECONSIDERATION 20 [Dkt. 49]; and 21 4) GRANTING REQUESTS 22 FOR JUDICIAL NOTICE 23 [Dkt. 49-4, 57] 24 25 I. INTRODUCTION 26 Five California registered gun owners have filed suit to prevent Rob Bonta, 27 Attorney General of the State of California, from enforcing a California law that 28 permits the State to disclose their personal identifying information to bona fide 1 research institutions for the ostensible purposes of preventing gun violence, 2 shooting accidents, and suicide. Plaintiffs ask the Court to enjoin the State from 3 sharing their information and to declare the law, California Assembly Bill 173 4 (“AB 173”), unconstitutional under the Second and Fourteenth Amendments. The 5 gun owners, all of whom are law abiding citizens who passed background checks, 6 raise four claims. First, they argue that AB 173 violates—or at minimum, chills— 7 their Second Amendment right to keep and bear arms. Second, they maintain that 8 disclosing their personal identifying information to non-government researchers 9 violates privacy protections guaranteed to them by the Fourteenth Amendment. 10 Next, they assert that AB 173 violates their right to due process under the 11 Fourteenth Amendment by retroactively expanding access to their restricted 12 personal information. Their final claim, applicable only to applicants for concealed 13 weapon permits (“CCW”) and holders of such permits, is that federal law preempts 14 AB 173 insofar as AB 173 authorizes disclosure of their social security numbers 15 to third parties in derogation of the federal Privacy Act of 1974. 16 This case began with the Plaintiff gun owners seeking the issuance of a 17 temporary restraining order (“TRO”) forbidding enforcement of the law. Tracking 18 the requirements for emergency injunctive relief, Plaintiffs argued they would be 19 irreparably harmed if their personal information was shared with researchers, that 20 they were likely to prevail on the merits of their lawsuit, and that issuance of a 21 TRO was in the public interest. However, the Court declined to issue a TRO, 22 largely on procedural grounds, because Plaintiffs’ request came 108 days after 23 AB 173 took effect and they made no showing of an emergency that would justify 24 immediate judicial intervention. (Dkt. 22 at 3). 25 Plaintiffs then filed a Motion for Preliminary Injunction, mirroring the 26 arguments they raised in their request for a TRO. The Attorney General opposed 27 the motion and filed his own Motion to Dismiss Plaintiffs’ lawsuit. The Court heard 28 argument on both motions on April 5, 2022. 1 In their opposition to the preliminary injunction, Defendants attached the 2 uncontested declaration of Dr. Trent Simmons. Dr. Simmons is the Research Data 3 Supervisor for the California Department of Justice (“DOJ”). He oversees the 4 section of the DOJ responsible for reviewing requests for information relating to 5 gun and ammunition purchases collected by the Department, and his 6 responsibilities include implementing AB 173. (Dkt. 29-4, Simmons Decl. ¶¶ 5–8). 7 In his declaration, Dr. Simmons explains that researchers who apply for 8 access to data that includes the personal identifying information of registered gun 9 owners, gun and ammunition purchasers, and applicants for CCW permits, must 10 explain how the requested information supports a research project, (id. ¶ 10), and 11 must comply with strict data security measures set by the Federal Bureau of 12 Investigations (“FBI”), (id. ¶ 9). Researchers seeking access to state databases 13 containing personal identifying information must detail their data security 14 protocols, confirm they meet the DOJ’s security requirements, and identify the 15 individual researchers who will use the data. (Id. ¶ 12). Each researcher must also 16 complete a fingerprint background check. (Id. ¶¶ 8, 12). Only two research 17 institutions are currently authorized to view gun owner and purchaser information, 18 one operating under the auspices of the University of California at Davis (“UC 19 Davis”) and the other under the auspices of Stanford University. (Id. ¶¶ 15–17, 20 21–23). 21 Before publishing any material derived from information in the state 22 databases, researchers must provide the DOJ with a pre-publication manuscript 23 at least ten days before publication. (Id. ¶ 14). The DOJ then reviews the 24 manuscript to ensure no personal identifying information is published directly or 25 in such a manner that identities could be reverse engineered. (Id.). 26 Finally, applicants for access to the databases must agree to report any data 27 breaches. (Id. ¶ 23). To date, no researcher has “ever inadvertently disclosed 28 personal identifying information in data obtained from the [DOJ], or any source, to 1 an unauthorized person or the public.” (Id.). 2 In response to the Court’s questions during argument on the preliminary 3 injunction motion, the Deputy Attorney General representing the State confirmed 4 that the above-described restrictions on access to and disclosure of data in DOJ 5 gun databases remain in force. (Dkt. 43, Mot. Hr’g Tr. at 24:23–31:15). The Court 6 took the motions under submission and both parties subsequently submitted 7 supplemental briefing. 8 Since the April 5 hearing, two notable events occurred. First, on June 23, 9 2022, the Supreme Court issued its opinion in New York State Rifle & Pistol Ass’n, 10 Inc. v. Bruen, 142 S. Ct. 2111 (2022)—the first major Second Amendment case 11 in a decade. In Bruen, the high court jettisoned what had been a widely accepted 12 “two-step” test for evaluating Second Amendment claims, see, e.g., Duncan v. 13 Bonta, 19 F.4th 1087, 1100 (9th Cir. 2021), in favor of a one-step historical test. 14 142 S. Ct. at 2126–27. The Court held that the constitutionality of a gun law 15 depends on whether the regulation implicates people, conduct, or arms falling 16 within the “plain text” of the Second Amendment. Id. at 2126. If so, the regulation 17 is presumptively unconstitutional and “the government must [then] affirmatively 18 prove that its firearms regulation is part of the historical tradition” of firearms 19 regulation. Id. at 2127. Regulations lacking such a historical pedigree are 20 inconsistent with the Second Amendment and are unconstitutional. Id. at 2129–30 21 (“When the Second Amendment’s plain text covers an individual’s conduct, the 22 Constitution presumptively protects that conduct.”). Following the Bruen decision, 23 this Court ordered supplemental briefing to address the implications of Bruen for 24 this case. (Dkt. 47). 