League of Women Voters v. U.S. Department of Homeland Security

Opinion

UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLUMBIA

LEAGUE OF WOMEN VOTERS, et al.,

Plaintiffs,

Civil Action No. 25 - 3501 (SLS)

v.

Judge Sparkle L. Sooknanan U.S. DEPARTMENT OF HOMELAND SECURITY, et al.,

Defendants.

MEMORANDUM OPINION

This case implicates two fundamental rights that protect Americans from government overreach: the right to privacy and the right to vote. In the past year, several federal agencies have joined forces to create a centralized federal database that contains the private information of United States citizens, including Social Security numbers, citizenship status, and other sensitive data. But decades ago, Congress put protections in place to prevent precisely this type of centralized data bank. And the record in this case shows that the federal agencies that created this database knew that the database violates those statutory protections. The agencies were scrambling to comply with an Executive Order aimed at reshaping federal elections, which directed them to create a system for mass voter verification. So they haphazardly combined and repurposed the private information of millions of Americans, including citizenship data that they knew to be unreliable. Since then, states have partnered with the federal government to access the database and are actively removing United States citizens from voter rolls based on inaccurate information. All in all, the federal government has knowingly trampled on the privacy rights of American citizens in a manner that threatens the sacred right to vote. This Court cannot stand idly by while that happens.

Last March, President Donald J. Trump signed a sweeping Executive Order directing actions related to the administration of elections. Exec. Order No. 14248 of March 25, 2025, Preserving and Protecting the Integrity of American Elections, 90 Fed. Reg. 14,005 (Mar. 28, 2025) (DHS AR 334–39). Several lawsuits followed, and courts across the country have since enjoined various aspects of that Executive Order. As relevant here, the Executive Order instructed certain federal agencies, including the Department of Homeland Security (DHS) and the Social Security Administration (SSA), to put systems in place for state and local authorities to verify the citizenship or immigration status of registered voters or individuals registering to vote. The Executive Order triggered an overhaul of a system maintained by DHS to verify citizenship and immigration status—the Systematic Alien Verification for Entitlements (SAVE) system. The 2025 SAVE overhaul modified the system in three major ways: (1) to include the records of natural- born citizens, (2) to access SSA records, including Social Security numbers, and (3) to permit bulk searches of records by SAVE users.

The League of Women Voters, its local affiliates, and the Electronic Privacy Information Center sued DHS, SSA, and other federal governmental actors (collectively, the Federal Defendants) to challenge the overhaul of SAVE, including the establishment of the modified system and two related notices published by DHS and SSA. They allege that the modifications transformed the system’s functionality, increased the scope of covered individuals, made SAVE less accurate, violated statutory procedures, and were contrary to law. The Plaintiffs originally moved for an Administrative Procedure Act (APA) stay, which this Court denied for failure to show irreparable harm. Since then, states have run their voter rolls through the modified SAVE system, and some of the Plaintiffs’ members have been wrongfully identified as non-citizens by

3

SAVE, resulting in the cancellation of their voter registrations. Meanwhile, the Court permitted the State of Texas to intervene as a Defendant in this action.

The Plaintiffs now move for summary judgment. The Court agrees that the establishment of the SAVE modified system and the notices that followed are unlawful in several respects. First, they violate a prohibition in the Social Security Act against the disclosure of Social Security numbers and other related SSA records. Second, they violate both substantive and procedural protections in the Privacy Act, which prevent the non-consensual disclosure of certain information (both by federal agencies and between federal agencies) and require notice and comment for certain actions relevant here. Third, they violate the APA. The Court therefore sets aside and vacates the 2025 SAVE modified system and the related notices because they were contrary to law, arbitrary and capricious, in excess of statutory authority, and without observance of procedure required by law.

BACKGROUND

A. Social Security Act The Social Security Act of 1935 creates financial assistance benefit programs for certain Americans. Pub. L. No. 74–271, 49 Stat. 620 (codified at 42 U.S.C. § 301 et seq.). Soon after its enactment, the Social Security Board established the Social Security number (SSN) as an identifier for “U.S. workers, enabling employers to submit accurate reports of covered earnings for use in administering benefits under the new Social Security program.” Carolyn Puckett, The Story of the Social Security Number, Soc. Sec. Bull., Vol. 69, No. 2 (July 2009), https://www.ssa.gov /policy/docs/ssb/v69n2/v69n2p55.html [https://perma.cc/ H96G-835X]. This “is still the primary purpose for the SSN.” Id.

Privacy was central to the newly formed regulatory scheme. In 1937, the Social Security Board enacted its very first regulation, which “governed privacy and disclosure of Social Security

4

records.” Social Security History: Regulation No. 1, SSA, https://www.ssa.gov /history/reg1.html [https://perma.cc/NGU4-FPM6]. That regulation prohibited any “member, officer, or employee of the Board” from producing or disclosing “any record . . . or any information acquired therefrom . . . pertaining to any person.” Disclosure of Official Records & Information, 2 Fed. Reg. 1,256, 1,256 (June 18, 1937). In 1939, Congress codified the language of that regulation into the Social Security Act, prohibiting the disclosure of “any file, record, report, or other paper, or any information” obtained by the Board except as the agency’s regulations prescribe. Social Security Act Amendments of 1939, Pub. L. No. 76–379, title VIII, § 1106, 53 Stat. 1360, 1398 (codified as amended at 42 U.S.C. § 1306(a)). Today, the Social Security Act expressly prohibits federal employees from disclosing the “[s]ocial security account numbers and related records . . . obtained or maintained . . . pursuant to any provision of law enacted on or after October 1, 1990.” 42 U.S.C. § 405(c)(2)(C)(viii)(I).

B. Privacy Act The Privacy Act of 1974 establishes “certain safeguards for an individual against an invasion of personal privacy by requiring Federal agencies” to “collect, maintain, use, or disseminate any record of identifiable personal information in a manner that assures that such action is for a necessary and lawful purpose.” Pub. L. No. 93–579, § 2(b)(4), 88 Stat. 1896, 1896 (codified at 5 U.S.C. § 552a note). The Act “was passed largely out of concern over ‘the impact of computer data banks on individual privacy.’” U.S. DOJ v. Reps. Comm. for Freedom of the Press, 489 U.S. 749, 766 (1989) (quoting H.R. Rep. No. 93–1416, at 7 (1974)).

1. Statutory Background The Privacy Act’s animating concern is that “the increasing use of computers and sophisticated information technology, while essential to the efficient operations of the

5

Government, has greatly magnified the harm to individual privacy that can occur from any collection, maintenance, use, or dissemination of personal information.” Privacy Act of 1974 § 2(a)(2), 88 Stat. at 1896 (codified at 5 U.S.C. § 552a note). Indeed, the Act was precipitated by proposals in the 1960s for a computerized “data center” maintained by the Executive Branch that would bring “the data collected by various agencies into a single consistent body” and “identify individual respondents in some way, [likely] by social security number.” Computer Privacy: Hearings Before the Subcomm. on Admin. Prac. and Proc. of the S. Comm. on the Judiciary, 90th Cong. 4–5 (1967) (statement of Carl Kaysen, Dir., Inst. for Advanced Study, Princeton Univ.). Rather than garner support, these proposals “immediately caused a public outcry,” necessitating a congressional response. Dongsheng Zang, The Privacy Act of 1974: The American Bill of Rights on Data and Its Unfinished Business, 86 U. Pitt. L. Rev. 85, 100 (2024) (detailing the legislative background of the Privacy Act of 1974).

Congress reacted by holding high-profile hearings on “The Computer and Invasion of Privacy” and “Federal Data Banks,” where extensive criticism ensured that “the National Data Center [idea was] probably dead.” Id. at 114–121 (citations omitted); see also Sampson v. Murray, 415 U.S. 61, 96 n.2 (1974) (Douglas, J., dissenting) (recognizing that the hearings reflected a “congressional concern” that “we live in an Orwellian age in which the computer has become ‘the heart of a [national] surveillance system’” (quoting Arthur R. Miller, Computers, Data Banks and Individual Privacy: An Overview, 4 Colo. Human Rights L. Rev. 1, 2 (1972))). At the time, it became evident that there was a grave “threat to privacy implicit in the accumulation of vast amounts of personal information in computerized data banks or other massive government files,” and that “[t]he right to collect and use such data for public purposes is typically accompanied by a

6

concomitant statutory or regulatory duty to avoid unwarranted disclosures.” Whalen v. Roe, 429 U.S. 589, 605 (1977).

Congress enacted the Privacy Act to address this “growing awareness that governmental agencies were accumulating an ever-expanding stockpile of information about private individuals that was readily susceptible to . . . inaccuracies that the citizen would never know of, let alone have an opportunity to rebut or correct.” Londrigan v. FBI, 670 F.2d 1164, 1169 (D.C. Cir. 1981). It responded with a detailed statutory scheme to prevent “the creation of secret information systems or data banks” by the federal government that would result in “the wrongful disclosure and use, in some cases, of [such] personal files held by Federal agencies.” Id. (quoting S. Rep. No. 1183, at 1, 2 (1974)). Thus, the Privacy Act “was designed to provide individuals with more control over the gathering, dissemination, and accuracy of agency information about themselves,” Greentree v. U.S. Customs Serv., 674 F.2d 74, 76 (D.C. Cir. 1982) (emphasis omitted), and to “establish safeguards to protect individuals against the disclosure of confidential records ‘which could result in substantial harm, embarrassment, inconvenience, or unfairness to any individual on whom information is maintained,’” FAA v. Cooper, 566 U.S. 284, 294–95 (2012) (quoting 5 U.S.C. § 552a(e)(10)).

The statute’s provisions work together “to prevent the creation of formal or de facto national data banks,” “centralized Federal information systems[,]” or “interagency computer data banks”—by making it “legally impossible for the Federal Government in the future to put together anything resembling a ‘1984’ personal dossier on a citizen, and [ensuring] proper regard for individual privacy, the confidentiality of data, and the security of [any] system” of records maintained by the federal government. See United States v. Weber, 816 F. Supp. 3d 1168, 1194 (C.D. Cal. 2026) (cleaned up) (quoting S. Comm. on Gov’t Operations & H.R. Comm. On Gov’t

7

Operations, 94th Cong., Source Book on Privacy 168, 217, 884 (Joint Comm. Print 1976)). The Act accomplishes its goal through both substantive and procedural “safeguards . . . against an invasion of personal privacy.” Cooper, 566 U.S. at 294–95 (quoting Privacy Act of 1974 § 2(b), 88 Stat. at 1896).

2. Substantive Safeguards The Privacy Act’s substantive safeguards provide robust protections related to significant governmental use and retention of identifiable personal information. See 5 U.S.C. § 552a. For instance, the statute instructs federal agencies to “collect information to the greatest extent practicable directly from the subject individual” when use of the information can adversely affect the individual’s rights. Id. § 552a(e)(2). It requires agencies to maintain records “with such accuracy, relevance, timeliness, and completeness as is reasonably necessary to assure fairness to the individual.” Id. § 552a(e)(5). And it provides various mechanisms to give individuals notice of what records are maintained by the federal government as well as to correct any inaccuracies in those records. Id. § 552a(d)–(g). Importantly, the Act prohibits both inter-agency and extra-agency disclosure of government records except in limited circumstances. Id. § 552a(b). One such circumstance is a “routine use,” which is defined as “the use of such record for a purpose which is compatible with the purpose for which it was collected.” Id. § 552a(a)(7), (b)(3).

The statute also has special provisions governing the use of Social Security numbers. The Act provides that “[i]t shall be unlawful for any Federal, State or local government agency to deny to any individual any right, benefit, or privilege provided by law because of such individual’s refusal to disclose his social security account number.” Privacy Act of 1974 § 7(a)(1), 88 Stat. at 1909 (codified at 5 U.S.C. § 552a note). The Act further requires that “[a]ny Federal, State, or local government agency which requests an individual to disclose his social security account

8

number shall inform that individual whether that disclosure is mandatory or voluntary, by what statutory or other authority such number is solicited, and what uses will be made of it.” Id. § 7(b), 88 Stat. at 1909.

In 1988, Congress amended the Privacy Act with the Computer Matching and Privacy Protection Act of 1988. Pub. L. No. 100–503, 102 Stat. 2507 (codified at 5 U.S.C. § 552a note). That statute prohibits federal agencies from disclosing records to other federal agencies, state governments, or local governments through a “computer matching program” without a written agreement. 5 U.S.C. § 552a(o)(1). The Act establishes various statutory procedures and requirements governing such agreements. Id. § 552a(o). And it prohibits state or local governments from duplicating or disclosing federal records received pursuant to such an agreement “except where required by law or essential to the conduct of the matching program.” Id. § 552a(o)(1)(H). That same prohibition applies to federal agencies with respect to records provided by “any State or local government, or agency thereof, which discloses records to be used in a matching program.” Id. § 552a(a)(11), (o)(1)(H).

