UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLUMBIA
LEAGUE OF WOMEN VOTERS, et al.,
Plaintiffs,
Civil Action No. 25 - 3501 (SLS)
v.
Judge Sparkle L. Sooknanan U.S. DEPARTMENT OF HOMELAND SECURITY, et al.,
Defendants.
MEMORANDUM OPINION
This case is about a recent overhaul of the Systematic Alien Verification for Entitlements (SAVE) system, which is used by the Department of Homeland Security (DHS) to respond to requests from state and local authorities to verify citizenship and immigration status. Voters and various non-profit organizations sued DHS, the Social Security Administration (SSA), and other federal governmental actors to challenge the changes. They allege that the Government’s overhaul of SAVE—which transformed the system’s functionality and increased the scope of covered individuals to include citizens born in the United States—made it less accurate, violated statutory procedures, and was contrary to law. The Plaintiffs originally moved for a preliminary injunction and asked the Court to certify a preliminary relief subclass. But they have since withdrawn those motions and now ask the Court only to issue a stay under the Administrative Procedure Act (APA) reverting SAVE to its functionality prior to the overhaul. Based on the current record, the Court is troubled by the recent changes to SAVE and doubts the lawfulness of the Government’s actions. But because the Plaintiffs have not demonstrated irreparable injury, the Court may not grant a stay
2
under the APA. The Court instead directs the Parties to propose an expedited schedule to resolve this case on the merits.
BACKGROUND
A. Statutory Background The Privacy Act of 1974 establishes “certain safeguards for an individual against an invasion of personal privacy by requiring Federal agencies” to “collect, maintain, use, or disseminate any record of identifiable personal information in a manner that assures that such action is for a necessary and lawful purpose.” Privacy Act of 1974 § 2(b)(4), Pub. L. No. 93-579, 88 Stat. 1896 (1974), codified at 5 U.S.C. § 552a note.
1. Statutory Restrictions The statute offers substantial protections regarding governmental use and retention of identifiable personal information. See 5 U.S.C. § 552a. For instance, the statute instructs federal agencies to “collect information to the greatest extent practicable directly from the subject individual” when use of the information can adversely affect the individual’s rights. Id. § 552a(e)(2). It requires agencies to maintain records “with such accuracy, relevance, timeliness, and completeness as is reasonably necessary to assure fairness to the individual.” Id. § 552a(e)(5). And it provides various mechanisms to give individuals notice of what records are maintained by the federal government and to correct any inaccuracies in those records. Id. § 552a(d)–(g). The Act prohibits both inter-agency and extra-agency disclosure of government records except in limited circumstances. Id. § 552a(b). One such circumstance is a “routine use,” which is defined as “the use of such record for a purpose which is compatible with the purpose for which it was collected.” Id. § 552a(a)(7), (b)(3).
In 1988, Congress amended the Privacy Act with the Computer Matching and Privacy Protection Act of 1988, Pub. L. No. 100-503, 102 Stat. 2507 (1988). That statute prohibits federal
3
agencies from disclosing records to other federal agencies, state governments, or local governments through a “computer matching program” without a written agreement. 5 U.S.C. § 552a(o)(1). The Act establishes various statutory requirements governing such agreements. Id § 552a(o). And it prohibits state or local governments from duplicating or disclosing federal records received pursuant to such an agreement “except where required by law or essential to the conduct of the matching program.” Id. § 552a(o)(1)(H). That same prohibition applies to federal agencies with respect to records provided by “any State or local government, or agency thereof, which discloses records to be used in a matching program.” Id. § 552a(a)(11), (o)(1)(H).
Congress further provided that nothing in the 1988 Act “shall be construed to authorize (1) the establishment or maintenance by any agency of a national data bank that combines, merges, or links information on individuals maintained in systems of records by other Federal agencies; (2) the direct linking of computerized systems of records maintained by Federal agencies;” or “(3) the computer matching of records not otherwise authorized by law.” Computer Matching and Privacy Protection Act of 1988, § 9, Pub. L. No. 100-503, 102 Stat. 2507, 2514, codified at 5 U.S.C. § 552a note.