25 The second notable event occurred on June 27, 2022, when the DOJ, 26 through its newly launched Firearms Dashboard Portal, publicly exposed the 27 personal identifying information of everyone in the state who had applied for a 28 CCW permit between 2012 and 2021. (Dkt. 49-4, Ex. 2). The information included 1 applicants’ names, dates of birth, addresses, gender, race, driver’s license 2 numbers, and criminal histories. (Id.). In response to this major gaffe, Plaintiffs 3 filed a Motion for Reconsideration of their TRO request. (Dkt. 49). They asked the 4 Court to either grant the TRO or allow them to supplement the record in support 5 of their pending Motion for Preliminary Injunction. (Id.). The Court permitted both 6 parties to file supplemental briefing concerning this development. 7 The Court has read, heard, and considered all of the arguments made in 8 support of and in opposition to Plaintiffs’ Motion for Preliminary Injunction and 9 Motion for Reconsideration and Defendants’ Motion to Dismiss. The Court 10 concludes that Plaintiffs’ First Amended Complaint (“FAC”) fails to state a claim 11 for which relief can be granted. Fed. R. Civ. P. 12(b)(6). Defendants’ Motion to 12 Dismiss is GRANTED, and Plaintiffs’ claims are DISMISSED. With no valid claims 13 remaining to support the Plaintiffs’ request for injunctive relief, Plaintiffs’ Motion 14 for Preliminary Injunction and Motion for Reconsideration are DENIED AS MOOT. 15 II. BACKGROUND 16 A. Procedural History of AB 173 and Plaintiffs’ Contentions 17 In 2016, the California legislature enacted California Penal Code § 14321, 18 which established the Firearm Violence Research Center. 2016 Cal. Stat., ch. 24 19 § 30 (codified as amended at Cal. Penal Code § 14231). The statute directed that, 20 “subject to the conditions and requirements established elsewhere in [the] statute, 21 state agencies . . . shall provide to the center, upon proper request . . . , the data 22 necessary for the center to conduct its research.” Cal. Penal Code § 14231(c)(2). 23 UC Davis was initially designated to conduct the research and administer the 24 Center. Later, Stanford University was authorized to also conduct research. 25 AB 173 went into effect five years later on September 23, 2021. (Dkt. 28, 26 FAC ¶¶ 72–74). The statute expressly permits the California DOJ to disclose data 27 from state registries known as the Automated Firearms System (“AFS”) and the 28 Dealer Record of Sale System (“DROS”) to the California Firearm Violence 1 Research Center and to other “nonprofit bona fide research institution[s] 2 accredited by the United States Department of Education or the Counsel for 3 Higher Education Accreditation for the study of the prevention of violence.” Cal. 4 Penal Code § 11106(d). The registries, which predate the enactment of AB 173, 5 include the personal identifying information of firearm and ammunition purchasers 6 and applicants for CCW permits, including their names, addresses, places and 7 dates of birth, state driver’s license or other identification numbers, telephone 8 numbers, sex, occupations, physical descriptions, and—only in the case of those 9 who apply or have applied for CCW permits—social security numbers.1 (FAC 10 ¶¶ 54, 59, 64). To prevent public dissemination of this information, AB 173 also 11 revised California Penal Code §§ 14231(c)(3), 11106(d), and 30352(b)(2) to 12 specify: 13 Material identifying individuals shall only be provided for research or statistical activities and shall not be 14 transferred, revealed, or used for purposes other than 15 research or statistical activities, and reports or publications 16

17 1 The parties dispute whether the AFS contains social security numbers and CCW permit applications. Plaintiffs assert that the applications, which contain social 18 security numbers, are included in the AFS, pointing to information available on the 19 DOJ’s website, which in turn states that the AFS is “populated” in part with information from CCW permit applications. (Dkt. 26-7 at 2). Defendants provided 20 conflicting accounts. At oral argument on the motion to dismiss, counsel for 21 Defendants, relying on the declaration of a DOJ employee familiar with the AFS and DROS systems, stated that the systems generally don’t contain social 22 security numbers, (Dkt. 43, Mot. Hr’g Tr. at 23:11–24:22; Dkt. 29-6, Lin Decl. 23 ¶ 11); that the CCW permit applications aren’t part of the AFS, (Mot. Hr’g Tr. 82:21–25); and that, to the best of her knowledge, CCW permit applications 24 haven’t yet been transmitted to researchers, (id. at 84:25–85:21). However, the 25 declaration of Professor Garen J. Wintemute, the founding director of the California Firearm Violence Research Center at UC Davis, states that researchers 26 have received CCW permits applications, suggesting that social security numbers 27 have been transmitted to the researchers. (Dkt. 29-1, Wintemute Decl. ¶ 7 (“We have since obtained individually identifiable [CCW permit application] records 28 1 derived therefrom shall not identify specific individuals. 2 Plaintiffs’ position in this case is that the State’s disclosure to 3 non-government researchers of their personal identification information—which 4 they were compelled to furnish as a precondition to purchasing firearms and 5 ammunition or obtaining a CCW permit—violates the Second Amendment. They 6 argue AB 173 has a chilling effect on their exercise of Second Amendment rights 7 because prospective gun and ammunition purchasers will refrain from purchasing 8 guns and ammunition, and that CCW permit applicants will refrain from applying 9 for or renewing CCW permits to protect their personal identifying information from 10 disclosure to third parties. They also assert that the disclosure provisions of 11 AB 173 violate their Fourteenth Amendment right to informational privacy and due 12 process because the statute retroactively broadened access to their personal 13 information. Finally, they maintain that AB 173 is preempted by the Federal 14 Privacy Act of 1974. (FAC ¶ 92). 15 // 16 // 17 // 18 // 19 // 20 // 21 // 22 // 23 // 24 // 25 // 26 // 27 // 28 // 1 B. Firearms Dashboard Portal Data Exposure 2 The DOJ launched the Firearms Dashboard Portal on June 27, 2022. 3 (Dkt. 49-4, Ex. 1). The press release announcing the launch highlighted the DOJ’s 4 responsibility to balance “its duties to provide gun violence and firearms data to 5 support research efforts while protecting the personal identifying information in 6 the data the [DOJ] collects and maintains.” (Id.) Unfortunately, the DOJ failed to 7 hold that balance true. 8 Coinciding with the June 27 launch of the DOJ Dashboard, confidential 9 personal data of nearly 200,000 Californians was unintentionally exposed to the 10 public. (Dkt. 49-4, Ex. 2). See 2022 Firearms Dashboard Data Exposure, Cal. 11 DOJ: Office of the Attorney General, https://oag.ca.gov/dataexposure (last visited 12 Jan. 12, 2023). The exposed material included confidential personal information 13 (previously described) associated with four sets of firearms-related data: (1) CCW 14 permits and applications; (2) Firearms Safety Certificates; (3) DROS transactions; 15