Congress further provided that nothing in the 1988 Act “shall be construed to authorize (1) the establishment or maintenance by any agency of a national data bank that combines, merges, or links information on individuals maintained in systems of records by other Federal agencies; (2) the direct linking of computerized systems of records maintained by Federal agencies”; or “(3) the computer matching of records not otherwise authorized by law.” Computer Matching and Privacy Protection Act of 1988 § 9, 102 Stat. at 2514.

3. Procedural Safeguards The Privacy Act also prescribes procedural safeguards that apply when records maintained by a federal agency—a so-called “system of records”—are changed or used in a new way. 5 U.S.C.

9

§ 552a(a)(5), (e). Congress enacted these safeguards to “permit an individual to determine what records pertaining to him are collected, maintained, used, or disseminated by [federal] agencies” and to ensure “adequate safeguards are provided to prevent misuse of such information.” Privacy Act of 1974 § 2(b)(1), (4), 88 Stat. at 1896.

In relevant part, the statute establishes strict notice and comment requirements in these circumstances. 5 U.S.C. § 552a(e)(4), (11). When an agency “establish[es] or revis[es]” any “system of records,” it must “publish in the Federal Register . . . a notice of the existence and character of the system of records,” i.e., a System of Records Notice (SORN). Id. § 552a(e)(4). Each SORN “shall include” nine categories of information:

(A) the name and location of the system;

(B) the categories of individuals on whom records are maintained in the system;

(C) the categories of records maintained in the system;

(D) each routine use of the records contained in the system, including the categories of users and the purpose of such use;

(E) the policies and practices of the agency regarding storage, retrievability, access controls, retention, and disposal of the records;

(F) the title and business address of the agency official who is responsible for the system of records;

(G) the agency procedures whereby an individual can be notified at his request if the system of records contains a record pertaining to him;

(H) the agency procedures whereby an individual can be notified at his request how he can gain access to any record pertaining to him contained in the system of records, and how he can contest its content; and (I) the categories of sources of records in the system.

Id. To publish a statutorily compliant SORN, a federal agency must provide at least thirty days prior “notice of any new use or intended use of the information in the system, and provide an opportunity for interested persons to submit written data, views, or arguments to the agency.” Id. § 552a(e)(11). And the agency must provide notice to Congress as well. Id. § 552a(r).

10

C. Factual Background 1. SAVE System of Records SAVE is a system administered by DHS that is “designed to help federal, state, tribal, and local government agencies confirm citizenship and immigration status prior to granting benefits and licenses, as well as for other lawful purposes.” DHS AR 195. SAVE users “formalize the purpose and use in which they use SAVE through a Memorandum of Agreement (MOA) or Computer Matching Agreement (CMA)” establishing “the terms and conditions for the user agency’s participation in SAVE.” DHS AR 195–96. One purpose for which states can enter into such an agreement is to verify the citizenship of registered voters. Notice of a Modified System of Records, 90 Fed. Reg. 48,948, 48,951 (Oct. 31, 2025) (DHS AR 117) (DHS 2025 SORN). Prior to May 2025, SAVE users could access the immigration status of individuals with information stored in the SAVE system, and SAVE’s response was based on the limited records maintained by DHS, the State Department, and the Justice Department. See Notice of Modified System of Records, 85 Fed. Reg. 31,798, 31,802 (May 27, 2025) (DHS AR 112) (2020 SORN). Also prior to May 2025, DHS recognized SAVE as a system of records subject to the Privacy Act—which means that DHS appeared to comply with the statute’s notice-and-comment requirements and issued SORNs for changes to SAVE.1

1 See Notice of Modified System of Records, 85 Fed. Reg. 31,798, 31,798 (May 27, 2020) (DHS AR 108); DHS USCIS–004 SAVE Program System of Records, 81 Fed. Reg. 78,619, 78,619 (Nov. 8, 2016); DHS USCIS—004—SAVE Program System of Records, 77 Fed. Reg. 47,415, 47,415 (Aug. 8, 2012); USCIS–004 Verification Information System (VIS) System of Records Notice, 73 Fed. Reg. 75,445, 75,445–46 (Dec. 11, 2008); USCIS VIS System of Records Notice, 73 Fed. Reg. 10,793, 10,793 (Feb. 28, 2008); Privacy Act: VIS Records Notice, 72 Fed. Reg. 17,569, 17,569 (Apr. 9, 2007); Privacy Act of 1974 System of Records, 67 Fed. Reg. 64,134, 64,134 (Oct. 17, 2002); Privacy Act of 1974 System of Records, 66 Fed. Reg. 46,812, 46,812 (Sep. 7, 2001).

11

2. Establishment of the Modified SAVE On March 25, 2025, President Trump signed a sweeping Executive Order directing federal agencies to take various actions related to the administration of federal elections. Exec. Order No. 14248, 90 Fed. Reg. at 14,006–09 (DHS AR 335–38). The Executive Order instructs that for the purpose of “identify[ing] unqualified voters registered in the States,” “the Secretary of Homeland Security shall, consistent with applicable law, ensure that State and local officials have, without the requirement of the payment of a fee, access to appropriate systems for verifying the citizenship or immigration status of individuals registering to vote or who are already registered.” Id. at 14,006 (DHS AR 335). The Executive Order further requires DHS to “share database information with States upon request” under 8 U.S.C. § 1373(c) for voter list maintenance, and it directs DHS, in coordination with the Department of Government Efficiency, to compare voter records with “Federal immigration databases.” Id. at 14,005–06 (DHS AR 334–35). And the Executive Order specifically directs SSA to make its databases available “to all State and local election officials” for verifying voter eligibility. Id. at 14,007 (DHS AR 336).

The Executive Order prompted a flurry of action by the Federal Defendants charged with its implementation. SSA AR 1–2; DHS AR 39–68. On May 15, 2025, DHS and SSA executed a letter agreement to overhaul the SAVE system, which authorized “information sharing” between DHS and SSA “by matching data submitted through SAVE to SSA records in SSA’s Master Files of Social Security Number (SSN) Holders and SSN Applications.” DHS AR 423 (citation omitted); SSA AR 9 (citation omitted). The “SSA Master Files” (or NUMIDENT)—which would be linked to SAVE under the new information sharing agreement—contains SSNs, names, dates and places of birth, citizenship indicators, death records, and information obtained while processing requests for SSNs. SSA AR 170–71; DHS AR 253. On May 22, 2025, the Federal

12

Defendants publicly launched the expanded SAVE system. DHS AR 493; DHS AR 1385. But no agency published a SORN or otherwise provided an opportunity for the public to comment on the modifications prior to publication. Mot. Hr’g Tr. 71:15–22, ECF No. 48. At that juncture, the operative SORN for SAVE was published on May 27, 2020. Notice of Modified System of Records, 85 Fed. at 31,798 (DHS AR 108).

3. Present Litigation and Promulgation of New SORNs In September 2025, the Plaintiffs filed this action challenging the modified SAVE as unlawful, see Compl., ECF No. 1, and moved for an emergency stay under Section 705 of the APA, Mot. Stay, ECF No. 16. During those emergency proceedings, the Federal Defendants would not say one way or the other whether the Privacy Act applies to modifications to SAVE—despite DHS’s prior practice of publishing SORNs for modifications to the system. Mot Hr’g Tr. 69:18– 24. But the Federal Defendants conceded that the then-recent modification to SAVE was substantial enough that the Privacy Act would require a SORN if it applied. Id. The Court ultimately denied the Plaintiffs’ emergency motion for failure to show irreparable harm. See League of Women Voters v. DHS., No. 25-cv-3501, 2025 WL 3198970, at *5 (D.D.C. Nov. 17, 2025).

The administrative record provides a window into DHS’s understanding of the SAVE “modified system.” Notice of a Modified System of Records, 90 Fed. Reg. at 48,948 (DHS AR 114). Internal “Privacy Threshold Analysis” documents from July and September 2025 show that DHS was aware that the modification of SAVE was “not in compliance” with the Privacy Act, DHS AR 277; DHS AR 319, and that “[s]hortfalls in data accuracy” in SSA citizenship data integrated into the new SAVE system “could cause incomplete or false results,” DHS AR 260; DHS AR 302. This was in part because “[t]here is no obligation for an individual to report to SSA

13

a change in their citizenship or immigration status until they request a replacement card or file a claim for a Social Security benefit.” SSA AR 103. Thus, a naturalized citizen who applied for a Social Security card or otherwise interacted with SSA prior to naturalization may be incorrectly identified as a non-citizen in SSA records. Id.

After the hearing on the Plaintiffs’ emergency motion, DHS and SSA both published SORNs (2025 SORNs) for the modifications made to their respective systems. Notice of a Modified System of Records, 90 Fed. Reg. at 48,948–55 (DHS AR 114–21); Notice of a Modified System of Records, 90 Fed. Reg. 50,879 (Nov. 12, 2025) (SSA AR 206) (SSA 2025 SORN); Fed. Defs.’ Suppl. Resp. 8, ECF No. 51; Fed. Defs.’ Notice of Publication of SORN, ECF No. 54. The 2025 SORNs outlined the “modified system” that resulted from the modification of SAVE in May 2025. Notice of a Modified System of Records, 90 Fed. Reg. at 48,949 (DHS AR 115); see also Notice of a Modified System of Records, 90 Fed. Reg. at 50,880 (SSA AR 207). The DHS 2025 SORN established a new “Routine Use L” to enable DHS to disclose records to SSA “and other federal, state, tribal, territorial, local, governments and other authorized entities to assist [SAVE] user agencies [to] determine U.S. citizenship and immigration status of an individual when a DHS approved agreement is in place between DHS and the entity.” Notice of a Modified System of Records, 90 Fed. Reg. at 48,954 (DHS AR 120). The SSA 2025 SORN added a new “Routine Use No. 49” for disclosures of “citizenship and immigration status” to DHS “pursuant to 8 U.S.C. [§] 1373(a).” Notice of a Modified System of Records, 90 Fed. Reg. at 50,883 (SSA AR 210). The 2025 SORNs solicited comments from the public—but they also provided that the modified SAVE system outlined in the 2025 SORNs would be effective immediately (i.e., before the public could submit comments). See Notice of a Modified System of Records, 90 Fed. Reg. at 48,949 (DHS AR 115); Notice of a Modified System of Records, 90 Fed. Reg. at 50,880 (SSA AR 207)

14

(recognizing immediate effect except for new routine uses which would automatically take effect after thirty days). The modified system that resulted from the Federal Defendants’ self-described “overhaul” of SAVE differed from SAVE’s prior functionality (authorized by DHS’s 2020 SORN) in three primary ways. See DHS AR 493.

First, the old SAVE did not previously have access to the records of natural-born citizens unless those individuals had some other interaction with DHS, e.g., as a sponsor of a non-citizen. See Notice of Modified System of Records, 85 Fed. Reg. at 31,801 (DHS AR 111). But the new SAVE includes records about “U.S. citizens by birth.” Notice of a Modified System of Records, 90 Fed. Reg. at 48,949–51 (DHS AR 115–17).

Second, the old SAVE only accessed records stored in DHS systems, along with certain immigration-related records systems at the State Department and the Department of Justice identified in the 2020 SAVE SORN. See Notice of Modified System of Records, 85 Fed Reg. at 31,802 (DHS AR 112). The old SAVE did not access SSA databases and SAVE users could not run initial SAVE searches using an individual’s SSN or partial SSN. Notice of Modified System of Records, 85 Fed Reg. at 31,798–99, 31,802 (DHS AR 108–09, 112). Instead, users had to provide an individual’s DHS numeric identifier (e.g., an alien registration number or A-Number). Notice of Modified System of Records, 85 Fed Reg. at 31,799 (DHS AR 09); DHS AR 248; DHS AR 399. The old SAVE only had access to Social Security numbers “in very limited circumstances” when benefits applicants submitted that number through DHS’s Form G-845, a form used to document a person’s immigration status and verify their identity. Notice of Modified System of Records, 85 Fed Reg. at 31,802 (DHS AR 111). Previously, “[i]f SAVE display[ed] an ‘Institute Additional Verification’ message,” SAVE users could require completion of the form “G-845 with the applicant’s knowledge and consent,” which could include a social security

15

number. DHS AR 192; see also DHS AR 205–06, 278. But beyond this circumstance, SAVE did not have access to social security numbers. See Notice of Modified System of Records, 85 Fed Reg. at 31,802 (DHS AR 112); DHS AR 278. Because most U.S.-born citizens do not have DHS numeric identifiers, before 2025 SAVE generally did not query the records of natural-born U.S. citizens. See DHS AR 248.