2. Procedural Safeguards The Privacy Act also adopts procedural safeguards when the records maintained by a federal agency, i.e., a “system of records,” are changed or used in a new way. 5 U.S.C. § 552a(a)(5), (e). Congress enacted these safeguards to “permit an individual to determine what records pertaining to him are collected, maintained, used, or disseminated by [federal] agencies” and ensure “adequate safeguards are provided to prevent misuse of such information.” Privacy Act of 1974 § 2(b)(1), (4), 88 Stat. 1896 (1974), codified at 5 U.S.C. § 552a note.
4
In relevant part, the statute establishes strict notice and comment requirements in these circumstances. 5 U.S.C. § 552a(e)(4), (11). When an agency “establish[es] or revis[es]” any “system of records,” it must “publish in the Federal Register . . . a notice of the existence and character of the system of records,” i.e., a System of Records Notice (SORN). Id. § 552a(e)(4). Each SORN “shall include” nine categories of information:
(A) the name and location of the system;
(B) the categories of individuals on whom records are maintained in the system;
(C) the categories of records maintained in the system;
(D) each routine use of the records contained in the system, including the categories of users and the purpose of such use;
(E) the policies and practices of the agency regarding storage, retrievability, access controls, retention, and disposal of the records;
(F) the title and business address of the agency official who is responsible for the system of records;
(G) the agency procedures whereby an individual can be notified at his request if the system of records contains a record pertaining to him;
(H) the agency procedures whereby an individual can be notified at his request how he can gain access to any record pertaining to him contained in the system of records, and how he can contest its content; and
(I) the categories of sources of records in the system.
Id. To publish a statutorily compliant SORN, id., a federal agency must provide at least 30-days prior “notice of any new use or intended use of the information in the system, and provide an opportunity for interested persons to submit written data, views, or arguments to the agency.” Id. § 552a(e)(11). And the agency must provide notice to Congress. Id. § 552a(r).
B. Factual Background SAVE is a system administered by DHS that is “designed to help federal, state, tribal, and local government agencies confirm citizenship and immigration status prior to granting benefits
5
and licenses, as well as for other lawful purposes.” DHS, DHS Ref. No. DHS/USCIS/PIA-006(c), Privacy Impact Assessment for the Systematic Alien Verification for Entitlements Program, at 2 (2020), https://perma.cc/HU2M-NTL8 (2020 PIA). SAVE users “formalize the purpose and use in which they use SAVE through a Memorandum of Agreement (MOA) or Computer Matching Agreement” establishing “the terms and conditions for the user agency’s participation in SAVE.” Id. at 2–3. One purpose for which states can enter into an agreement to use SAVE is to verify the citizenship of registered voters. DHS, Privacy Act of 1974; Notice of Modified System of Records, 90 Fed. Reg. 48948, 48952 (Oct. 31, 2025) (2025 SORN).
In early 2025, President Donald J. Trump issued various executive orders establishing a new Department of Government Efficiency (DOGE) within the Executive Office of the President and instructing DHS and SSA to cooperate with DOGE to improve state governments’ access to federal systems for verifying citizenship or immigration status. See Exec. Order No. 14158, Establishing and Implementing the President’s “Department of Government Efficiency,” 90 Fed. Reg. 8441 (Jan. 20, 2025); Exec. Order No. 14243, Stopping Waste, Fraud, and Abuse by Eliminating Information Silos, 90 Fed. Reg. 13681 (Mar. 20, 2025); Exec. Order No. 14248, Preserving and Protecting the Integrity of American Elections, 90 Fed. Reg. 14005 (Mar. 25, 2025). Pursuant to these executive orders, DHS and DOGE announced on April 22, 2025, that they were transforming SAVE to “ensure government officials can swiftly verify legal status, halting entitlements and voter fraud.” Press Release, DHS, USCIS, DOGE Overhaul Systematic Alien Verification for Entitlements Database, Dep’t of Homeland Sec. (Apr. 22, 2025), https://perma.cc/Y8A5-YX3M. But the Government did not publish any new notice or provide an opportunity to comment on this initiative. Mot. Hr’g Tr. 71:15–22, ECF No. 48. So the operative
6
SORN for SAVE continued to be one published on May 27, 2020. DHS, Privacy Act of 1974; Notice of Modified System of Records, 85 Fed. Reg. 31798 (May 27, 2020) (2020 SORN).