16 2 The Court GRANTS Plaintiffs’ requests for judicial notice of the DOJ webpages, 17 entitled “Attorney General Bonta Releases New Firearms Data to Increase Transparency and Information Sharing,” (Dkt. 49-4, Ex. 1); “California Department 18 of Justice Alerts Individuals Impacted by Exposure of Personal Information from 19 2022 Firearms Dashboard,” (Dkt. 49-4, Ex. 2); “California Department of Justice Releases Results of Independent Investigation of Firearms Dashboard Data 20 Exposure,” (Dkt. 57, Ex. 1); and the independent report of the Firearms Dashboard 21 data exposure, (Dkt. 57, Ex. 2). In ruling on a Rule 12(b)(6) motion, courts generally may not look beyond the four corners of the complaint, with the 22 exceptions of documents incorporated by reference into the complaint and any 23 relevant matters subject to judicial notice. See Swartz v. KPMG LLP, 476 F.3d 756, 763 (9th Cir. 2007). An exception applies that permits a court to “judicially 24 notice a fact that is not subject to reasonable dispute because it: (1) is generally 25 known within the trial court’s territorial jurisdiction; or (2) can be accurately and readily determined from sources whose accuracy cannot reasonably be 26 questioned.” Fed. R. Evid. 201(b). Proper subjects of judicial notice include 27 information posted on websites run by government entities. See Daniels-Hall v. Nat’l Educ. Ass’n, 629 F.3d 992, 998–99 (9th Cir. 2010). The material posted on 28 1 and (4) the Assault Weapons Registry. Id. Of note, social security numbers and 2 financial information were not included in the underlying dataset that was 3 exposed. Id. The information first became accessible to public view on June 27 4 and remained so until the next day when DOJ removed it and shut down the 5 Firearms Dashboard. Id. To be clear, none of the confidential personal information 6 that was exposed came from the California Firearm Violence Research Center at 7 UC Davis or Stanford University—the two authorized firearms research 8 organizations. 9 III. LEGAL STANDARD 10 A Rule 12(b)(6) motion to dismiss tests the sufficiency of the complaint. 11 Navarro v. Block, 250 F.3d 729, 732 (9th Cir. 2001). “To survive a motion to 12 dismiss, a complaint must contain sufficient factual matter, accepted as true, to 13 ‘state a claim to relief that is plausible on its face.’” Ashcroft v. Iqbal, 556 U.S. 662, 14 678 (2009) (quoting Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 547 (2007)). A 15 claim is plausible if the factual allegations supporting it permit “the court to draw 16 the reasonable inference that the defendant is liable for the misconduct alleged.” 17 Id. The factual allegations need not be detailed; instead, the plaintiff must plead 18 sufficient facts that, if true, “raise a right to relief above the speculative level.” 19 Twombly, 550 U.S. at 545. The plausibility standard is not a “‘probability 20 requirement,’ but it asks for more than a sheer possibility that a defendant has 21 acted unlawfully.” Iqbal, 556 U.S. at 678 (quoting Twombly, 550 U.S. at 556). And 22 courts aren’t required to accept legal conclusions couched as factual allegations. 23 See Twombly, 550 U.S. at 555. Ultimately, a court must determine whether the 24 plaintiff’s alleged facts, if proven, permit the court to grant the requested relief. 25 See Iqbal, 556 U.S. at 666; Fed. R. Civ. P. 8(a)(2). Dismissal is proper “where 26 there is no cognizable legal theory or an absence of sufficient facts alleged to 27 support a cognizable legal theory.” Navarro, 250 F.3d at 732. 28 Plaintiffs have brought only a facial challenge to AB 173—an argument that 1 the law is unconstitutional as it is written. (FAC ¶¶ 44–45). For a facial challenge 2 to survive a motion to dismiss, the complaint must “‘establish[] that no set of 3 circumstances exists under which the [statute] would be valid,’ i.e., that the 4 [statute] is unconstitutional in all of its applications.” Wash. State Grange v. Wash. 5 State Republican Party, 552 U.S. 442, 449 (2008) (quoting United States v. 6 Salerno, 481 U.S. 739, 745 (1987)). “[A] facial challenge must fail where the 7 statute has a plainly legitimate sweep.” Id. (cleaned up). 8 IV. DISCUSSION 9 A. Violation of the Second Amendment or the Right of Privacy? 10 Resolving the competing motions in this case presents a threshold question: 11 Do the arguments for and against AB 173 raise a genuine Second Amendment 12 dispute, a privacy dispute, or both? The answer to this question informs the legal 13 standard to be applied. 14 B. Second Amendment Challenge 15 If this is principally a Second Amendment case, then the Court must resolve 16 the issues in conformity with Bruen. 142 S. Ct. at 1231. The Supreme Court based 17 its analysis in Bruen on a textual review of the Second Amendment in light of the 18 historical setting and tradition at the time the Amendment was enacted. Applying 19 that analysis here, the Court must first determine whether the information sharing 20 provision of AB 173 is covered by the plain text of the Second Amendment. 21 Assuming it is, Bruen demands that there must be a historical analogue—a 22 tradition of similar firearm regulation—that supports the practice. 23 But preliminarily, it’s important to underscore what Bruen didn’t do. Bruen 24 didn’t undo all preexisting gun regulations. Licensing requirements, fingerprinting, 25 background checks, and mandatory gun safety training courses exist in many 26 states and operate as prerequisites to exercising the right to possess and carry 27 firearms. The legitimacy of these longstanding and common regulations was 28 recognized in District of Columbia v. Heller, 554 U.S. 446, 336 (2008) and in 1 McDonald v. Chicago, 561 U.S. 742, 786 (2010)—a point acknowledged by 2 Bruen. In his majority opinion in Bruen, Justice Thomas confirmed that the 3 constitution permits state licensing regimes to require gun licensing and 4 background checks as long as the requirements don’t have the effect of 5 preventing law-abiding citizens from exercising their Second Amendment rights. 6 Bruen, 142 S. Ct. at 2138 n.9.3 7 Justices Alito and Kavanaugh echoed this point in their concurring opinions. 8 Justice Alito wrote that Bruen decides nothing about “the requirements that must 9 be met to buy a gun,” and doesn’t “disturb anything that we said in [Heller or 10 McDonald] about restrictions that may be imposed on the possession or carrying 11 of guns.” Id. at 1257. Similarly, Justice Kavanaugh, joined by the Chief Justice, 12 affirmed that, under Heller, “the Second Amendment allows a ‘variety’ of gun 13 regulations,” including such “presumptively lawful regulatory measures” as 14 “requir[ing] a [gun] license applicant to undergo fingerprinting, a background 15 check, a mental health records check, and training in firearms handling and in 16 laws regarding the use of force, among other possible requirements.” Id. at 2162. 17