Meanwhile, the new SAVE “update[d] the categories of records in the system to include collecting both full and truncated (last four digits) Social Security number[s]” and added the SSA Master File as a “record source” for SAVE. Notice of a Modified System of Records, 90 Fed. Reg. at 48,949 (DHS AR 115). The result is that SAVE users may use the modified system to query any non-citizen, naturalized citizen, and natural-born citizen who have Social Security numbers in the SSA Master File. See DHS AR 248.

Third, the old SAVE could only conduct individual searches; SAVE users could not conduct bulk searches of more than one person’s data at a time. See DHS AR 247. But the new SAVE added “the capability to create cases in SAVE by uploading a file with a list of multiple cases” for a bulk search. Notice of a Modified System of Records, 90 Fed. Reg. at 48,951 (DHS AR 117).

4. Modified SAVE’s User Experience The SAVE “modified system” operates as follows. Id. at 48,948 (DHS AR 114). After user agencies execute an MOA or CMA with USCIS, which establish “the terms and conditions for the user agency’s participation in SAVE,” DHS AR 195–96; see also DHS AR 223; DHS AR 1344, those users may conduct bulk searches.

A SAVE user first downloads a spreadsheet and manually enters some or all the following data: first name, last name, date of birth, either a full or partial SSN, and the reason for verification

16

(e.g., voter verification). DHS AR 1443. The SAVE user can also provide voters’ DHS numeric identifiers (e.g., an A-number). DHS AR 225; DHS AR 2. The user then uploads the completed file into the SAVE interface. DHS AR 1444. Once that happens, SAVE automatically discloses the voters’ uploaded data to SSA and uses it to search the SSA Master File. See DHS AR 224–25; DHS AR 253; DHS AR 1525. SSA automatically discloses the SSA Master File search results to DHS, including the following fields:

• SSN Match (True/False);

• Full SSN for all matches (when a partial SSN is provided);

• Name Match (True/False);

• Date of Birth Match (True/False);

• Citizenship/Foreign Indicator:

o Blank – Citizenship code is blank and foreign-born indicator is blank;

o “A” – U.S. citizen;

o “B” – Legal alien, eligible to work;

o “C” – Legal alien, not eligible to work;

o “D” – Other;

o “E” – Alien student, restricted work authorized; and o “F” – Conditionally legalized alien;

• Foreign Born indicator (citizenship code is not present, but voter was foreign born);

• State/Country Code;

• American Samoa indicator (True/False);

• Alien Registration number (where applicable);

• Death indicator (Yes Deceased/Not Deceased); and • Error code descriptions (transaction and record levels).

Notice of a Modified System of Records, 90 Fed. Reg. at 48,950 (DHS AR 116); DHS AR 225–26; DHS AR 233; DHS AR 424; DHS AR 437–38.

If the search identifies a potential non-U.S. citizen and a DHS numeric identifier is available (either from the user’s initial input or SSA records), SAVE automatically queries

17

additional systems across the federal government, DHS AR 1450–58; DHS AR 1525; Notice of a Modified System of Records, 90 Fed. Reg. at 48,953–54 (DHS AR 119–20); DHS AR 227–30. After a manual review of responses, SAVE may then return a response that will either include the voter’s citizenship status—e.g., “U.S. Citizen” or “Lawful Permanent Resident”—or request additional actions by the SAVE user, including requesting the submission of additional documents. DHS AR 1525; DHS AR 1507; DHS AR 1378–79; DHS AR 1530.

If the match to SSA records is inconclusive, the SSA records confirm that a voter is a citizen or is deceased, or SAVE identifies a potential non-U.S. citizen status and no DHS numeric identifier is available, then SAVE ends the automated query, DHS AR 254–55; DHS AR 297, and generates one of the following responses:

• U.S. Citizen (per SSA Record);

• Deceased (per SSA record);

• Immigration Enumerator [i.e. DHS identifier] Required – Resubmit with Additional Information;

• Unable to Return Record from SSA – Resubmit with Additional Information;

or

• Full SSN Required – Resubmit with Additional Information.

DHS AR 1379.

If SAVE identifies a voter as a citizen, then the SAVE user need not take any further steps or gather “additional information.” See DHS AR 1507–08. If SAVE identifies the individual as anything else, then the template SAVE MOA directs the SAVE user to “contact the registrant or registered voter to obtain proof of U.S. citizenship.” DHS AR 762. And if the SAVE result is inconclusive (e.g., SAVE provides an “Immigration Enumerator Required – Resubmit with Additional Information” response), then (1) the SAVE user must provide the voter’s DHS numeric identifier (which state and local agencies likely do not possess), and/or (2) the SAVE user must

18

“contact the registrant or registered voter to obtain proof of U.S. citizenship.” See DHS AR 762; DHS AR 1526.

D. Procedural Background On January 21, 2026, after the comment period expired for the 2025 SORNs, the Plaintiffs—the League of Women Voters, League of Women Voters of Texas, League of Women Voters of Louisiana, League of Women Voters of Louisiana Education Fund, League of Women Voters of Virginia, and the Electronic Privacy Information Center (EPIC)—filed an Amended and Supplemental Complaint challenging the three major modifications to the SAVE system outlined in those SORNs. Am. Compl., ECF No. 61. On April 6, 2026, the Court permitted the State of Texas, a SAVE user, to intervene as a Defendant in this action. Order, ECF No. 86. The Plaintiffs moved for summary judgment, asking this Court to set aside and vacate the modified SAVE system and 2025 SORNs as unlawful under the APA and the Constitution. Pls.’ Mem. Supp. Summ. J. Mot., ECF No. 66-1 (Pls.’ Mot.). The Federal Defendants cross-moved for either dismissal of this action for lack of subject matter jurisdiction and failure to state a claim or for summary judgment. Fed. Defs.’ Combined Mem. Supp. Mot. Dismiss/Mot. Summ. J. and Opp’n to Pls.’ Mot. (Fed. Defs.’ Mot.), ECF No. 77-1. And the State of Texas moved to dismiss for lack of subject matter jurisdiction and failure to state a claim. Texas Mot. Dismiss (Texas Mot.), ECF No. 97. These motions are fully briefed and ripe for review. Pls.’ Combined Reply & Opp’n to Fed. Defs.’ Mot. (Pls.’ Reply), ECF Nos. 99 & 100; Pls.’ Opp’n to Texas Mot. (Pls.’ Opp’n), ECF No. 104; Texas Reply, ECF No. 105; Fed. Defs.’ Reply, ECF No. 106.2

2 The Court has received and considered amicus briefs in support of the Plaintiffs filed by Travis County, Travis County Tax Assessor-Collector Celia Israel, and Travis County Clerk Dyana Limon-Mercado; Campaign Legal Center, Center for Media and Democracy, Common Cause, and Protect Democracy Project; Texas Civil Rights Project; Lawyers Defending American

19

LEGAL STANDARD

A court “shall grant summary judgment if the movant shows that there is no genuine dispute as to any material fact and the movant is entitled to judgment as a matter of law.” Fed. R. Civ. P. 56(a). In the context of an APA challenge, summary judgment “serves as a mechanism for deciding, as a matter of law, whether the administrative record supports the agency action and whether the agency action is consistent with the APA standard of review.” Int’l Swaps & Derivatives Ass’n v. U.S. CFTC, 887 F. Supp. 2d 259, 266 (D.D.C. 2012) (citing Richards v. INS, 554 F.2d 1173, 1177 & n.28 (D.C. Cir. 1977)).

“A motion under Rule 12(b)(1) ‘presents a threshold challenge to a court’s [subject-matter]

jurisdiction.’” Ctr. for Biological Diversity v. U.S. Int’l Dev. Fin. Corp., 585 F. Supp. 3d 63, 69 (D.D.C. 2022) (quoting Ctr. for Biological Diversity v. Jackson, 815 F. Supp. 2d 85, 89 (D.D.C. 2011)). The plaintiff “bears the burden of proving by a preponderance of the evidence that the Court has subject-matter jurisdiction over her claims.” Schmidt v. U.S. Capitol Police Bd., 826 F. Supp. 2d 59, 69 (D.D.C. 2011). When evaluating a motion under Rule 12(b)(1), “the court may consider documents outside the pleadings to assure itself that it has jurisdiction.” Sandoval v. U.S. DOJ, 322 F. Supp. 3d 101, 104 (D.D.C. 2018).

Under Rule 12(b)(6), a court must dismiss a complaint that does not “contain sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.’” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)). Courts “must construe the complaint ‘in favor of the plaintiff, who must be granted the benefit of all inferences that can be derived from the facts alleged.’” Hettinga v. United States, 677 F.3d 471, 476 (D.C. Cir. 2012) (quoting Schuler v. United States, 617 F.2d 605, 608 (D.C. Cir. 1979)). But

Democracy, Inc.; Service Employees International Union; and the American Civil Liberties Union. ECF Nos. 68, 89, 91, 87, 88 & 94.

20

courts need not accept as true “a legal conclusion couched as a factual allegation,” nor an “inference[] . . . unsupported by the facts set out in the complaint.” Trudeau v. FTC, 456 F.3d 178, 193 (D.C. Cir. 2006) (first quoting Papasan v. Allain, 478 U.S. 265, 286 (1986); and then quoting Kowal v. MCI Commc’ns Corp., 16 F.3d 1271, 1276 (D.C. Cir. 1994)).

DISCUSSION

The Plaintiffs contend that the Federal Defendants have unlawfully established a modified SAVE system of records in violation of the APA and the Constitution. Specifically, they argue that the establishment of the modified SAVE and the 2025 SORNs (1) violated the APA because of substantive provisions in the Social Security Act and the Privacy Act, (2) violated certain procedural protections in the Privacy Act and are arbitrary and capricious under the APA, and (3) violated the constitutional separation of powers. The Plaintiffs seek summary judgment on their claims, asking the Court to hold unlawful, vacate, and set aside the modified SAVE system and the accompanying 2025 SORNs.

The Federal Defendants and the State of Texas (collectively, the Defendants) seek dismissal of the Plaintiffs’ claims. They first raise threshold arguments in support of dismissal— arguing that the Plaintiffs lack standing, that the challenged activity is not a final agency action, and that the Plaintiffs have an adequate remedy elsewhere. They also defend the establishment of the modified SAVE and the 2025 SORNs on the merits, asserting that they did not violate the APA or the Constitution and were otherwise authorized by immigration laws.

Having reviewed the comprehensive briefing in this case, the Court is convinced that the Plaintiffs have the better of the arguments. The Defendants’ threshold arguments are easily dispensed with. And on the merits, the Court holds that the establishment of the modified SAVE system and the 2025 SORNs are unlawful for at least three reasons. First, they violated the Social Security Act. Second, they violated both substantive and procedural protections in the Privacy Act.

21

And third, they are arbitrary and capricious in violation of the APA. Because relief is warranted on these claims alone, the Court declines to address the Plaintiffs’ remaining claims.3 A. Standing Standing leads off. Recall that the Plaintiffs are non-profit organizations. An organization may demonstrate standing by either (1) asserting associational “standing solely as the representative of its members,” or (2) identifying an organizational injury “in its own right.” Students for Fair Admissions, Inc. v. President & Fellows of Harvard Coll., 600 U.S. 181, 199 (2023) (quoting Warth v. Seldin, 422 U.S. 490, 511 (1975)). To establish associational standing, an organization must show that: “(1) at least one of its members has standing to sue in her or his own right, (2) the interests it seeks to protect are germane to its purpose, and (3) neither the claim asserted nor the relief requested requires the participation of an individual member in the lawsuit.” Institutional S’holder Servs., Inc. v. SEC, 142 F.4th 757, 764 (D.C. Cir. 2025) (quoting Wash. All. of Tech. Workers v. DHS, 50 F.4th 164, 175 (D.C. Cir. 2022)). The first two prongs are rooted in Article III of the Constitution, but the “third prong is a prudential one” focused on “matters of administrative convenience and efficiency.” United Food & Com. Workers Union Loc. 751 v. Brown Grp., Inc., 517 U.S. 544, 555–57 (1996).

Here, the Defendants do not appear to challenge the final two prongs. The League of Women Voters and their state affiliates seek to protect the voting rights of their members, which is germane to the League’s purpose to “empower voters and defend democracy, including by registering voters and increasing voter participation.” Stewart Decl. ¶¶ 2, 7, ECF No. 16-5; see also LeBombard Decl. ¶¶ 2, 5, 14, ECF No. 66-7; Suppl. Green Decl. ¶¶ 2, 6, ECF No. 66-8; Porte

3 The Court need not address the Plaintiffs’ constitutional claims; Privacy Act accuracy claims, 5 U.S.C. § 552a(e)(5), (6), (10); claims under Section 1306(a)(1) of the Social Security Act; and mandamus claims to enforce the Computer Matching and Privacy Protection Act.