The Plaintiffs point out that for prior revisions of SAVE, DHS recognized SAVE as a system of records subject to the Privacy Act, complied with that statute’s notice-and comment- requirements, and issued corresponding SORNs.1 The Government is unclear about whether it was ever required to comply with the Privacy Act for changes to SAVE, but it concedes that the 2025 changes were substantial enough that the Privacy Act would require a SORN if it applies. Mot Hr’g Tr. 69:21–24.
C. The Plaintiffs’ Challenge In September 2025, the Plaintiffs filed this action challenging the Government’s recent overhaul of SAVE. See Compl., ECF No. 1. There are various Organizational Plaintiffs, including the League of Women Voters and local affiliates of that organization, Compl. ¶¶ 29–33, as well as the Electronic Privacy Information Center, Compl. ¶ 34. There are also Individual Plaintiffs who are naturalized U.S. citizens residing in states that currently use the overhauled SAVE system to
1 See Privacy Act of 1974; Notice of Modified System of Records, 85 Fed. Reg. 31798 (May 27, 2020); Privacy Act of 1974; Department of Homeland Security United States Citizenship and Immigration Services–004 Systematic Alien Verification for Entitlements Program System of Records, 81 Fed. Reg. 78619 (Nov. 8, 2016); Privacy Act of 1974; Department of Homeland Security U.S. Citizenship and Immigration Services (USCIS)—004—Systematic Alien Verification for Entitlements (SAVE) Program System of Records, 77 Fed. Reg. 47415 (Aug. 8, 2012) (2012 SORN); Privacy Act of 1974; USCIS–004 Verification Information System (VIS) System of Records Notice, 73 Fed. Reg. 75445 (Dec. 11, 2008); Privacy Act of 1974; USCIS; Verification Information System (VIS) System of Records Notice, 73 Fed. Reg. 10793 (Feb. 28, 2008); Privacy Act: Verification Information System Records Notice, 72 Fed. Reg. 17569 (Apr. 9, 2007); Privacy Act of 1974; System of Records, 67 Fed. Reg. 64134 (Oct. 17, 2002); Privacy Act of 1974; System of Records, 66 Fed. Reg. 46812 (Sep. 7, 2001).
7
verify voter lists and registration. Pls.’ Prelim. Inj. Mot. (PI Mot.) 4 n.9, ECF No. 16-1.2 The Individual Plaintiffs bring a putative class action on behalf of “[a]ll United States citizens and lawful permanent residents whose records containing their Personally Identifiable Information (PII) are contained in the Interagency Data Systems, whose PII originated from a federal agency other than DHS or its subcomponents, and who did not consent to that PII being shared with DHS.” Compl. ¶ 196.
The Plaintiffs contend that the changes to SAVE violated the Administrative Procedure Act (APA) and the Privacy Act. PI Mot. 4. They further argue that the changes were ultra vires and violate the separation of powers. Id. For purposes of this motion, they challenge three changes to SAVE: (1) the ability to access SSA records, (2) the inclusion of U.S.-born citizens, and (3) the system’s increased search capacity.
SSA Records. Prior to 2025, SAVE only accessed records stored in a DHS cloud service—
the Verification Information System (VIS). 2020 PIA, at 3, 12. VIS contained data from the legacy SAVE database and updated that data daily with any new DHS or other agency records that SAVE was designed to access under the 2020 SORN. 2020 PIA, at 3 n.3, 10–12. The VIS cloud-storage system operated pursuant to SAVE’s 2020 SORN, 2020 PIA, at 3 n.3, and was viewed as an extension of the SAVE system of records, 2020 SORN, at 31800 (identifying VIS as a “system
2 Only some of the Plaintiffs who filed this lawsuit have requested the APA stay at issue here. PI Mot. 4 n.9. John Doe 1 is a naturalized citizen voter in Texas who has reason to believe their data in the SSA system is inaccurate. Doe 1 Decl. ¶¶ 5, 14, ECF No. 16-2. John Doe 4 is a naturalized citizen voter in Louisiana who has reason to believe their data in the SSA system is inaccurate. Doe 4 Decl. ¶¶ 5, 14, ECF No. 16-3. John Doe 5 is a naturalized citizen voter in Virginia who has reason to believe their data in the SSA system is inaccurate. Doe 5 Decl. ¶¶ 5, 13, ECF No. 16-4.