18 3 Bruen also didn’t repeal existing prohibitions under federal and state laws 19 governing who may possess a firearm. As examples, it is illegal under federal law for persons in the following categories to possess a firearm: a person convicted 20 of a crime punishable by imprisonment for more than one year, 18 U.S.C. 21 § 922(g)(1); a fugitive from justice, § 922(g)(2); an unlawful user of, or one addicted to, a controlled substance, § 922(g)(3); a person adjudicated as a mental 22 defective or committed to a mental institution, § 922(g)(4); a person illegally or 23 unlawfully in the United States, § 922(g)(5); a person dishonorably discharged from the Armed Forces, § 922(g)(6); U.S. citizens who have renounced their 24 citizenship, § 922(g)(7); a person subject to a domestic violence restraining order 25 issued after a hearing on notice, § 922(g)(8); and a person convicted of a misdemeanor domestic violence crime, § 922(g)(9). State laws have expanded 26 these categories. All of these laws necessarily contemplate collecting personal 27 information from gun and ammunition purchasers and CCW permit applicants, monitoring gun and ammunition sales, running criminal and mental health 28 1 What one gleans from these qualifications is that there is a difference 2 between prohibiting a right and regulating the right; so long as the regulation of 3 the right to keep and bear arms doesn’t amount to a prohibition of the right, the 4 regulation is permissible. Read together, Heller, McDonald, and Bruen establish 5 that “the Second Amendment is neither a regulatory straightjacket nor a regulatory 6 blank check.” Id. at 2133 (quoting Heller, 554 U.S. at 626). Rather, the cases 7 collectively confirm that the Second Amendment permits laws and regulations that 8 precondition the right to keep and bear arms on the obligation to comply with such 9 ministerial tasks as providing personal identifying information and submitting to a 10 background check—provided that the overall regulatory regime is neither overly 11 discretionary nor overly burdensome. See id. at 2138 n.9 (“[B]ecause any 12 permitting scheme can be put toward abusive ends, we do not rule out 13 constitutional challenges to shall-issue regimes where, for example, lengthy wait 14 times in processing license applications or exorbitant fees deny ordinary citizens 15 their right to public carry.”). Laws requiring gun owners to comply with such 16 ministerial tasks are presumptively valid and don’t violate the plain text of the 17 Second Amendment. 18 Therein lies the rub in this case. Under Bruen, the first step in assessing 19 whether a regulation violates the Second Amendment is to determine whether the 20 plain text of the Second Amendment covers the conduct regulated by the 21 challenged law. Id. at 2126. While Plaintiffs acknowledge the legitimacy of these 22 regulatory prerequisites to gun ownership and possession, and expressly disclaim 23 any purpose “to contest the statutory and regulatory scheme governing the 24 collection of personal information in connection with firearms and ammunition 25 transactions,” (Dkt. 24 at 3), they maintain that disclosure of such information to 26 third party researchers denies ordinary citizens the right to keep and bear arms. 27 Central to Plaintiffs’ Second Amendment claims is the premise that sharing their 28 personal information with outside gun research organizations jeopardizes their 1 personal privacy and physical security. Plaintiffs hypothesize that if their identities 2 are publicly revealed, they will be harassed, subjected to reprisals, and exposed 3 to heightened risks of their homes being burglarized or becoming victims of 4 violence. (FAC ¶¶ 81–82). Notwithstanding that DOJ protocols and the California 5 Penal Code forbid any approved research organization from publicly 6 disseminating the personal information of gun owners, Plaintiffs argue that their 7 information may still be hacked. They also surmise that renegade researchers— 8 hostile to their Second Amendment rights—could surreptitiously release their 9 information to the public. (Id. ¶¶ 84–85). Either possibility, according to Plaintiffs, 10 presents a threat of infringement to their Second Amendment rights. 11 The trouble with both arguments is that they are entirely speculative and 12 predictive of harm that is completely attenuated from the plain text and core 13 protections of the Second Amendment. Starting with the possibility of hacking, to 14 date, there has been no claim—not to mention any evidence—that personal 15 information supplied by the DOJ to either the UC Davis or Stanford research 16 organizations has been hacked. And the probability of hacking, though it can 17 never be completely foreclosed, has been greatly reduced by the requirement that 18 all bona fide research organizations follow strict data security protection protocols 19 set by the FBI and DOJ. Even without such protocols in place, the Court is dubious 20 that the threat of hacking alone is sufficient to state a Second Amendment 21 infringement claim. The only personal information to which the research 22 organizations have access is information previously collected by the DOJ. No 23 doubt recognizing the State’s incontrovertible right to collect personal information 24 from gun owners, Plaintiffs haven’t argued—nor could they—that the mere 25 collection of such information violates their Second Amendment rights by 26 improperly subjecting them to the threat of hacking. Nor have they presented 27 evidence that there is any greater threat that data will be hacked from the research 28 organizations than from the DOJ itself. Indeed, the only known unauthorized 1 disclosure of gun owner data was the June 27 mishap for which the DOJ was 2 entirely at fault. 