22

Decl. ¶¶ 2, 3, 11, 14, ECF No. 16-6. And EPIC seeks to protect the privacy rights of its members, which is germane to its “mission . . . to secure the fundamental right to privacy in the digital age.” Butler Decl. ¶ 3, ECF No. 66-10. Furthermore, individual member participation is not necessary where an organization seeks APA vacatur on behalf of its members. See Powder River Basin Res. Council v. U.S. Dep’t of Interior, 749 F. Supp. 3d 151, 162 (D.D.C. 2024); Sierra Club v. Perry, 373 F. Supp. 3d 128, 135 (D.D.C. 2019).

Standing thus turns on whether “at least one of [the Plaintiffs’] members has standing to sue in her or his own right.” Institutional S’holder Servs., 142 F.4th at 764 (quoting Wash. All. of Tech. Workers, 50 F.4th at 175). “To establish Article III standing, a plaintiff must show (1) injury in fact that is concrete and particularized and actual or imminent rather than conjectural or hypothetical, (2) causation fairly traceable to the defendant’s challenged action and (3) redressability by a favorable decision that is likely as opposed to merely speculative.” Am. Whitewater v. FERC, 125 F.4th 1139, 1150 (D.C. Cir. 2025) (citing Lujan v. Defs. of Wildlife, 504 U.S. 555, 560–61 (1992)). The “plaintiff[] must demonstrate standing for each claim that they press and for each form of relief that they seek.” TransUnion LLC v. Ramirez, 594 U.S. 413, 431 (2021). And where an action involves only non-monetary relief, “[o]nly one plaintiff . . . needs standing in order for a particular claim to go forward. . . . That is, if constitutional standing ‘can be shown for at least one plaintiff, [the Court] need not consider the standing of the other plaintiffs to raise that claim.’” Whitman-Walker Clinic v. U.S. HHS, 485 F. Supp. 3d 1, 18 (D.D.C. 2020) (quoting Carpenters Indus. Council v. Zinke, 854 F.3d 1, 9 (D.C. Cir. 2017)).

Here, the Court concludes that the League of Women Voters and the League of Women Voters of Texas have standing to proceed. See Nel Decl., ECF No. 66-3; A. Doe Decl., ECF

23

No. 66-4; B. Doe Decl., ECF No. 66-5; J. Doe 4 Suppl. Decl., ECF No. 16-3.4 Their members suffered three types of injuries: privacy or reputational injuries, voter injuries, and procedural injuries. Pls.’ Mot. 13.5 The Court addresses each in turn.

1. Privacy or Reputational Injuries The Plaintiffs first argue that the disclosure of their members’ personal information in violation of the Social Security Act and the Privacy Act has caused privacy or reputational injuries that are sufficiently concrete to confer Article III standing. See id. The Court agrees.

“[F]or Article III purposes, an injury is ‘concrete’ if it is similar to a type of harm cognizable at common law.” Pileggi v. Washington Newspaper Publ’g Co., 146 F.4th 1219, 1226 (D.C. Cir. 2025) (quoting TransUnion, 594 U.S. at 424). Of course, “Article III does not require ‘an exact duplicate in American [common-law] history and tradition’”—“an injury is concrete if it has ‘a close historical or common-law analogue’” and there is a “close relationship” between the harm that Congress sought to remedy and that analogue. Id. (quoting TransUnion, 594 U.S. at 424–25). In providing a private cause of action, Congress may even “identif[y] a modern relative of a harm with long common law roots,” Gadelhak v. AT&T Servs., Inc., 950 F.3d 458, 462 (7th Cir. 2020) (Barrett, J.), and “elevate to the status of legally cognizable injuries [those] concrete, de facto injuries that were previously inadequate in law,” TransUnion, 594 U.S. at 425–26 (quoting Spokeo, Inc. v. Robins, 578 U.S. 330, 341 (2016)). Thus, the injury-in-fact requirement is satisfied if a party brings a “private right of action to remedy” a harm recognized in common law or “a harm that is a lesser form of a harm recognized at common law.” Pileggi, 146 F.4th

4 Members of local and state Leagues of Women Voters are also members of the League of Women Voters. Stewart Decl. ¶ 6, ECF No. 16-5; Supp. Stewart Decl. ¶ 10, ECF No. 66-5. 5 Because the Plaintiffs’ injuries suffice to confer standing for their claims, the Court does not address the Plaintiffs’ argument that organizational or informational standing can also support some of their claims. See Pls.’ Mot. 13.

24

at 1227. “Th[e]se include, for example, reputational harms, disclosure of private information, and intrusion upon seclusion.” TransUnion, 594 U.S. at 425.

The Privacy Act “provide[s] certain safeguards for an individual against an invasion of personal privacy.” Cooper, 566 U.S. at 294–95 (quoting Privacy Act of 1974 § 2(b), 88 Stat. at 1896). “[T]he Act serves interests similar to those protected by defamation and privacy torts”— “there is good reason to infer that Congress relied upon those torts in drafting the Act” and “parallel[ed]” those “common-law torts” in its statutory scheme. Id. at 295–96.

Here, the Plaintiffs have established privacy injuries because of the modified SAVE system. They claim that the Federal Defendants have disclosed their members’ private information in SSA records (including their SSNs and citizenship status) without their consent through bulk SAVE queries. Specifically, they allege that Texas, Louisiana, and other SAVE users have accessed and continue to have access to this private information through SAVE in violation of the Social Security Act and the Privacy Act. See Nel Decl. ¶¶ 27–43; A. Doe Decl. ¶¶ 18, 23–24; B. Doe Decl. ¶¶ 32–44, 46–47; C. Doe Decl. ¶¶ 19–25, ECF No. 66–6. The Plaintiffs further allege that their members provided this private information to SSA when they applied for SSNs, and that they reasonably expected the agency to keep that information confidential and use it only for that purpose. See Nel Decl. ¶ 33; A. Doe Decl. ¶ 18; B. Doe Decl. ¶ 38; C. Doe Decl. ¶ 25; Kisselburgh Decl. ¶ 15, ECF No. 66-11; Suppl. Green Decl. ¶ 49; J. Doe 4 Suppl. Decl. ¶ 9; J. Doe 6 Decl. ¶¶ 10, 20, ECF No. 16-8.

The Plaintiffs establish reputational injuries, too. As they tell it, their members include individuals who applied for SSNs when they were non-citizens but have since naturalized. Nel Decl. ¶ 34; A. Doe Decl. ¶¶ 4–6; B. Doe Decl. ¶¶ 4–6; Suppl. Green Decl. ¶¶ 32, 35; J. Doe 4 Suppl. Decl. ¶¶ 2, 8; C. Doe Decl. ¶¶ 4–5; J. Doe 6 Decl. ¶¶ 2, 9. For those individuals, their Social

25

Security files are outdated and incorrectly list them as non-citizens. Nel Decl. ¶ 34; B. Doe Decl. ¶ 39; Suppl. Green Decl. ¶ 11; J. Doe 4 Suppl. Decl. ¶ 14; C. Doe Decl. ¶ 26; J. Doe 6 Decl. ¶ 15. The Plaintiffs state that their members had no reason to believe that failure to update their citizenship status with SSA would have any impact on their lives. Nel Decl. ¶ 34; A. Doe Decl. ¶ 19; B. Doe Decl. ¶ 39; C Doe Decl. ¶ 26. But because of the Federal Defendants’ disclosure of their citizenship status through the modified SAVE, these individuals were identified as potential non-citizens by the State of Texas based on a “comparison of the information in [their] voter registration records with the United States Citizenship and Immigration Services SAVE records.” Nel Decl., Ex. 1; A. Doe Decl., Ex. 1; B. Doe Decl., Ex. 2; C. Doe Decl., Ex. 1. And they have had to provide proof of citizenship within thirty days to avoid cancellation of their voter registrations. A. Doe Decl. ¶¶ 11–14 & Ex. 1; C. Doe Decl. ¶¶ 12–14, 18 & Ex. 1. Some of the Plaintiffs’ members have had their voter registrations wrongfully cancelled for failure to provide documentation within thirty days of these notices. See Nel Decl. ¶¶ 19–21, 24, 26 & Exs. 1, 2; B. Doe Decl. ¶¶ 11–17, 21–22, 24–27, 30–31 & Exs. 1, 2.

The Plaintiffs argue that statutory claims challenging the disclosure of their private information to both DHS and SAVE users have three common-law analogues: intrusion upon seclusion, breach of confidence, and defamation. Pls.’ Mot. 14–16. The Court agrees that all three analogues fit the bill. Therefore, it concludes that the Plaintiffs have established concrete injuries that serve as a basis for standing in this Court.

a. Intrusion Upon Seclusion The first analogue is intrusion upon seclusion. Pls.’ Mot. 14. An “injury . . . closely analogous to the harm of intrusion upon seclusion” is cognizable under Article III. Pileggi, 146 F.4th at 1228. Intrusion upon seclusion is an “intentional[] intrusi[on], physical or otherwise, upon

26

the solitude or seclusion of another or his private affairs or concerns . . . if the intrusion would be highly offensive to a reasonable person.” Id. (quoting Restatement (Second) of Torts § 652B (A.L.I. 1977)). Various courts across the country, see, e.g., Am. Fed. of State, Cnty. & Mun. Emps. v. SSA, 172 F.4th 361, 369 (4th Cir. 2026) (en banc), and nearly “every court in this circuit” have held that the unauthorized disclosure of Social Security and other “private information” by government employees is the exact type of injury protected by the tort of intrusion upon seclusion, AFL-CIO v. Dep’t of Lab., No. 25-cv-339, 2026 WL 879518, at *10 (D.D.C. Mar. 31, 2026) (collecting cases). And the Plaintiffs are challenging just that—an unauthorized disclosure of Social Security and other private information. This supports Article III standing.

The Defendants urge the contrary. They say that intrusion upon seclusion has an additional requirement: “knowledge that a third party is engaged in” the invasion of privacy, relying on the Fourth Circuit’s abrogated opinion in Am. Fed’n of Teachers v. Bessent, 152 F.4th 162, 172 (4th Cir. 2025), abrogated by 172 F.4th 361 (4th Cir. 2026). See Fed. Defs.’ Mot. 19; Texas Mot. 11– 12. That decision reasoned that intrusion upon seclusion is targeted to privacy injuries “that invade[] one’s space or disrupt[] one’s daily activities,” while “[u]nauthorized knowledge of sensitive information” like Social Security information without a “feeling of unease” or “trespass” stemming from knowledge of that disclosure is more akin to “defamation.” Bessent, 152 F.4th at 172 (citation omitted). Bessent’s rationale is both unconvincing and inapposite for three reasons.

First and foremost, Bessent was decided on an emergency basis and therefore on an expedited timeline, and it thus concluded only that the plaintiffs there likely lacked standing. Id. at 171. With more time to consider the issue, the en banc Fourth Circuit concluded that Bessent misread the Second Restatement of Torts and held instead that disclosure of SSA data is akin to

27

the tort of intrusion upon seclusion irrespective of knowledge of the disclosure. Am. Fed. of State, Cnty. & Mun. Emps., 172 F.4th at 370–71.

Second, Bessent is inapposite. In Bessent, none of the plaintiffs alleged that “any particular row of information [in the database] belonging to any particular Plaintiff [was] examined” by a third party. 152 F.4th at 172. In stark contrast, the record here abounds with declarations that SSA handed over individuals’ private information to state authorities, that those authorities revoked or threatened to revoke voter registrations based on the unauthorized and inaccurate disclosures, and that the unauthorized and inaccurate disclosures disrupted the individuals’ daily lives when they were forced to correct the inaccuracies. See, e.g., A. Doe Decl. ¶¶ 11–14; C. Doe Decl. ¶¶ 12–14, 18. These facts—United States citizens receiving notices from state authorities threatening revocation of their voter registration and possible criminal sanctions based on the unauthorized disclose of inaccurate, private information—undoubtedly create a “feeling of unease when and where one should ideally be at peace.” Bessent, 152 F.4th at 172.