8
location” for SAVE).3 Accordingly, before the overhaul, the Government referred to “SAVE” as a “database”—i.e., a system that included the search tool and the cloud data underlying it. Press Release, DHS, USCIS, DOGE Overhaul Systematic Alien Verification for Entitlements Database, DHS (Apr. 22, 2025), https://perma.cc/Y8A5-YX3M.
Following the overhaul, SAVE is no longer “a database for immigration status and citizenship information.” 2025 SORN, at 48949. Rather, SAVE now directly “searches multiple government databases or systems to provide a SAVE response.” Id.4 This includes SSA databases—which were not previously identified as accessible in the 2020 SORN. 2025 SORN, at 48950, 48952. The Plaintiffs allege that the use of SSA data raises serious accuracy concerns because “the citizenship [data] SSA maintains merely represents a snapshot . . . [from] the time of their interaction with SSA,” e.g., when they applied for a social security card. PI Mot. 16. And a 2006 internal audit estimated that SSA’s citizenship data inaccurately identified about 3.3 million citizens as non-citizens “because they had become U.S. citizens after obtaining their SSN.” 5 The Government does not dispute that such inaccuracies likely still exist. Mot. Hr’g Tr. at 61:1–9.
3 VIS previously operated under its own SORN. See Privacy Act of 1974; USCIS–004 Verification Information System (VIS) System of Records Notice, 73 Fed. Reg. 75445 (Dec. 11, 2008). But recent modifications to VIS have been made under the SAVE SORN. See 2020 PIA, at 3 n.3; 2020 SORN, at 31799; 2012 SORN, at 47415. 4 Specifically, SAVE’s underlying “service,” the Verification Data Integration Service, conducts the search. 2025 SORN, at 48949. The term “Verification Data Integration Service” has not been used in prior SAVE SORNs and is undefined. See id. Unlike the detailed description of VIS in the 2020 PIA, this Service is not referenced in SAVE’s 2025 PIA. See DHS, Ref. No. DHS/USCIS/PIA-006(d), Privacy Impact Assessment for the Systematic Alien Verification for Entitlements “SAVE” Program (2025), https://perma.cc/HXG9-83G2. 5 SSA Off. of the Inspector Gen., No. A-08-06-26100, Congressional Response Report: Accuracy of the Social Security Administration’s Numident File iii (Dec. 18, 2006), https://perma.cc/5G2JFF4V.
9
U.S.-Born Citizens. SAVE primarily assists with “Systematic Alien Verification for Entitlements.” 2020 SORN, at 31800 (emphasis added). So, prior to the recent changes, SAVE only verified the status of “an immigrant, nonimmigrant, and certain naturalized and derived U.S. citizens.” 2020 PIA, at 2. SAVE rarely had access to records about U.S.-born citizens unless they had some other interaction with DHS, e.g., as a sponsor for a non-citizen. 2020 SORN, at 31801. Following the overhaul, SAVE now accesses the data of nearly every person in SSA’s databases— including U.S. citizens by birth. 2025 SORN, at 48949. The Plaintiffs challenge this expansion— which they suggest “ballooned the population of Americans whose sensitive personal information is accessed through SAVE by over 1,000%—from about 26.5 million to over 300 million.” PI Mot. 26 (emphasis omitted).
Search Functionalities. Finally, SAVE searches were previously conducted on a case-by-
case basis using an individual’s DHS identifier (A-Number). 2020 SORN, at 31799. Now, SAVE allows for: (1) bulk searches, and (2) searches using either full or partial social security numbers. See PI Mot. 15. The Plaintiffs allege concerns about the scope of such widespread searches and the accuracy of only using a partial social security number. Id. at 14–15.
Soon after filing this lawsuit, the Plaintiffs moved for both an APA stay and preliminary injunction prohibiting the Defendants from using the current, newly configured SAVE system and requiring the Defendants to return SAVE to its pre-overhaul functionality. PI Mot. The Plaintiffs also moved for class certification for a subclass in support of their request for a preliminary injunction. See Mot. Certification Prelim. Relief Subclass, ECF No. 17. The Court held a hearing on October 28, 2025. After the hearing, the Plaintiffs withdrew their request for certification of a subclass and the corresponding request for a preliminary injunction. See Notice, ECF No. 46. At this juncture, only the motion for an APA stay remains before this Court. Id.; see also Mot. Hr’g
10
Tr. at 26:18–25, 27:1–3. This motion is fully briefed and ripe for review. See Opp’n, ECF No. 37; Reply, ECF No. 41; Pls’ Supp. Mem., ECF No. 47; Defs.’ Supp. Resp., ECF No. 51.