3 Plaintiffs’ other fear—that dissident researchers might intentionally breach 4 DOJ protocols by publicly leaking their personal information—is equally 5 unsubstantiated. Again, to state the obvious, the possibility of a recusant, 6 ideologically motivated employee gaining access to Plaintiffs’ personal 7 information isn’t a risk that is peculiar to the UC Davis and Stanford gun research 8 organizations. No doubt there are state employees, perhaps even some within the 9 DOJ, with ideological axes to grind. But the mere possibility of misbehavior by a 10 rogue activist isn’t sufficient to prove that Plaintiffs will be deterred from exercising 11 their Second Amendment rights. This tenuous possibility existed when Plaintiffs 12 first supplied their personal information to the State so they could lawfully acquire 13 firearms, purchase ammunition, or obtain a CCW permit. Unfortunately, rogue 14 actors are a problem every society must grapple with in this technological age. 15 See In re Crawford, 194 F.3d 954, 959 (9th Cir. 1999) (“Enhanced risk, in fact, 16 obtains anytime the government requires an individual to deposit identifying 17 information in the public record.”). 18 Additionally, the speculative possibility of hacking or insider malfeasance 19 existed prior to the adoption of AB 173 and didn’t prevent Plaintiffs from acquiring 20 firearms and ammunition or obtaining or renewing CCW permits. Before AB 173’s 21 adoption, all five Plaintiffs in this case were registered California gun owners and 22 one was granted a CCW permit. The limited disclosure of private information for 23 research purposes permitted by AB 173 doesn’t expose Plaintiffs to any novel 24 risks or impose new burdens on them. Nor do these disclosures amount to an 25 “abusive” practice that prevents Plaintiffs from acquiring additional firearms or 26 ammunition or applying for or renewing a CCW permit in the future. 27 Plaintiffs’ alternative argument is that even if AB 173 doesn’t directly violate 28 the Second Amendment, disclosure of their personal information to the research 1 organizations chills their exercise of the right. A “chilling effect” on the exercise of 2 a constitutional right occurs when a person seeking to engage in constitutionally 3 protected activity is deterred from doing so by government regulations not 4 specifically prohibiting the protected activity. The test is an objective one that asks 5 whether a person of ordinary firmness would be deterred from exercising the 6 protected right. See O'Brien v. Welty, 818 F.3d 920, 933 (9th Cir 2016) (applying 7 test to claim of First Amendment retaliation). 8 In support of this argument, Plaintiffs Jane Doe, John Doe No. 2, and John 9 Doe No. 3 submitted declarations asserting that the disclosure of their personal 10 information to third-party researchers has dissuaded them from exercising their 11 Second Amendment rights. (Dkt. 26-9; 26-11; 26-12). But considering the 12 categorical prohibition on publicly disseminating any personal identifying 13 information that the DOJ has imposed on the research organizations, the 14 enhanced risks Plaintiffs fear are no more likely than the risks posed by many 15 other California laws that compel citizens to furnish publicly available personal 16 information. These include property title and land ownership registries, electoral 17 rolls, and court documents. See, e.g., Cal. Gov’t Code § 6253 (providing a right of 18 public access to records of state and local public agencies); § 6252(e) (defining 19 “public records” as “any writing containing information relating to the conduct of 20 the public’s business prepared, owned, used, or retained by any state or local 21 agency regardless of physical form or characteristics”); see also Publicly Available 22 Records: Records Available Online or Through a Different Process, City of San 23 Diego: Communications, https://www.sandiego.gov/communications/public- 24 records-requests/records-available (last visited Jan. 12, 2023) (listing various 25 records available for public inspection). Applications for CCW permits and records 26 of issuance of such permits are likewise considered public documents open to 27 inspection in California unless the public interest clearly weighs against their 28 disclosure. See Cal. Gov’t Code § 6255. The pervasiveness of such publicly 1 available personal information weighs strongly against the objective 2 reasonableness of Plaintiffs’ “chilling effect” claim.4 3 For these reasons, the Plaintiffs’ Second Amendment facial challenge to 4 AB 173 fails. Permitting gun owners’ information to be shared under strict privacy 5 protection protocols for legitimate research purposes is merely a limited extension 6 of the “presumptively lawful regulatory measures” that permit states to collect 7 information from gun and ammunition purchasers and CCW permit applicants in 8 the first place. Ancillary regulations like these don’t restrict conduct covered by 9 the plain text of the Second Amendment and are permissible. 10 C. Fourteenth Amendment Challenges 11 Plaintiffs next contend that the information disclosure provisions of AB 173 12 violate the privacy and due process guarantees of the Fourteenth Amendment. 13 Their argument is two-fold. First, relying on the right to informational privacy 14 recognized in the Fourteenth Amendment, Plaintiffs reprise their position that 15 permitting disclosure of their personal information to third-party researchers 16 violates their right to privacy. Second, they maintain that AB 173 violates the 17 Fourteenth Amendment guarantee of due process by retroactively expanding the 18 purpose for which their personal information was collected and by broadening 19 access to the information. 20 1. Alleged Violation of Right to Informational Privacy 21 The Ninth Circuit has recognized a constitutional right to informational 22 privacy. In re Crawford, 194 F.3d at 958 & n.4. At the core of this right is the 23 “individual[’s] interest in avoiding disclosure of personal matters.” Id. at 958 24 25 4 The Doe declarations also allude to the “potentiality” of dissemination of their 26 personal information “to the broader public.” (Dkt. 26-9 at 4; 26-11 at 4). But 27 considering the DOJ prohibitions previously discussed, this conjectural risk must also be discounted by the improbability of its occurrence. In re Crawford, 194 F.2d 28 1 (quoting Doe v. Attorney General, 941 F.2d 720, 795 (9th Cir. 1991)). The scope 2 of protection extends to “inherently sensitive or intimate information,” the 3 disclosure of which could “lead directly to injury, embarrassment or stigma.” Id. at 4 960. But the right “is not absolute; rather, it is a conditional right which may be 5 infringed upon a showing of proper governmental interest.” Doe, 941 F.2d at 796. 