Third, Bessent is unpersuasive on its own terms. Most glaringly, it did not grapple with TransUnion’s instruction that Article III does not “require an exact duplicate” to a harm cognizable in common law and that Congress “may ‘elevate to the status of legally cognizable injuries concrete, de facto injuries that were previously inadequate in law.’” TransUnion, 594 U.S. at 425–26, 433 (quoting Spokeo, 578 U.S. at 341). Courts considering this instruction have held that the disclosure of SSA data is undoubtedly the “same kind of harm that common law” privacy torts, like intrusion upon seclusion, protect. See All. for Retired Ams. v. Bessent, 770 F. Supp. 3d 79, 104 (D.D.C. 2025) (quoting Gadelhak, 950 F.3d at 462). Indeed, TransUnion itself made clear that “retention of information lawfully obtained, without further disclosure, traditionally has not provided the basis for a lawsuit in American courts,” but a different analysis is necessary in

28

equitable suits where (1) private information is “provided” to third parties, (2) there is a “serious likelihood of disclosure” of that information, or (3) when plaintiffs are “aware of . . . misleading information” provided about them. 594 U.S. at 434, 436 n.7, 438 (emphases added) (cleaned up). Courts have long held that the “unlawful” “collection, storage, and use” of private data “qualifies as an invasion of a ‘private domain, much like an act of trespass would be’” and “is closely analogous to historical claims for invasion of privacy.” Fox v. Dakkota Integrated Sys., LLC, 980 F.3d 1146, 1155 (7th Cir. 2020) (emphasis added) (cleaned up) (collecting cases and holding that a plaintiff’s claim that her workplace unlawfully retained and shared her biometric data with a third-party was sufficiently analogous to historical claims for invasion of privacy to establish an Article III injury).

Accordingly, the Court concludes that the tort of intrusion upon seclusion is a sufficient analogue for the disclosure claims under the Privacy and Social Security Acts. The Plaintiffs have suffered a concrete injury for purposes of Article III standing.

b. Breach of Confidence

The Parties next dispute whether the tort of breach of confidence provides an analogue.

Pls.’ Mot. 14; Fed. Defs.’ Mot. 20–21; Texas Mot. 14–15. The tort of breach of confidence—“a harm that has traditionally been regarded as providing a basis for a lawsuit in English or American courts”—“‘lies where a person offers private information to a third party in confidence and the third party reveals that information’ to another.” Jeffries v. Volume Servs. Am., Inc., 928 F.3d 1059, 1064 (D.C. Cir. 2019) (first quoting Spokeo, 578 U.S. at 340–41; and then quoting Muransky v. Godiva Chocolatier, Inc., 922 F.3d 1175, 1190–91 (11th Cir. 2019)). Importantly, breach of confidence bears a close resemblance to the Privacy Act’s prohibition on “disclosure” or “use of [a] record for a purpose which is [in]compatible with the purpose for which it was collected.”

29

5 U.S.C. § 552a(a)(7), (b)(3). “[T]here is good reason to infer[, then,] that Congress relied upon [this] tort[] in drafting the Act,” Cooper, 566 U.S. at 295, and that a violation of this provision in the Privacy Act is a close “analogue” to breach of confidence, TransUnion, 594 U.S. at 424. Accordingly, the Court agrees that the Plaintiffs’ Privacy Act claim challenging the “wrongful sharing of sensitive information” through SAVE “bears a close relationship to the harms traditionally redressable through . . . breach of confidence” as well. League of United Latin Am. Citizens v. Exec. Off. of the President, 818 F. Supp. 3d 34, 110 (D.D.C. 2026).

c. Defamation

Finally, the Plaintiffs also rely on the common law tort of defamation as an analogue for their disclosure injuries. Pls.’ Mot. 16. “Under longstanding American law, a person is injured when a defamatory statement ‘that would subject him to hatred, contempt, or ridicule’ is published to a third party.” TransUnion, 594 U.S. at 432 (quoting Milkovich v. Lorain Journal Co., 497 U.S. 1, 13 (1990)) (citing Restatement (First) of Torts § 559 (A.L.I. 1938)). “Any act whereby the defamatory matter is intentionally or negligently communicated to a third person is a publication.” Restatement (First) of Torts § 577 cmt. a (A.L.I. 1938). Thus, when a plaintiff is “injured by [the] dissemination of allegedly inaccurate information” to a third party—that injury “bears a close relationship to the common-law tort of defamation” and constitutes an Article III injury. Ranjan v. U.S. DHS, 747 F. Supp. 3d 192, 199–200 (D.D.C. 2024). As another judge in this District has explained:

To understand this [harm], it is useful to begin with the Supreme Court’s decision in TransUnion. The plaintiff class sued TransUnion, a credit reporting agency, arguing that it had “failed to use reasonable procedures to ensure the accuracy of their credit files.” 594 U.S. at 417. For about 1,800 class members, TransUnion had disseminated misleading credit reports to businesses, “label[ing] the class members as potential terrorists, drug traffickers, or serious criminals.” Id. at 432. The Court analogized that injury to the tort of defamation . . . [where] “a person is injured when a defamatory statement ‘that would subject him to hatred, contempt, or

30

ridicule’ is published to a third party.” Id. (quoting [Milkovich, 497 U.S. at 13]).

Because those class members had “suffered a harm with a ‘close relationship’ to the harm associated with the tort of defamation,” the Court had “no trouble concluding” that they had experienced a concrete harm sufficient to confer standing. Id. . . . [But] the Court held that the roughly 6,000 [other] class members whose inaccurate reports had never been disseminated could not satisfy the concrete-harm requirement. Id. at 434–35[.]

Ranjan, 747 F. Supp. 3d at 199–200.

Similarly, here, the undisputed record shows that the Plaintiffs’ members have been injured by “dissemination of . . . inaccurate information” falsely indicating that they are non-citizens. Id. at 199. Such publication is defamatory not only because it resulted in the revocation or threatened revocation of their voter registrations but because it carries an implication that those members are “serious criminals.” TransUnion, 594 U.S. at 432; see 18 U.S.C. § 611 (criminalizing non-citizen voting); id. § 1015 (criminalizing voter registration by non-citizens); Press Release, Tex. Sec’y of State, Texas Completes Citizenship Verifications in the SAVE Database (Oct. 20, 2025), https://www.sos.state.tx.us/about/newsreleases/2025/102025.shtml [https://perma.cc/9WZ2- XVDA] (stating that “individuals who are deemed non-citizens” under SAVE and “that voted in a Texas election will be referred to the Office of the Attorney General” of Texas for investigation). Undoubtedly then, the Plaintiffs have suffered injuries with “a sufficiently close relationship to the harm[s] from . . . false and defamatory statement[s].” TransUnion, 594 U.S. at 433.

The Defendants’ arguments to the contrary border on the absurd. The Defendants argue that “a former non-citizen being described as a current non-citizen—even if mistakenly and inaccurately, after naturalization—does not come close to” defamation and “is nothing like being labeled a ‘potential terrorist.’” Fed. Defs.’ Mot. 22; see also Texas Mot. 15. The Defendants’ view on the importance of citizenship bears little resemblance to reality. See Schneiderman v. United States, 320 U.S. 118, 122 (1943) (“[I]t is safe to assert that nowhere in the world today is the right of citizenship of greater worth to an individual than it is in this country. It would be difficult to

31

exaggerate its value and importance. By many it is regarded as the highest hope of civilized men.”); Kennedy v. Mendoza-Martinez, 372 U.S. 144, 159 (1963) (“Citizenship is a most precious right.”); Fedorenko v. United States, 449 U.S. 490, 506–07 (1981) (citizenship is a “priceless treasure” (quoting Johnson v. Eisentrager, 339 U.S. 763, 791 (1950) (Black, J., dissenting))). As evidenced by the actions taken by state authorities in this case, even the mere suggestion of non-citizenship can cause grievous consequences. See Klapprott v. United States, 335 U.S. 601, 616 (1949) (Rutledge, J., concurring in judgment) (“To take away a man’s citizenship deprives him of a right no less precious than life or liberty, indeed of one which today comprehends those rights and almost all others.”). This remains as true for a naturalized citizen as any other. See Luria v. United States, 231 U.S. 9, 22 (1913) (“Under our Constitution, a naturalized citizen stands on an equal footing with the native citizen in all respects, save that of eligibility to the Presidency.”). Suffice it to say that in the context of voting—where citizenship status can distinguish an engaged voter from a criminal—accusing a registered voter of being a non-citizen counts as, at the very least, “a lesser form” of defamation. Pileggi, 146 F.4th at 1227.

* * *

Having found that the Plaintiffs have suffered privacy and reputational injuries, the remaining standing inquiries are easily satisfied. The Defendants do not contest that those injuries are the result of the SAVE modified system, and a favorable decision by this Court would undoubtedly redress those injuries.

2. Voter Injuries

The Plaintiffs next argue that they have suffered cognizable Article III voter injuries that can alternatively provide standing for all their claims. Pls.’ Mot. 16. The Court agrees.

32

It goes without saying that voting is “a process ‘of the most fundamental significance under our constitutional structure.’” Bost v. Ill. State Bd. of Elections, 607 U.S. 71, 77 (2026) (quoting Ill. Bd. of Elections v. Socialist Workers Party, 440 U.S. 173, 184 (1979)). Thus, “[t]here is no doubt that the right to vote is a legally protected interest” cognizable under Article III of the Constitution. Am. Encore v. Fontes, 152 F.4th 1097, 1111 (9th Cir. 2025). And “[a] plaintiff need not have the franchise wholly denied to suffer injury” to this concrete interest. Charles H. Wesley Educ. Found., Inc. v. Cox, 408 F.3d 1349, 1352 (11th Cir. 2005). Voters are injured when “they [a]re wrongly identified as non-citizens” and their franchise is burdened as a result. Arcia v. Fla. Sec’y of State, 772 F.3d 1335, 1341 (11th Cir. 2014). Even an “increased risk” of disenfranchisement can make an injury “sufficiently ‘imminent’ for standing purposes.” Richardson v. Trump, 496 F. Supp. 3d 165, 179 (D.D.C. 2020) (quoting Attias v. Carefirst, Inc., 865 F.3d 620, 627 (D.C. Cir. 2017)). For instance, in a challenge to an Arizona law requiring the use of SAVE, the Ninth Circuit found that naturalized voters had standing based on evidence that “SAVE may not” have up-to-date “naturalization records,” and the resulting “danger” that “properly registered voters, who in fact are citizens, may have their voter registrations cancelled[,] . . . losing their constitutional right to vote.” Mi Familia Vota v. Fontes, 129 F.4th 691, 708–09 (9th Cir. 2025). And the Eleventh Circuit similarly held that naturalized voters had “standing to prospectively challenge” Florida’s “attempt to remove non-citizens from the voter rolls using the SAVE database” based on “potential errors that could occur when the Secretary attempted to confirm their immigration status in various state and federal databases.” Arcia, 772 F.3d at 1341.

Here, as the Federal Defendants admit, the “Plaintiffs have found four people who were apparently asked to confirm their citizenship to Texas officials.” Fed. Defs.’ Mot. 24 (citing Nel Decl.; A. Doe Decl.; B. Doe Decl.; C. Doe Decl.). Sworn declarations from those individuals

33

establish that they were naturalized citizens with inaccurate SSA records; that Texas threatened to revoke their voter registrations because of information obtained through the modified SAVE system; and that they were required to confirm their citizenship to maintain their voter registrations. See, e.g., Nel Decl. ¶¶ 19–21, 24–26, 34 & Exs. 1, 2; A. Doe Decl. ¶¶ 11–14 & Ex. 1; B. Doe Decl. ¶¶ 11–17, 21–22, 24–28, 30–31, 39; C. Doe Decl. ¶¶ 12–14, 18 & Ex. 1. Two members had to provide proof of citizenship to maintain their registered voter status. A. Doe Decl. ¶¶ 11–14; C. Doe Decl. ¶¶ 12–14, 18. One member had her voter registration revoked without her knowledge and was asked to submit new documentation to restore her registration. B. Doe Decl. ¶¶ 11–17, 21–22, 24–27, 30–31. And two members’ voter registrations remained revoked at the time that they filed their declarations in this case. Nel Decl. ¶¶ 19–26; B. Doe Decl. ¶¶ 30–31. The Defendants have neither disputed this sworn testimony nor challenged their introduction. See Fed. R. Civ. P. 56(c) (requiring a party opposing summary judgment to point to a contrary portion of the record, assert the presence of a dispute, or argue evidence is inadmissible in order to show a genuine dispute of material fact).6 On this record, the Plaintiffs’ voter injuries are sufficient to confer standing.

The Defendants’ arguments do not alter this conclusion. First, the Defendants ask this Court to “infer[] . . . that, after denial of their preliminary-injunction motion,” the “Plaintiffs went searching for affected individuals, found a few, and signed them up for membership.” Fed. Defs.’ Mot. 13. If the Defendants are arguing that the Plaintiff organizations engaged in improper solicitation, they cite no record evidence whatsoever to support that claim. And they never asked

6 Although Rule 56 operates differently with respect to a court’s review of an administrative record, Rule 56(c), alongside that rule’s other provisions, governs the consideration of declarations in support of standing at the summary judgment posture, even in APA cases. See, e.g., Teva Pharms. USA, Inc. v. U.S. FDA, 514 F. Supp. 3d 66, 89 n.3 (D.D.C. 2020).