During the pendency of these proceedings, DHS and SSA published SORNs reflecting the recent changes to the SAVE system. Defs.’ Supp. Resp. 8; Defs.’ Notice, ECF No. 54. The DHS SORN also provides notice of additional proposed modifications to SAVE that have not yet gone into effect. 2025 SORN, at 48949, 48951. It provides for a comment period until December 1, 2025, but says that new or modified uses will automatically go into effect on that date. Id. at 48949. Id. The SSA SORN confirms the existing changes to DHS’s access of its records and includes a comment period up until December 12, 2025. SSA, Privacy Act of 1974 Notice of a Modified System of Records, 90 Fed. Reg. 50879, 50880 (Nov. 12, 2025) (SSA SORN).
LEGAL STANDARD
Section 705 of the APA authorizes “the reviewing court” to stay “the effective date of an agency action” pending judicial review “[o]n such conditions as may be required and to the extent necessary to prevent irreparable injury.” 5 U.S.C. § 705. “The factors governing issuance of a preliminary injunction” generally “also govern issuance of a § 705 stay.” District of Columbia v. U.S. Dep’t of Agric., 444 F. Supp. 3d 1, 15 (D.D.C. 2020) (collecting cases). A movant must show (1) that he is likely to succeed on the merits, (2) that he is likely to suffer irreparable harm without a stay, (3) that the balance of equities tips in his favor, and (4) that a stay is in the public interest. Ohio v. Env’t Prot. Agency, 603 U.S. 279, 291 (2024). But a stay cannot be granted if not “necessary to prevent irreparable injury.” 5 U.S.C. § 705. “[I]f a party fails to make a sufficient showing of irreparable injury, the court may deny the motion . . . without considering the other factors.” Affinity Healthcare Servs., Inc. v. Sebelius, 720 F. Supp. 2d 12, 15–16, 15 n.4 (D.D.C. 2010) (citing CityFed Fin. Corp. v. Off. of Thrift Supervision, 58 F.3d 738, 747 (D.C. Cir. 1995)).
11
DISCUSSION
To obtain an APA stay, the Plaintiffs bear the burden of demonstrating irreparable injury or harm absent that preliminary relief. Affinity Healthcare Servs., 720 F. Supp. 2d at 16 (citing Mazurek v. Armstrong, 520 U.S. 968, 972 (1997)). And the Court may not grant preliminary relief without “a clear showing” that such relief is needed. Id. (emphasis in original). The Plaintiffs request a stay to address the following injuries: (a) notice and comment injuries, (b) voter injuries, (c) informational injuries, and (d) privacy injuries. PI Mot 34–43. Because they fail to show that “they will suffer irreparable harm absent immediate injunctive relief” for any of these injuries, the Court denies their request for a stay under the APA. Affinity Healthcare Servs., 720 F. Supp. 2d at 16. Based on this record, the Plaintiffs’ injuries are not of such a nature that they cannot be redressed by final relief at the conclusion of this case. See Am. Fed’n of Lab. v. Dep’t of Lab., No. 25-cv-339, 2025 WL 1783899, at *14 (D.D.C. June 27, 2025).6 A. Notice and Comment Injuries Both the Organizational and Individual Plaintiffs allege procedural harms from their inability to participate in the Privacy Act’s notice and comment proceedings for the recent changes to SAVE. PI Mot. 42. The Plaintiffs recognize that a “procedural injury” such as being denied notice and comment “alone is insufficient to support a finding of irreparable harm.” Id. (quoting Maryland v. Corp. for Nat’l & Cmty. Serv., 785 F. Supp. 3d 68, 115 (D. Md. 2025)); see also E. Band of Cherokee Indians v. U.S. Dep’t of the Interior, No. 20-cv-757, 2020 WL 2079443, at *4
6 Although the Government argues that the Plaintiffs lack standing to proceed, it agrees that the Court may leave that question for another day. Mot. Hr’g Tr. 59:5–17; Univ. of California Student Ass’n v. Carter, 766 F. Supp. 3d 114, 121 n.3 (D.D.C. 2025) (noting that where the defendant has not moved to dismiss and the court is denying preliminary relief, it need not consider whether the plaintiffs have carried their burden of demonstrating that they likely have standing when the record does not suggest such a showing is entirely implausible).