6 Plaintiffs’ claim of informational privacy requires the Court to weigh their 7 asserted privacy interests against the government’s professed interests in 8 disclosure. Id. Relevant considerations include: (1) the type of record; (2) the 9 information contained in the record; (3) the potential for harm from any subsequent 10 nonconsensual disclosure; (4) the injury from disclosure to the relationship in 11 which the record was generated; (5) the adequacy of safeguards to prevent 12 unauthorized disclosure; (6) the degree of need for access; and (7) the public 13 interest in access. Id. (quoting United States v. Westinghouse Elec. Corp., 638 14 F.2d 570, 578 (3d Cir. 1980)). “[T]he government has the burden of showing that 15 ‘its use of the information [advances] a legitimate state interest and that its actions 16 are narrowly tailored to meet [that] legitimate interest.’” Id. “In most cases, it will 17 be the overall context, rather than the particular item of information, that will dictate 18 the tipping of the scales.” In re Crawford, 194 F.3d at 959. 19 Plaintiffs contend that the biographical information that gun and ammunition 20 purchasers and CCW permit applicants must disclose, such as their names, 21 addresses, dates of birth, and driver’s license numbers—when considered in 22 combination with their status as known gun owners—is confidential information 23 protected by the Fourteenth Amendment. Their specific fear is that 24 non-government researchers may publicly identify them as firearms owners, 25 which in turn might subject them to harassment, threats of physical violence, and 26 the theft of their firearms. Prudent analysis of the relevant considerations listed 27 above doesn’t support their argument. 28 The gun and ammunition purchase records collected by the DOJ are routine 1 ministerial records required by federal and California law. See, e.g., 18 U.S.C. 2 § 923(g)(1)(A)(4) (requiring licensed firearm importers, manufacturers, and 3 dealers to maintain records of firearms sales); Cal. Penal Code § 28100 (requiring 4 firearms dealers to maintain a record of all firearms sales); Cal. Penal Code 5 § 30352(b)(1) (requiring the DOJ to maintain a record of all ammunition sales in a 6 database called the Ammunition Purchase Records File). And the Ninth Circuit 7 has previously held that Plaintiffs’ interest in maintaining confidential the fact of 8 their gun ownership is minimal. See Silveira v. Lockyer, 312 F.3d 1052, 1092 9 (9th Cir. 2002) (finding minimal the plaintiffs’ interests in maintaining confidential 10 the fact of their assault weapon ownership). The privacy interest in CCW permits 11 is similarly minimal, as these records have been deemed public records in 12 California since 1957. See CBS Inc. v. Block, 42 Cal. 3d 646, 655 (1986). Nothing 13 in the nature of these types of records is stigmatizing, embarrassing, or likely to 14 lead directly to injury. Cf. Doe, 941 F.2d 780 (holding records of HIV-status and 15 AIDS diagnosis protected by the right to privacy); Whalen v. Roe, 429 U.S. 589 16 (1977) (same for medical information). 17 The nature of the information contained in the records—biographical 18 information that is generally available in many other public registries—is likewise 19 unremarkable. The parties dispute whether social security numbers are included 20 in the data,5 but even if so, the inclusion of this information doesn’t necessarily 21 violate Plaintiffs’ right of informational privacy. In re Crawford, 194 F.3d at 960 22 (finding social security numbers disclosed to the public in bankruptcy filings not 23 protected). Finally, Plaintiffs’ contention that their biographical information and 24 their status as known gun owners in combination poses a threat to them is 25 unsupported. Other federal courts have held the right to privacy doesn’t protect 26 “one’s name, address, and status as a firearm licensee,” Doe No. 1 v. Putnam 27

28 1 Cty., 344 F. Supp. 3d 518, 541 (S.D.N.Y. 2018); see also Burke v. Vision Gov’t 2 Sols., Inc., 433 F. Supp. 3d 380, 392 (D. Conn. 2020) (finding no Fourteenth 3 Amendment right to privacy in one’s status as a firearm permit holder), so 4 considering this factor in combination with disclosure of Plaintiffs’ biographical 5 information adds nothing to the required balancing of interests. 6 The potential for harm from disclosure of Plaintiff’s personal information— 7 especially social security numbers—isn’t trivial. In re Crawford, 194 F.3d at 958 8 (noting danger of rampant identity theft). But this factor must necessarily be 9 considered in tandem with another factor: the adequacy of safeguards to prevent 10 unauthorized disclosure. To reiterate, no data security system is failproof. And 11 while neither party has presented the Court with concise data on the prevalence 12 of hacking, there is no dispute that the UC Davis and Stanford research 13 organizations employ safeguards designed to prevent disclosure of shared 14 information to unscrupulous third parties. It is likewise undisputed that, to date, 15 there have been no incidents or reports of hacking of the organizations’ 16 databases. Considering that both research organizations follow DOJ and FBI 17 computer security and protection protocols, the speculative possibility of a data 18 breach occurring at UC Davis or Stanford is no more likely than one occurring at 19 the DOJ, where the data originates. The risk of unauthorized disclosure has been 20 mitigated to the extent reasonably possible. 21 The final two factors, the degree of need for access and the public interest 22 in access, should also be considered together. The legislative findings and 23 declarations supporting AB 173, (Dkt. 36 at 14); Cal. Penal Code § 14230(a), 24 identify California’s interest in the public health and safety challenges posed by 25 firearm violence. The findings take note of the multiple forms of firearm violence, 26 highlighting the rising rate of suicides, as well as homicides and accidental deaths. 