34

this Court for discovery on this issue. See Fed. Defs.’ Mot. 13 n.6 (noting that the Federal Defendants requested this information, did not receive it, but never raised the issue before the Court); Fed. R. Civ. P. 56(e)(2) (permitting the Court to “consider [a] fact undisputed” if the opposing party fails to properly address it). Regardless, the Court can think of no reason why this is relevant to the standing inquiry, and the Defendants certainly do not explain why.

Next, the Defendants characterize the voting-related injury suffered by the member whose voter registration was cancelled because of the modified SAVE as a “past injury.” Fed. Defs.’ Mot. 24; Texas Mot. 12. They are wrong. This member was facing “continuing, present adverse effects” when the Plaintiffs filed this lawsuit by virtue of her voter registration being cancelled— which is more than enough to satisfy Article III. O’Shea v. Littleton, 414 U.S. 488, 495–96 (1974). And nothing in the record suggests that this injury has been redressed. Nel Decl. ¶ 26.

Relatedly, the Federal Defendants suggest that no Article III injury exists because the identified members “hav[e] now had the opportunity to correct their records” and have not claimed “any paperwork issues” preventing them from doing so. Fed. Defs.’ Mot. 24–25; Fed. Defs.’ Reply 10. But it is well established that the need to take “affirmative steps to avoid the risk of harm” is itself an Article III injury. Meese v. Keene, 481 U.S. 465, 475 (1987). And the “disruption of daily activities” to correct one’s citizenship information to vote is an injury-in-fact under Article III. Env’t Def. Fund v. FERC, 2 F.4th 953, 971 (D.C. Cir. 2021) (quoting Sierra Club v. FERC, 867 F.3d 1357, 1366 (D.C. Cir. 2017)); B. Doe Dec.; ¶¶ 19–23 (describing various phone calls with Texas election officials to determine why their voter registration was cancelled and how to fix it). The same is true of the pocket-book injury of “even a small amount of money,” such as the cost of printing, postage, and obtaining an envelope to correct one’s voter registration. Czyzewski v. Jevic Holding Corp., 580 U.S. 451, 464 (2017); see also Mack v. Resurgent Cap.

35

Servs., L.P., 70 F.4th 395, 405–07 (7th Cir. 2023) (holding that the time, effort, and money for postage that a consumer spent responding to improper debt collector communication constituted a concrete injury); Ebaugh v. Medicredit, Inc., No. 24-1838, 2025 WL 1088077, at *1 (8th Cir. Apr. 11, 2025) (same); See B. Doe Decl. ¶ 23 (resubmitting voter registration forms was necessary when their voter registration was cancelled due to SAVE).

In any event, “past wrongs may serve as evidence” of “a real and immediate threat of repeated injury” as well. Jibril v. Mayorkas, 20 F.4th 804, 814 (D.C. Cir. 2021) (cleaned up) (quoting N.B. ex rel. Peacock v. District of Columbia, 682 F.3d 77, 84 (D.C. Cir. 2012)). That risk is particularly pronounced on this record. The Plaintiffs have produced affidavits from individuals whose citizenship status in SSA records is incorrect and who live in states that have agreements with the Federal Defendants to use the modified SAVE to purge voter rolls. J. Doe 4 Decl. ¶¶ 8–12; J. Doe 6 Decl. ¶¶ 5, 14–15. The administrative record shows that DHS “assumes the accuracy of the Social Security Administration data” in its operation of SAVE, and thus, the system runs the risk of “incomplete or false results” when individuals with inaccurate SSA data are run through it. DHS AR 260; DHS AR 302; see also DHS AR 760 n.2. Indeed, the State of Texas does not dispute that an independent investigation in Travis County, Texas, found that “twenty-five percent of the non-citizen matches” in that county were individuals who had already proven citizenship in the United States. Texas Mot. 17 (quoting Am. Compl. ¶¶ 141–42). The administrative record also shows that, pursuant to its template agreement, DHS requires SAVE users to “contact the registrant or registered voter to obtain proof of U.S. citizenship” “in all cases where the User Agency receives any SAVE response other than that of U.S. citizen.” DHS AR 762. Thus, the Plaintiffs have shown that their members will necessarily need to take “affirmative steps to avoid the risk of harm” that accompanies being labeled a potentially ineligible voter should the modified SAVE system

36

continue to operate. Meese, 481 U.S. at 475. This is sufficient to demonstrate an Article III injury. See Mi Familia Vota, 129 F.4th at 708–09; Arcia, 772 F.3d at 1341; League of Women Voters of the U.S. v. Newby, 838 F.3d 1, 8 (D.C. Cir. 2016) (holding that the “experience of the Kansas League” showed it was “almost certain that similar obstacles to registration will spring up in Alabama and Georgia when those States decide to enforce their [proof-of-citizenship] laws”).

The Defendants make much of the fact that only a small proportion of the U.S. electorate are naturalized voters with potentially inaccurate citizenship data in SSA records. This is a red herring. The fact that only a “tiny number” of people are impacted by unlawful activity does not mean that an Article III injury is not present. Contra Texas Mot. 16. Members of the Plaintiff organizations are among those people—they live in States that have agreed to use SAVE data to purge voter rolls and their SSA citizenship data is out of date. J. Doe 4 Decl. ¶¶ 8–12; Doe 6 Decl. ¶¶ 5, 15. The rule is not that an injury must be a generally shared grievance for it to be brought in federal court. Rather, to sustain an action, an organization need only show that “one of its members” suffered a particularized harm. Institutional S’holder Servs., 142 F.4th at 764 (quoting Wash. All. of Tech. Workers, 50 F.4th at 175). And in this context, “even one disenfranchised voter” is one “too many.” League of Women Voters of N.C. v. North Carolina, 769 F.3d 224, 244 (4th Cir. 2014).

Having established cognizable voter injuries, the Court turns to causation and redressability. The Federal Defendants contend that the Plaintiffs’ voter injuries are caused by “the independent action of some third party not before the court”—namely, states such as Texas. Fed. Defs.’ Mot. 25–26 (citation omitted). Before addressing the Federal Defendants’ argument head on, the Court notes that Texas is now a Defendant in this case. And “[w]hen a party intervenes, it becomes a full participant in the lawsuit and is treated just as if it were an original party”—the

37

Court’s decision constitutes a “complete adjudication” on the merits and “the possibility that the plaintiff will be able to obtain relief against the intervenor-defendant is part of the price paid for intervention.” Schneider v. Dumbarton Devs., Inc., 767 F.2d 1007, 1017 (D.C. Cir. 1985) (first quoting United States v. Oregon, 657 F.2d 1009, 1014 (8th Cir. 1981); and then quoting District of Columbia v. MSPB, 762 F.2d 129, 132 (D.C. Cir. 1985)); see also Food & Water Watch v. U.S. EPA, 5 F. Supp. 3d 62, 67 n.1 (D.D.C. 2013); Donovan v. Oil, Chem., & Atomic Workers Int’l Union & Its Loc. 4-23, 718 F.2d 1341, 1350–51 (5th Cir. 1983); United States v. Jim, 891 F.3d 1242, 1252–53 (11th Cir. 2018).

Nevertheless, the Federal Defendants’ argument about third parties does not change the result. As the Federal Defendants recognize, Article III “requires no more than de facto causality.” Dep’t of Com. v. New York, 588 U.S. 752, 768 (2019) (quoting Block v. Meese, 793 F.2d 1303, 1309 (D.C. Cir. 1986) (Scalia, J.)); Fed. Defs.’ Mot. 26–27. A plaintiff has standing to sue the federal government if “‘third parties will likely react’ to the government[’s] [action] (or judicial relief) ‘in predictable ways’ that will likely cause (or redress) the plaintiff’s injury.” Diamond Alt. Energy, LLC v. EPA, 606 U.S. 100, 112 (2025) (quoting Alliance for Hippocratic Medicine, 602 U.S. 367, 383 (2024)). The Defendants argue that states are the true cause of the Plaintiffs’ injuries because “[n]o voter is cancelled from the rolls based solely on a SAVE response”; rather, Texas engages in “additional verification” before cancelling voter registration. Texas Mot. 17; see also Fed. Defs.’ Mot 26–27. But as explained above, that additional verification is itself an Article III injury. And the undisputed record shows that the Plaintiffs’ members suffer that injury because “SAVE records show that [they] are not . . . United States citizen[s].” B. Doe Decl., Ex. 2. It is hardly surprising that additional voter verification and potential voter disenfranchisement is “the predictable effect of” the federal government incorrectly informing a state that an individual may

38

be ineligible to vote. Hawkins v. Haaland, 991 F.3d 216, 225 (D.C. Cir. 2021) (quoting New York, 588 U.S. at 768).

Furthermore, this injury “is likely to be redressed by a favorable judicial decision.”

Students for Fair Admissions, 600 U.S. at 199 (quoting Spokeo, 578 U.S. at 338). Reverting SAVE to its prior functionality before the recent changes—without the inaccurate SSA data labeling the Plaintiffs’ members as non-citizens—would likely redress the Plaintiffs’ harms. Their future harms from “potential errors” would certainly be redressed. Arcia, 772 F.3d at 1341; see also Mi Familia Vota, 129 F.4th at 708–09.

3. Procedural Injuries Finally, the Parties seem to dispute whether the Plaintiffs have standing to pursue their procedural claims under the Privacy Act and the APA as well. See Pls.’ Mot. 22–25; Fed. Defs.’ Mot. 11–32; Texas Mot. 12–21. The Court finds that these injuries, too, are sufficient to support standing.

Again, to demonstrate standing, a plaintiff must show: (1) that she suffered an “injury in fact” that is concrete, particularized, and imminent, (2) that there is a fairly traceable “causal connection between the injury and the conduct complained of,” and (3) that it is “likely” rather than “speculative” that “the injury will be redressed by a favorable decision.” Dep’t of Educ. v. Brown, 600 U.S. 551, 561 (2023) (quoting Lujan, 504 U.S. at 560–61). But for a procedural injury, “courts relax—while not wholly eliminating—the issues of imminence and redressability[.]” Ctr. for L. & Educ. v. Dep’t of Educ., 396 F.3d 1152, 1157 (D.C. Cir. 2005); see Brown, 600 U.S. at 561. A plaintiff need only show “some concrete interest that is affected by the deprivation.” Brown, 600 U.S. at 562 (quoting Summers v. Earth Island Inst., 555 U.S. 488, 496–97 (2009)). A plaintiff need not demonstrate that observing proper procedure “would have led to (caused) a

39

different substantive outcome.” Id. at 565–66. Rather, the question is whether an agency’s “substantive decisions” have any “causal relationship” to the interests that the plaintiff seeks to vindicate. Id. at 566.

For instance, “a plaintiff with concrete plans to observe nature in a particular area ‘would be harmed if [a] [land-management project] went forward without incorporation of the ideas he would have suggested’ in his comments.” Id. (second alteration in original) (quoting Summers, 555 U.S. at 494). This is true even if it is “uncertain whether public comment would alter [that] particular land-management decision[.]” Id. “A person ‘living adjacent to the site for proposed construction of a federally licensed dam’” similarly “has standing to challenge the licensing agency’s failure to prepare an environmental impact statement, even though he cannot establish with any certainty that the statement will cause the license to be withheld or altered.” Id. at 561 (quoting Lujan, 504 U.S. at 572 n.7). “In th[ese] context[s], the fact that the defendant might well come to the same decision[s] after abiding by the contested procedural requirement does not deprive a plaintiff of standing.” Id. at 561–62. On the other hand, a plaintiff cannot bring a procedural challenge to an agency action that bears no relationship to the “substantive decisions” made by that agency. Id. at 566. For instance, a plaintiff whose application for a statutory benefit was denied cannot challenge an agency’s procedure in deciding “to give other people [that benefit] under a different statutory scheme.” Id. at 565 (emphasis omitted). That plaintiff’s injury—denial of the statutory benefit—cannot be “traced” because the agency’s procedures governed a different kind of benefit altogether. Id. at 567 (quoting Simon v. Eastern Ky. Welfare Rights Org., 426 U.S. 26, 42–43 (1976)). The question is whether the “procedural right” a plaintiff seeks to vindicate has any bearing on the “protect[ion]” of the “concrete interest[s]” of that plaintiff. Ctr. for L. & Educ., 396 F.3d at 1157 (emphasis omitted).