12
(D.D.C. Apr. 30, 2020) (collecting cases). But they argue that this case falls into a narrow exception to that rule where a “[p]laintiff has been deprived of notice and the opportunity to have their comments considered prior to” an agency action “which threatens serious harms to their interests.” Maryland, 785 F. Supp. 3d at 115 (cleaned up) (emphasis added); PI Mot. 42 (collecting cases). The Court disagrees.
For challenges to proposed agency actions, it is true that “later remedial action” may not cure a notice and comment injury because the agency “is far less likely to be receptive to comments” once an impending agency action has been put into effect. N. Mariana Islands v. United States, 686 F. Supp. 2d 7, 18 (D.D.C. 2009). But central to that reasoning is that the challenge must be brought before the complained-of action. Id. Here, the challenged action—the overhaul of the SAVE database—has already occurred. PI Mot. 2 (alleging that the overhaul occurred between April and August 2025). And the Plaintiffs identify no future changes to SAVE in support of the request for an APA stay. So notice and comment now or at the conclusion of the litigation has the same result—the “submission of views after the effective date” of the agency action. N. Mariana Islands, 686 F. Supp. 2d at 18 (quoting Am. Fed’n of Gov’t Emps. v. Block, 655 F.2d 1153, 1158 (D.C. Cir. 1981)). The fact that “corrective relief will be available at a later date, in the ordinary course of litigation, weighs heavily against a claim of irreparable harm.” Clevinger v. Advoc. Holdings, Inc., 134 F.4th 1230, 1234 (D.C. Cir. 2025) (citation omitted).
In arguing otherwise, the Plaintiffs rely heavily on Maryland v. Corp. for Nat’l & Cmty.
Serv., 785 F. Supp. 3d 68 (D. Md. 2025). Mot. Hr’g Tr. 48:10–12. But that case held only that the failure to provide notice and comment can constitute irreparable harm if the ensuing agency action causes another detrimental injury that “without an injunction . . . cannot be adequately remedied by a final judgment.” Maryland, 785 F. Supp. 3d at 117. Accordingly, the Plaintiffs cannot
13
demonstrate irreparable harm from prior agency action by pointing to a notice and comment injury alone. Rather, the Plaintiffs must demonstrate another basis for injury. See id.
B. Voter Injuries The Individual Plaintiffs and members of the Organizational Plaintiffs next allege irreparable injury from the possibility of being “erroneously disenfranchised,” “fac[ing] additional obstacles to voting,” or being “subjected to unwarranted criminal investigation” due to the SAVE overhaul. PI Mot. 35. The Court takes seriously the allegations that the challenged agency actions might restrict fundamental voting rights. But the mere “‘possibility of irreparable harm’ is not sufficient” to justify preliminary relief. Indiana v. Haaland, No. 24-cv-1665, 2024 WL 5213401, at *9 (D.D.C. Dec. 24, 2024) (quoting Winter v. Nat. Res. Def. Council, Inc., 555 U.S. 7, 22 (2008)). Rather, “the party seeking [] relief must show that the injury complained of is of such imminence that there is a clear and present need for equitable relief.” Wisconsin Gas Co. v. FERC, 758 F.2d 669, 674 (D.C. Cir. 1985) (cleaned up). Such a showing “is what justifies the extraordinary remedy of granting relief before the parties have had the opportunity fully to develop the evidence and fully to present their respective cases.” Indiana, 2024 WL 5213401, at *4 (cleaned up).
Here, the Plaintiffs have not shown that the likelihood of their purported injuries is “both certain and great.” Wisconsin Gas, 758 F.2d at 674. In a nutshell, the Plaintiffs ask this Court to find irreparable injury because their SSA records are likely inaccurate, which might lead DHS to return an incorrect “non-citizen” response to a request from their home state, which might then cause the state to terminate their voter registration or take other adverse actions. This falls well short of the requisite showing of irreparable harm. See Indiana, 2024 WL 5213401, at *10. Indeed,
14
it is telling that the Plaintiffs have not identified a single individual who has experienced this hypothetical injury. Mot. Hr’g Tr. 39:4–8.