27 (Dkt. 36 at 14); § 14230(a), (b); see also Mai v. United States, 952 F.3d 1106, 28 1120–21 (9th Cir. 2020) (discussing suicide as a form of “gun violence”). The 1 California legislature specifically found that, because of limited research, “[t]oo 2 little is known about firearm violence and its prevention.” (Dkt. 36 at 14); § 3 14230(e). These findings constitute an express statutory mandate and an 4 articulated public policy supporting the restricted disclosure provisions of the 5 statute. See Doe, 941 F.2d at 796. While the State’s interests are served in the 6 first instance by collecting data from gun owners, the California legislature 7 reasonably assumes that analysis of the collected data by trained researchers 8 may also prove helpful in advancing the State’s objectives. These findings are 9 sufficient to meet the State’s burden of showing that its use of the information in 10 the manner prescribed advances a legitimate state interest. 11 The State has also demonstrated that disclosure of the information to the 12 research organizations is narrowly tailored to meet the State’s legitimate state 13 interest in preventing gun violence. The essential concern underlying Plaintiffs’ 14 lawsuit isn’t the confidential dissemination of their personal information to small 15 groups of vetted researchers. Rather, Plaintiffs’ core concern is that their personal 16 identifying information will somehow make its way into the public square, which 17 will lead to negative consequences. The strict security precautions enacted by 18 DOJ are designed to prevent such an occurrence. Forbidding the research 19 organizations from publicly disseminating shared data absent DOJ approval, 20 requiring background checks of those with access to the data, and mandating 21 strict security protocols governing access to the data repositories all help to 22 protect unauthorized disclosure of Plaintiffs’ information. 23 Balancing the relevant factors, the Court finds that the disclosure provisions 24 of AB 173 don’t violate Plaintiffs’ Fourteenth Amendment right to informational 25 privacy. 26 2. Alleged Violation of Due Process 27 Plaintiffs argue that AB 173 violates the Fourteenth Amendment guarantee 28 of due process because it retroactively expands the purposes for which 1 information collected from them could be used and broadens access to their 2 personal information. According to Plaintiffs, when they originally provided 3 personal information to DOJ to lawfully purchase firearms and ammunition, or to 4 apply to obtain a CCW permit, two California statutes, Penal Code §§ 11106 and 5 30352, declared that such information would be used “only for enumerated law 6 enforcement purposes such as assisting with criminal investigations, arrests, and 7 prosecutions.”6 (Dkt. 26 at 32). Plaintiffs contend they relied on these statutory 8 assurances and assert that permitting bona fide researchers to access their 9 information isn’t an authorized “law enforcement purpose.” 10 To begin, it isn’t obvious that the California Penal Code sections Plaintiffs 11 cite evince the intent of the California legislature to limit access to the AFS 12 database in the manner they suggest. Plaintiffs maintain that before the 13 amendments effected by AB 173, § 11106 expressly limited disclosure of their 14 personal information “only to a limited class of statutorily defined governmental 15 actors and agencies, and only for law enforcement purposes.” (Dkt. 28 ¶ 140).7 In 16

17 6 Record support for this statement isn’t apparent. The materials Plaintiffs point to—Exhibits 11, 12, and 13 to the FAC—don’t contain the limiting language they 18 recite. For example, although DOJ’s Privacy Policy Statement, attached as 19 Exhibit 11, states “[w]e only use or disclose personal information for the specified purposes [the information was collected for],” it goes on to disclaim that the privacy 20 policy is subject to change at any time without notice. (FAC, Ex. 11 at 3–4). 21 Similarly, the privacy notice attached to the Personal Firearms Eligibility Check Application and Firearms Ownership Report, Exhibits 12 and 13 respectively, 22 provides that personal information may be disclosed to “other persons . . . when 23 necessary to perform their legal duties, and their use of your information is compatible and complies with state law, such as for . . . regulatory purposes.” (Id. 24 Ex. 12 at 5; Ex. 13 at 5). Moreover, the list of valid disclosures under California 25 Penal Code § 11105 includes such non-law enforcement purposes as disclosure to health officers for the prevention of disease, § 11105(b)(14), and disclosure to 26 public transportation agencies “for the purpose of oversight and enforcement 27 policies with respect to its contracted providers.” § 11105(b)(25). 28 1 fact, the pre-AB 173 version of § 11106 didn’t expressly limit the purposes for 2 which information could be shared to just those enumerated in the statute’s text. 3 Instead, § 11106 delegated authority to the Attorney General and directed him to, 4 “upon proper application therefor, furnish the information to the officers referred 5 to in Section 11105.” Cal. Penal Code § 11106(b)(3) (eff. Jan. 1, 2021 to Sept. 22, 6 2021). Section 11105, in turn, authorized the Attorney General to provide access 7 to a broad swath of criminal and non-criminal information—including the AFS 8 database—to state and local officials and to other listed entities for a variety of 9 law enforcement purposes and some other purposes.8 See Cal. Penal Code 10 § 11105 (listing officers and entities). But for the sake of considering Plaintiffs’ due 11 process argument, the Court will assume that AB 173 retroactively broadened the 12 scope of access to the AFS data base. 13 Nonetheless, the flaw in Plaintiffs’ due process argument is that retroactive 14 changes to a statute, standing alone, don’t violate due process. See Landgraf v. 15 USI Film Prods., 511 U.S. 244, 269 & n.21 (1994) (“A statute does not operate 16 ‘retrospectively’ merely because it is applied in a case arising from conduct 17 antedating the statute’s enactment or upsets expectations based in prior law.”) 18 (citation omitted). To be sure, legislative prospectivity remains the appropriate 19 default rule. Id. at 272. But the constitutional impediments to retroactive civil 20 legislation are now modest, id., and unless a statutory change violates a specific 21