40

Here, as discussed, the Plaintiffs’ “legally protect[able] interest[s]” in privacy and voting have been put at risk by the Federal Defendants’ failure to comply with the procedural requirements of the Privacy Act and the APA. See Fontes, 152 F.4th at 1111. And the Federal Defendants’ failure to follow these procedures deprived the Plaintiffs of the “adequate safeguards . . . to prevent misuse of [their] information” that the law provides. Privacy Act of 1974 § 2(b)(1), (4), 88 Stat. at 1896. Without these safeguards, the Plaintiffs were subject to nonconsensual disclosure of their private information to DHS and SAVE users and the voter injuries that resulted from inaccuracies in that data—the types of harms that these procedures were designed to remedy. Undoubtedly then, the Plaintiffs have also shown that they have met the relaxed standard for procedural standing based on the threat to their privacy and voting interests.

* * *

In sum, the Plaintiffs have unlocked three doors to show concrete injuries suffered by their members. And with causation and redressability, they have sufficiently met their burden of establishing Article III standing.

B. Final Agency Action Moving to the next threshold argument, the Defendants contend that the establishment of the modified SAVE system outlined in the DHS and SSA SORNs does not constitute a final agency action reviewable under the APA. Texas Mot. 21–23; Fed. Defs.’ Mot. 36–38. This does not pass muster.

The APA only permits review of “final agency action.” 5 U.S.C. § 704. An agency action is final if it is (1) “the consummation of the agency’s decision-making process,” and (2) an action “by which rights or obligations have been determined, or from which legal consequences will flow.” Rhea Lana, Inc. v. Dep’t of Lab., 824 F.3d 1023, 1026 (D.C. Cir. 2016) (quoting Bennett v.

41

Spear, 520 U.S. 154, 177–78 (1997)). But whether rights or obligations have been determined or “‘legal consequences will flow’ from an agency action is a ‘pragmatic’ inquiry.” Ipsen Biopharmaceuticals, Inc. v. Azar, 943 F.3d 953, 956 (D.C. Cir. 2019) (quoting U.S. Army Corps of Eng’rs v. Hawkes Co., 578 U.S. 590, 599 (2016)). Courts focus on the “concrete consequences” of the “agency action” at issue. Cal. Cmtys. Against Toxics v. EPA, 934 F.3d 627, 637 (D.C. Cir. 2019).

The D.C. Circuit has long recognized that establishing “a policy of disclosing confidential information without notice” constitutes a final agency action—observing that “permitting [federal] employees to disclose confidential information without notice is surely a ‘consummation of the agency’s decisionmaking process.’” Venetian Casino Resort, L.L.C. v. EEOC, 530 F.3d 925, 931 (D.C. Cir. 2008) (quoting Bennett, 520 U.S. at 177–78). After all, such a policy both determines “the submitter’s rights” over the information handed over “and the agency’s obligations” on how to handle that information. Id. (cleaned up). This is the exact result of the establishment of the SAVE “modified system” outlined in the 2025 SORNs. Notice of a Modified System of Records, 90 Fed. Reg. at 48,948 (DHS AR 114); see also Notice of a Modified System of Records, 90 Fed. Reg. at 50,879–84 (SSA AR 206–11). Those SORNs—which “illuminate[] the nature of the policy”—reflect that establishing the modified system constituted the adoption of “a policy of disclosing confidential information without notice.” Venetian Casino, 530 F.3d at 931. Thus, establishing the SAVE modified system of records, as it is described in the 2025 SORNs, is a final agency action.

In addition, the Plaintiffs challenge the SORNs themselves, which also count as final agency action. See Pls.’ Reply 23.The SORNs permitted new “routine use[s] of the records contained in the system[]” that they described and laid out “the policies and practices of the agency

42

regarding storage, retrievability, access controls, retention, and disposal of the records.” 5 U.S.C. § 552a(e)(4)(D)–(E); see Notice of a Modified System of Records, 90 Fed. Reg. at 48,948–49 (DHS AR 114–15); Notice of a Modified System of Records, 90 Fed. Reg. at 50,880 (SSA AR 207).7 The Defendants try to argue otherwise by relying on the D.C. Circuit’s decision in Centro de Trabajadores Unidos v. Bessent, 167 F.4th 1218, 1236 (D.C. Cir. 2026). Fed. Defs.’ Mot. 37–38; Texas Mot. 5. But that case is inapposite. There, the D.C. Circuit held that when the “text of the statute unambiguously authorizes . . . disclosure” of information, then a memorandum of understanding explaining how that mandated disclosure will be executed is not a final agency action. Centro de Trabajadores Unidos, 167 F.4th at 1234. This is because the memorandum “does not impose binding duties—and therefore causes no legal consequences—when it merely clarifies existing duties under a statute.” Id. at 1236 (cleaned up).

But unlike the statute at issue in Centro, the Privacy Act only authorizes a routine use disclosure “within the scope of a routine use notice published by the agency.” Ames v. U.S. DHS, 861 F.3d 238, 240 (D.C. Cir. 2017) (citing 5 U.S.C. § 552a(a)(7), (e)(4)(D)). Thus, the 2025 DHS and SSA SORNs are undoubtedly final agency actions, because the “concrete consequence[]” of their promulgation is authorizing the challenged disclosures to occur, a consequence not authorized by any other separate statutory mandate. Cal. Cmtys. Against Toxics, 934 F.3d at 637; see Barrick Goldstrike Mines Inc. v. Browner, 215 F.3d 45, 48 (D.C. Cir. 2000) (“[D]ocument[s] reflecting a settled agency position and having legal consequences . . . may constitute ‘final agency action’ for

7 The 2025 SSA SORN provided that its authorization of new routine uses would become automatically effective after thirty days. Notice of a Modified System of Records, 90 Fed. Reg. 50,879, 50,880 (Nov. 12, 2025) (SSA AR 207) Thus, even if the SORN did not constitute final agency action when it was issued, it certainly does now.

43

the purpose of judicial review.”). The SORNs act both as final “agency statement[s] of . . . future effect designed to implement” the modified SAVE system and “license[s]” “permit[ting]” or acting as a “form of permission” for the system, routine uses, and disclosures that they outline. Norton v. S. Utah Wilderness All., 542 U.S. 55, 62 (2004) (first alteration in original) (quoting 5 U.S.C.§ 551). Both the establishment of the modified SAVE system described by the 2025 SORNs and the SORNs themselves are final agency actions that may be challenged under the APA.

C. The Social Security Act Turning to the merits, the Plaintiffs first argue that the modified SAVE system of records violates the Social Security Act. They are correct.8 The Social Security Act instructs that: “Social security account numbers and related records that are obtained or maintained by authorized persons pursuant to any provision of law enacted on or after October 1, 1990, shall be confidential, and no authorized person shall disclose any such social security account number or related record.” 42 U.S.C. § 405(c)(2)(C)(viii)(I). An “authorized person” is “an officer or employee of the United States, an officer or employee of any State, political subdivision of a State, or agency of a State or political subdivision of a State, and any other person” who has access to such records. Id. § 405(c)(2)(C)(viii)(III).

There can be no question that the modified SAVE system violates this prohibition—the system discloses both Social Security numbers and related records maintained by SSA. And the Defendants do not argue otherwise. Instead, they contend that the Plaintiffs lack a cause of action to enforce the Social Security Act—relying on inapposite cases where the relevant cause of action

8 Because the Plaintiffs succeed on their Social Security Act claim based on 42 U.S.C. § 405(c)(2)(C)(viii)(I), the Court does not address their alternative argument that the modified SAVE also violates 42 U.S.C. § 1306(a)(1). Pls.’ Mot. 32.

44

was not the APA. Fed. Defs.’ Mot. 50 (citing Biccum v. City of Watertown, No. 17-cv-645, 2019 WL 4752927 (N.D.N.Y. Sep. 30, 2019) (concerning a Section 1983 claim)). But the Defendants ignore that “the APA provides an omnibus cause of action for violations of other statutes.” FDA v. R. J. Reynolds Vapor Co., 606 U.S. 226, 232 n.4 (2025). The Plaintiffs’ claim challenging compliance with the Social Security Act was brought under the APA. See Am Compl. ¶ 204. And the APA’s judicial review provision, 5 U.S.C. § 702, “permits suit[s]” by any person aggrieved by agency action “for violations of numerous statutes of varying character that do not themselves include causes of action for judicial review.” Lexmark Int’l, Inc. v. Static Control Components, Inc., 572 U.S. 118, 130 (2014). The Defendants do not explain why the APA’s cause of action may not be used to remedy the Plaintiffs’ injuries caused by violations of the Social Security Act. Indeed, the Defendants’ briefs are devoid of any mention of this subject. See Fed. Defs.’ Mot. 49– 50; Texas Mot. 26–27. Accordingly, the Defendants have conceded both (1) that an APA cause of action exists for this claim, and (2) that the Social Security Act forbids disclosure of SSA data to DHS or in responses to SAVE users. Texas v. United States, 798 F.3d 1108, 1110 (D.C. Cir. 2015) (“[I]f a party files an opposition to a motion and therein addresses only some of the movant’s arguments, the court may treat the unaddressed arguments as conceded.” (quoting Wannall v. Honeywell, Inc., 775 F.3d 425, 428 (D.C. Cir. 2014))). By itself, this is sufficient for the Plaintiffs to prevail.9 D. The Privacy Act But there is more. Turning to the Privacy Act, the Plaintiffs argue that the SAVE modified system violates the Act’s substantive and procedural protections. Pls.’ Mot. 35–40. The

9 The Defendants do argue that other statutes authorize the disclosure notwithstanding the Social Security Act, which the Court addresses below. See infra Discussion F; see also Fed. Defs.’ Mot. 49–50; Texas Mot. 26–27.

45

Defendants challenge the Plaintiffs’ ability to bring these claims under the APA and argue that they fail in any event. See Fed. Defs.’ Mot. 54–59. The Plaintiffs’ arguments are more persuasive.

1. Other-Adequate-Remedy Bar First, the Defendants argue that the Plaintiffs’ Privacy Act claims fail because “judicial review” under the APA is not available when there is “[an]other adequate remedy in a court.” 5 U.S.C. § 704; Fed. Defs.’ Mot. 39. They point out that the Privacy Act provides judicial remedies for some violations but does not authorize equitable relief to enforce the statute’s notice and comment requirements or its limitations on disclosure. See Fed. Defs.’ Mot. 40–41 (citing 5 U.S.C. § 552a(g)); see also Sussman v. U.S. Marshals Serv., 494 F.3d 1106, 1122 (D.C. Cir. 2007). Because the Privacy Act provides limited avenues for judicial review, 5 U.S.C. § 552a(g), the Federal Defendants argue that Section 704 precludes APA relief based on that “other . . . remedy,” 5 U.S.C. § 704. See Fed. Defs.’ Mot. 39; Texas Mot. 23–24.

It is true that courts in this District have precluded APA suits for Privacy Act violations when they “duplicate existing procedures for review of agency action.” Haleem v. U.S. Dep’t of Def., No. 23-cv-1471, 2024 WL 230289, at *13–14 (D.D.C. Jan. 22, 2024) (quoting Bowen v. Massachusetts, 487 U.S. 879, 903 (1988)). But these precedents are inapplicable to the statute’s procedural requirements, 5 U.S.C. § 552a(e)(4), (11), and to forward-looking remedies to enforce the statute’s disclosure provisions, 5 U.S.C. § 552a(b), for which the Privacy Act does not “offer[] relief of the same genre,” Haleem, 2024 WL 230289, at *13 (quoting Garcia v. Vilsack, 563 F.3d 519, 522 (D.C. Cir. 2009)). Rather than suggesting a bar on APA review, the “absence of equitable relief” for these claims in the Privacy Act’s judicial review provisions is easily “explained by the availability of such relief under the APA,” Cooper, 566 U.S. at 303 n.12 (characterizing Doe v. Chao, 540 U.S. 614, 619 n.1 (2004)); see also id. (“The [Privacy] Act deters violations of its

46

substantive provisions in other ways—for instance . . . possibly by allowing for injunctive relief under the [APA]” (citations omitted)).10 Indeed, the D.C. Circuit has held that APA equitable or vacatur relief is available for Privacy Act violations in a case where “the Privacy Act does not by itself authorize the injunctive relief sought” by a plaintiff. Doe v. Stephens, 851 F.2d 1457, 1463, 1465–67 (D.C. Cir. 1988) (challenging agency disclosure as not constituting a routine use under 5 U.S.C. § 552a(a)(7), (b)). Various district courts have similarly rejected the Defendants’ reading of Section 704. See Ctr. for Taxpayer Rts. v. IRS, 815 F. Supp. 3d 1, 43 (D.D.C. 2025); Am. Fed’n of Gov't Emps. v. U.S. OPM, 786 F. Supp. 3d 647, 691–92 (S.D.N.Y. 2025); Doe v. Noem, 783 F. Supp. 3d 907, 923–24 (W.D. Va. 2025). And the Supreme Court has cautioned that the APA’s other-adequate-remedy bar, 5 U.S.C. § 704, should be “construed” narrowly and primarily to avoid “duplication,” rather than “to defeat the [APA’s] central purpose of providing a broad spectrum of judicial review of agency action.” Bowen, 487 U.S. at 903. “The mere fact that some acts are made reviewable,” Abbott