To start, the Individual Plaintiffs allege that their data in certain SSA records is likely inaccurate because they are naturalized citizens. See Doe 1 Decl. ¶14, ECF No. 16-2; Suppl. Doe 4 Decl. ¶14, ECF No. 16-3; Doe 5 Decl. ¶13, ECF No. 16-4. And the Organizational Plaintiffs suggest that the inaccuracies in SSA data may be widespread. PI Mot. 16–17. But even assuming the truth of these allegations, the Plaintiffs do not allege that SAVE generates “non-citizen” responses based on SSA data alone. PI Mot. 37– 38. See also 2025 SORN, at 48950.
To the contrary, it is undisputed that the SAVE system also queries records maintained by DHS and other federal agencies (e.g., the State Department). Mot. Hr’g Tr. at 12:6–9; 2020 SORN, at 31802; 2025 SORN, at 48953. And the Government asserts that the inclusion of these additional data sources mitigates the Plaintiffs’ concerns about erroneous SSA data. Mot. Hr’g Tr. at 63:1-5, 63:12– 25, 64:1–5. To this end, the Government represented at oral argument that if a state SAVE query yields a “non-citizen” response from SSA records and there are no additional data sources in SAVE to verify the individual’s citizenship, DHS does not return a “non-citizen” response to the state. Mot. Hr’g Tr. at 64:17– 20. Rather, DHS returns a request for additional verification information from the state to facilitate a DHS-led manual verification process. Mot. Hr’g Tr. at 62:22– 25, 63:1– 5, 64:17– 20; see also 2020 SORN., at 31799; 2025 SORN, at 48950. In other words, a “non-citizen” response from SSA, on its own, does not trigger a “non-citizen” response to a state or other SAVE user.
The Plaintiffs complain that this process does not eliminate possible injury because states rarely engage in the additional verification procedure. PI Mot. 38 n.79 (citing U.S. Gov’t Accountability Off., GAO-17-204, Immigration Status Verification for Benefits: Actions Needed
15
to Improve Effectiveness and Oversight 17 (2017), https://perma.cc/CD6Y-48QV). Even assuming this is true, nothing in the current record supports the Plaintiffs’ assertion that in lieu of additional verification, a state would remove individuals from voter rolls, deny registration, or pursue criminal investigation based on an inconclusive SAVE response alone. PI Mot. 37–39; Pls.’ Supp. Mem. 3–9. Absent support for that proposition, the claimed irreparable injury is merely speculative. See Indiana, 2024 WL 5213401, at *10.
Finally, the Plaintiffs provide additional evidence to support irreparable harm with respect to the State of Texas. They include a declaration stating that for at least one county in the state, twenty-five percent of the registered voters identified as ineligible using SAVE were previously verified by Texas as citizens. Davis Decl. ¶ 9, ECF No. 47-1. Although the Court is troubled by this result, the Plaintiffs have not shown that these errors occurred because of the challenged overhaul of the SAVE system. In fact, it is not even clear whether the errors occurred because the SAVE responses were inaccurate or because the initial state citizenship verification was flawed. After all, the very purpose of SAVE is to confirm the accuracy of the existing records of a state or local government. 2020 SORN, at 31800; 2025 SORN, at 48952.
Again, the Plaintiffs cannot point to even one naturalized citizen whose voter registration was negatively impacted by inaccuracies in the SAVE system. Mot. Hr’g Tr. 39:4–8. So there is simply not enough for the Court to conclude on the current record that John Doe 1 (the sole Texas Individual Plaintiff) or any organizational members face irreparable voter injuries so “imminent that there is a clear and present need for equitable relief.” League of Women Voters of United States v. Newby, 838 F.3d 1, 8 (D.C. Cir. 2016) (cleaned up).
16
C. Informational Injuries The Plaintiffs next argue that they suffer informational injuries because DHS and SSA failed to publish a SORN before overhauling the SAVE system. PI Mot. 41. But DHS and SSA have since published SORNs in the Federal Register outlining the challenged changes. See 2025 SORN; SSA SORN. So the Plaintiffs have not shown an “ongoing” and “time sensitive” informational injury requiring immediate relief. Citizens for Resp. & Ethics in Wash. v. Off. of Mgmt. & Budget, 791 F. Supp. 3d 29, 58 (D.D.C. 2025); Drs. for Am. v. Off. of Pers. Mgmt., 766 F. Supp. 3d 39, 54 (D.D.C. 2025).