22 § 11106 or § 11105. Regardless, the Court disagrees with Plaintiffs’ narrow 23 interpretation of the phrase. Legislators, prosecutors, judges—even cops on the beat—possess no special prowess or general expertise that permits them to 24 identify workable approaches to preventing gun violence, gun accidents, and gun 25 suicides. But perhaps researchers do. It is therefore quintessentially a “law enforcement purpose” for the state to enlist assistance from trained researchers 26 and research organizations to study these problems and to suggest solutions 27 based on their review of pertinent firearm data. 28 1 provision of the Constitution, “the potential unfairness of retroactive civil legislation 2 is not a sufficient reason for a court to fail to give a statute its intended scope,” id. 3 at 267. 4 For Plaintiffs’ retroactivity challenge to succeed, they must first demonstrate 5 that AB 173 “attaches new legal consequence to events completed before its 6 enactment.” Id. at 270. A new legal consequence is one that imposes a new 7 “liability or penalty.” Pinnock v. Int’l House of Pancakes Franchisee, 844 F. Supp. 8 574, 584 (S.D. Cal. 1993). Plaintiffs must also demonstrate that, in enacting 9 AB 173, the California legislature “acted in an arbitrary and irrational way.” 10 Pension Ben. Guar. Corp. v. R.A. Gray & Co., 467 U.S. 717, 729 (1984). The latter 11 issue is reviewed under the rational basis standard. See Gadda v. State Bar of 12 Cal., 511 F.3d 933, 938 (9th Cir. 2007). To survive rational basis review, “the 13 statute must be based on ‘a legitimate legislative purpose furthered by rational 14 means.’” Campanelli v. Allstate Life Ins. Co., 322 F.3d 1086, 1100 (9th Cir. 2003) 15 (quoting Gen. Motors Corp. v. Romein, 503 U.S. 181, 191 (1992)); see also 16 Pension Ben. Guar. Corp., 467 U.S. at 729 (“Provided that the retroactive 17 application of a statute is supported by a legitimate legislative purpose furthered 18 by rational means, judgments about the wisdom of such legislation remain within 19 the exclusive province of the legislative and executive branches”). 20 Having rejected Plaintiffs’ argument that the limited nonpublic disclosure of 21 their personal information to bona fide research organizations violates their right 22 to informational privacy, the Court is unable to identify any other new legal 23 consequence, liability, or penalty that AB 173 imposes on Plaintiffs. Considering 24 the required DOJ protocols and data security measures that are in place, Plaintiffs 25 haven’t established that the risk of public dissemination of their information, as 26 well as all of the attendant harms they dread, are any greater simply because 27 AB 173 adds an additional category to the comprehensive list of disclosures 28 authorized by Penal Code § 11105. 1 Even assuming that AB 173 attaches new legal consequences to the record 2 keeping regulations governing gun and ammunition purchases and CCW permit 3 applications, Plaintiffs’ due process claim still fails because they haven’t shown 4 that the California legislature acted in an arbitrary and irrational way. Pension Ben. 5 Guar. Corp., 467 U.S. at 729. By establishing the Firearms Violence Research 6 Center and authorizing the Center to conduct research into the prevention of gun 7 violence, gun accidents, and firearm-related suicide, the California legislature 8 sought to further the State’s interest in public health and safety. See Cal. Penal 9 Code § 14230(e). As explained above, granting vetted researchers access to 10 study protected firearms data as a means of implementing § 14230 serves a 11 legitimate legislative purpose in a rational and narrowly tailored manner. While 12 AB 173 may have expanded non-public access to Plaintiffs’ personal information, 13 this post factum expansion was neither arbitrary nor irrational. 14 Plaintiffs’ argument regarding Penal Code § 30352, which establishes 15 record keeping requirements for ammunition vendors, is similarly inapt. Before 16 being amended by AB 173, § 30352 required ammunition venders to electronically 17 notify the DOJ of all ammunition sales, and further provided that the information 18 was subject to disclosure under § 11105. See Cal. Penal Code § 30352(b) (eff. 19 Jan. 1, 2021 to Sept. 22, 2021). The only material change to § 30352 effected by 20 AB 173 was to permit ammunition sales information to be disclosed to the gun 21 research organizations in the same manner and under the same DOJ protocols 22 that apply to all other database information. Compare id. with § 30352(b)(2) (eff. 23 Sept. 22, 2021). For the reasons discussed above, such disclosure doesn’t violate 24 Plaintiffs’ due process rights. 25 Because AB 173 doesn’t unconstitutionally expand the limited purposes for 26 which gun and ammunition purchaser and CCW application data may be collected 27 or shared, the Court rejects Plaintiffs’ due process claim. 28 // 1 D. Preemption under the Federal Privacy Act 2 Plaintiffs’ last claim concerns only applicants for CCW permits and holders 3 of these permits. They argue that federal law preempts AB 173 insofar as AB 173 4 authorizes disclosure of their social security numbers to third parties in derogation 5 of the Privacy Act of 1974. (FAC ¶¶ 152–61). The argument relies on the notice 6 requirement contained in section 7(b) of the Privacy Act, Pub. L. No. 93-579, 7 § 7(b) 88 Stat. 1896, 1909, reprinted in 5 U.S.C. § 552a note, which provides: 8 Any Federal, State, or local government agency which 9 requests an individual to disclose his social security account number shall inform that individual whether that 10 disclosure is mandatory or voluntary, by what statutory or 11 other authority such number is solicited, and what uses will be made of it. 12 13 Plaintiffs’ argument misapprehends the text of AB 173 by conflating the statutory 14 language with a section of the CCW application form used by the DOJ. 15 The parties agree that the DOJ form application for obtaining a CCW permit 16 includes a box for applicants to list their social security numbers. The form doesn’t 17 specify whether disclosure of one’s social security number is mandatory or 18 voluntary. However, nothing in the text of AB 173 requires CCW applicants to 19 furnish this information. In fact, the text of the statute doesn’t even mention social 20 security numbers. Contrary to Plaintiffs’ argument, there is no conflict between the 21 text of AB 173 and that of the Federal Privacy Act implicating a statutory 22 preemption issue.9 23 V. CONCLUSION 24 For the forgoing reasons, the Court GRANTS Defendant’s Motion to 25 Dismiss, and DISMISSES Plaintiffs’ FAC in its entirety. To the extent Plaintiffs 26 27 9 The Court expresses no view whether the CCW application form currently used 28 1 ||wish to amend their claims, they may do so by filing a motion for leave to amend 2 ||by February 10, 2023, in accordance with the Southern District's Civil Local Rules 3 ||and this Court’s Civil Standing Order. 4 IT IS SO ORDERED. > lDated: January 12, 2023 lau A. (Buywy 6 Hon. Larry Alan Burns 7 United States District Judge 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28