D. Privacy Injuries Finally, the Plaintiffs argue that preliminary relief is needed to prevent privacy injuries from unauthorized disclosure or a potential data breach of their or their members’ personal information. PI Mot. 40.
1. Disclosure
“[W]hether disclosure of private information amounts to irreparable harm requires looking at (1) the type of information disclosed and (2) the breadth of disclosure and use of the information disclosed.” Am. Fed’n of Lab., 2025 WL 1783899, at *11. First, although social security data is the type of “sensitive” data where wrongful disclosure could cause irreparable harm, id., the information provided to states or local governments is limited. Mot. Hr’g Tr. 13–14. In response to a SAVE query, DHS only verifies an individual’s citizenship or immigration status; no other personal information is provided. Mot. Hr’g Tr. 13:7–8. And the type of SSA information disclosed to DHS is not yet known.
But even assuming the Plaintiffs can satisfy the first step, the breadth and use of disclosure does not justify preliminary relief in this case. “[T]he individual interest in protecting the privacy
17
of the information sought by the government is significantly less important where the information is collected by the government but not disseminated publicly.” Am. Fed’n of Gov’t Emps. v. Dep't of Hous. & Urb. Dev., 118 F.3d 786, 793 (D.C. Cir. 1997). For this reason, courts are hesitant to find irreparable harm “if the disclosure is within the government but not beyond it.” Am. Fed’n of Lab., 2025 WL 1783899, at *12. In this case, the Plaintiffs largely challenge disclosure of SSA information to DHS and to state and local government agencies using the SAVE system. See PI Mot. 39. But the Plaintiffs have not suggested that SAVE responses will be released to the public. Cf. Mot. Hr’g Tr. 14:1–20. The Government has represented that there are limits on how SAVE information may be used pursuant to various memorandums of agreement. Mot. Hr’g Tr. at 15:11– 25; 16:1–10. And inter-governmental disclosure is not alone enough for a Court to infer “imminent[] misuse or further disclos[ure]” justifying preliminary relief. Am. Fed’n of Lab, 2025 WL 1783899, at *13.
2. Data Breach
The Plaintiffs next argue that the SAVE overhaul substantially increased the risk of an unauthorized data breach of their personal information. PI Mot. 40. In support, they point to a SSA whistleblower report suggesting an increased risk of data breaches due to modifications to SSA databases containing social security numbers and other records. PI Mot. 40 (citing Min. Staff of S. Comm. on Homeland Sec. & Gov’t Aff., Unchecked and Unaccountable: How DOGE Jeopardizes Americans’ Data Without Regard for Law and Congress 2–3 (Sept. 2025), https://perma.cc/8ZMD-94T6 (Minority Report)). But that report focused on DOGE’s purported creation of a cloud-based database of SSA’s records. Minority Report at 2. Here, the Plaintiffs do not explain how their requested relief—denying SAVE access to such a database—would mitigate the risk of a data breach. Even if the Court ordered the Government to undo the recent SAVE
18
modifications, the risk that SSA’s separate “cloud environment” may be breached would remain unchanged. Id. Thus, the Plaintiffs fail to show how their requested stay would prevent “irreparable” privacy injuries. 5 U.S.C. § 705.
* * *
In this Circuit, courts must deny preliminary relief where a movant fails to show any irreparable injury “even if the other three factors entering the calculus merit such relief.” Chaplaincy of Full Gospel Churches v. England, 454 F.3d 290, 297 (D.C. Cir. 2006). To grant a stay under the APA, preventing “irreparable injury” is a statutory requirement. 5 U.S.C. § 705. Since the Plaintiffs are unlikely to suffer immediate irreparable harm before a final decision, the Court denies their request for a stay without addressing the other factors. See Affinity Healthcare Servs., 720 F. Supp. 2d at 15–16, 15 n.4. Given the rapid ongoing developments and serious issues at stake, the Court intends to move expeditiously to resolve the merits of this dispute. The Court thus orders the Parties to propose next steps in a joint notice by November 21, 2025, including an expedited summary judgment briefing schedule if necessary.
CONCLUSION
For the foregoing reasons, the Court denies the motion for a stay, ECF No. 16. A separate order will issue.
SPARKLE L. SOOKNANAN
United States District Judge
Date: November 17, 2025