10 The Court notes that the inquiry is more complex for 5 U.S.C. § 552a(e)(5) and (e)(6), which require federal agencies to ensure the “accura[cy], complete[ess], timel[iness], and relevan[ce]” of records maintained to “mak[e] any determination about any individual” or that are “disseminated . . . to any person other than an agency.” These provisions are violated when it is reasonably “feasible, necessary, and proper for the agency . . . to determine whether each filed item of information is accurate,” timely, and relevant, but the agency fails to do so. Strang v. U.S. Arms Control & Disarmament Agency, 864 F.2d 859, 866 (D.C. Cir. 1989) (quoting Doe v. United States, 821 F.2d 694 (D.C. Cir. 1987) (en banc)). The Privacy Act provides for some injunctive relief when an agency fails to correct records “which the individual believes is not accurate, relevant, timely, or complete.” 5 U.S.C. § 552a(d)(2)–(3), (g)(1)(A). But the D.C. Circuit has made clear that the Privacy Act’s remedial provisions were not “intended to be [the] exclusive” remedies for such violations. Vymetalik v. F.B.I., 785 F.2d 1090, 1098 n.12 (D.C. Cir. 1986). And it is evident that Sections 552(e)(5) and (6) were violated here. See, e.g., DHS AR 240 (finding “risk” that the modified SAVE “may share inaccurate information with registered agencies”); DHS AR 260 (recognizing the modified SAVE’s “[s]hortfalls in data accuracy”); DHS AR 302 (same); SSA AR 44 (“[C]itizenship information in SSA’s records might not be current.”). Nevertheless, the Court does not rest its conclusion with respect to the Privacy Act on these violations given that the Federal Defendants also violated other provisions of the Privacy Act for which there is unambiguously no adequate relief for the Plaintiffs other than 5 U.S.C. §§ 702, 706.

47

Lab’ys v. Gardner, 387 U.S. 136, 141 (1967) (citation omitted), or that “a naked money judgment” could be sought does not preclude APA review, Bowen, 487 U.S. at 905.

Stepping back, it is unclear whether the APA’s other-adequate-remedy bar even applies to the Privacy Act. 5 U.S.C. § 704. Although courts commonly use terms like the “Administrative Procedure Act” (or the “Freedom of Information Act”) to refer to the parts of Title 5 that carry forward the substantive provisions of that Act, that language is technically imprecise. It is true that the provisions of Chapter 5 and Chapter 7 of Title 5 “were originally enacted by act June 11, 1946, ch. 324, 60 Stat. 237, popularly known as the ‘Administrative Procedure Act.’” 5 U.S.C. ch. 5, subch. II note. But the Administrative Procedure Act was actually “repealed as part of [a] general revision” by Congress in 1966. Id. In that revision, Congress repealed various statutes “relating to the organization of government” and reenacted them as a single consolidated “Act” known as “title 5.” Pub. L. No. 89–554, pmbl., §§ 7(a), 8, 80 Stat. 378, 378, 631–32 (1966). The APA was one of the statutes repealed, id. § 8, 80 Stat. at 632 (repealing the APA, Pub. L. No. 79–404, 60 Stat. 237 (1946)), and Congress reenacted its provisions throughout the new “Act” “without substantive change,” Pub. L. No. 89–554 § 7(a), 80 Stat. at 631. Thus, although courts popularly use terms like the “Administrative Procedure Act”—there is in fact no Administrative Procedure Act, just Title 5. See id. § 7(b), 80 Stat at 631 (“A reference to a law replaced by sections 1–6 of this Act, including a reference in a regulation, order, or other law, is deemed to refer to the corresponding provision enacted by this Act.”); Univ. of Cincinnati v. Shalala, 891 F. Supp. 1262, 1269 n.18 (S.D. Ohio 1995) (“Defendant cites to the Administrative Procedure Act (APA). The APA was, however, repealed by Pub. L. No. 89–554, Sept. 6, 1966, 80 Stat. 381. The former APA’s provisions were incorporated into 5 U.S.C. ch. 5 and 7.” (citation omitted)).

48

Importantly, in 1974, Congress enacted the Privacy Act as an amendment to that Act, Title 5, and placed it in Chapter 5 alongside the APA’s provisions. Privacy Act of 1974 pmbl., 88 Stat. at 1896 (“To amend title 5, United States Code, by adding a section 552a[.]”). Thus, it is unclear whether the other-adequate-remedy bar (Section 704 of Title 5) directs a comparison between relief under the Privacy Act and relief under the APA. Think of it this way. Section 704 asks whether “there is no other adequate remedy in a court” to review “final agency action,” 5 U.S.C. § 704 (emphasis added), meaning that “APA review is not available if Congress has provided a ‘special and adequate review procedure’ elsewhere,” V.I. Hous. Fin. Auth. v. Fed’l Emergency Mgmt. Agency, 151 F.4th 409, 418 (D.C. Cir. 2025) (quoting Bowen, 487 U.S. at 904)). But review under the Privacy Act might not count as review “elsewhere,” id., given that both the Privacy Act and the APA might be properly conceived of as components of the same scheme: Title 5. Compare 5 U.S.C. § 552a(g) (authorizing “civil action[s] against [an] agency” regarding “the matters under the provisions of this subsection”), with id. § 702 (entitling aggrieved persons “to judicial review”); cf. id. § 552a(d)(3) (referring to § 552a(g)(1)(A) as provisions for “judicial review”). This would explain why the “inattention” to detail in the Privacy Act’s equitable relief provisions is largely “explained by the general provisions for equitable relief within the Administrative Procedure Act” provisions of Title 5. Doe, 540 U.S. at 619 n.1.11

11 Indeed, the APA’s typical remedy for a violation of Title 5 is to “set aside” the agency action altogether. 5 U.S.C. § 706. But for some violations not at issue here, the Privacy Act provides for lesser, more tailored equitable relief. See 5 U.S.C. § 552a(g)(2)–(3) (authorizing the court to order lesser remedies of amending records or mandating disclosure when an agency violates provisions in 5 U.S.C. § 552a(d)). Authorizing courts to grant lesser relief for some violations does not mean that the ordinary set-aside remedy is no longer available for others (e.g., failure to provide notice and comment). See Bowen v. Massachusetts, 487 U.S. 879, 901 (1988) (remedial schemes providing “doubtful and limited relief” for the violation at issue are not adequate remedies within the meaning of the APA).

49

This understanding—that Section 704 does not bar Privacy Act relief—is supported by the Office of Management and Budget’s interpretive guidelines “issued contemporaneously with the statute,” Loper Bright Enters. v. Raimondo, 603 U.S. 369, 394 (2024), which recognized that the Privacy Act’s judicial review provisions would not preclude “judicial review under other provisions of the [APA],” OMB Privacy Act Implementation: Guidelines and Responsibilities, 40 Fed. Reg. 28,948, 28,968 (July 9, 1975) (emphasis added). And subsequent enactments show that this was Congress’ understanding, too. Later amendments (not at issue here) expanding civil liability under the Privacy Act have indicated when Privacy Act remedies are “exclusive.” Judicial Redress Act of 2015, Pub. L. No. 114–126, § 2(b), 130 Stat. 282, 282–84 (codified at 5 U.S.C. § 552a note). And “[w]here Congress includes particular language in one section of a statute but omits it in another section of the same Act, it is generally presumed that Congress acts intentionally and purposely in the disparate inclusion or exclusion.” City & Cnty. of S.F. v. EPA, 604 U.S. 334, 344 (2025) (quoting Russello v. United States, 464 U.S. 16, 23 (1983)). Thus, the statutory scheme and context suggest that Privacy Act claims (when not brought under the provisions explicitly designated exclusive) are neither exclusive nor barred by Section 704 of the APA.

Ultimately, the Defendants ask this Court to discard this statutory structure and depart from the D.C. Circuit’s binding precedent in Stephens, arguing that the Circuit’s decision is not entitled to deference because it sua sponte construed the plaintiff’s complaint as raising an APA claim. See Fed. Defs.’ Mot. 42 n.10. But the Defendants do not explain why this means that Stephens is entitled to less precedential weight. “[I]t is axiomatic” that any precedential holding of the D.C. Circuit must be “binding on this court.” Alabama v. U.S. Army Corps of Eng’rs, 774 F. Supp. 3d 142, 154 (D.D.C. 2025). The Defendants may not like it, but Section 704 is not a bar to the Plaintiffs’ APA claims.

50

2. Disclosure Claims

On the merits of the disclosure claims, the Plaintiffs argue that the Federal Defendants’

disclosure of their SSA data to DHS and SAVE users violates the Privacy Act’s protections against non-consensual disclosures. Pls.’ Mot. 35. They are plainly correct.

The Privacy Act makes it “unlawful for an agency to disclose a record to another agency”

or to any other entity “without the written consent of the person to whom the record pertains.” Cooper, 566 U.S. at 289 n.2 (citing 5 U.S.C. § 552a(b)). The Act defines a “record” broadly as encompassing “any item, collection, or grouping of information about an individual that is maintained by an agency, including . . . his name, or the identifying number, symbol, or other identifying particular assigned to the individual.” 5 U.S.C. § 552a(a)(4) (emphasis added). And a disclosure encompasses “any means of communication.” Id. § 552a(b). Thus, the Act is violated whenever there is a “nonconsensual disclosure of any information that has been retrieved from a protected record.” Bartel v. FAA, 725 F.2d 1403, 1408 (D.C. Cir. 1984).

This limitation is subject to “certain exceptions.” Cooper, 566 U.S. at 289 n.2. One such exception is a “routine use,” which is defined as “the use of such record for a purpose which is compatible with the purpose for which it was collected.” 5 U.S.C. § 552a(a)(7), (b)(3). “To fit within the confines of the routine-use exception to the Privacy Act, an agency’s disclosure of a record must be both (i) ‘for a purpose which is compatible with the purpose for which it was collected’ and (ii) within the scope of a routine use notice published by the agency.” Ames, 861 F.3d at 240 (first quoting 5 U.S.C. § 552a(a)(7); and then citing id. § 552a(e)(4)(D)). “[C]ourts have held that compatibility requires a ‘meaningful degree of convergence’ between the agency’s purpose in collecting the record and the agency’s purpose in disclosing the record.” Id. at 240 n.1 (quoting Britt v. Naval Investigative Serv., 886 F.2d 544, 549 (3d Cir. 1989)) (citing Swenson v.

51

Postal Service, 890 F.2d 1075, 1078 (9th Cir. 1989)); see also Chichakli v. Tillerson, 882 F.3d 229, 233–34 (D.C. Cir. 2018).12 On this record, the Court concludes that DHS’s use of Social Security numbers and other SSA data for voter verification through SAVE is not a routine use under the Privacy Act. Although the DHS and SSA SORNs adopted new routine uses for SSA data for “citizenship and immigration” verification “to the Department of Homeland Security,” Notice of a Modified System of Records, 90 Fed. Reg. at 50,880 (SSA AR 207); see also Notice of a Modified System of Records, 90 Fed. Reg. at 48,954 (DHS AR 120), this does not change the fact that SSA collected this information for purposes concerning work authorization and eligibility for SSA benefits, see SSA AR 115–16; SSA AR 132; SSA AR 149; SSA AR 168–69; SSA AR 188–89; Notice of a Modified System of Records, 90 Fed. Reg. at 50,880 (SSA AR 207). The purpose of collecting such information was never the maintenance of “U.S. citizenship records” for voter verification. SSA AR 103. Indeed, SSA recognizes that its “citizenship information is accurate for SSA’s program purposes” only—“if used later for other purposes, it may not be current.” Id.

The Federal Defendants’ response to this argument is underwhelming. The Federal Defendants start by rejecting the premise that SSA “‘collected’ some form of ‘personal data’ from individuals” at all. Fed Defs.’ Mot. 58 (emphasis omitted). That is because, they say, “Social Security numbers are issued by SSA, to individuals”—thus, SSA collected nothing. Id. (emphasis

12 It has long been suggested that the Privacy Act requires “actual notice” of any routine uses at the time the record was collected. USPS v. Nat’l Ass’n of Letter Carriers, 9 F.3d 138, 146 (D.C. Cir. 1993); Covert v. Harrington, 876 F.2d 751, 755–56 (9th Cir. 1989). This understanding is based on the Privacy Act’s requirement that “the routine uses which may be made of the information, as published pursuant to [the SORN]” must be “on the form which [the agency] uses to collect the information or on a separate form that can be retained by the individual.” 5 U.S.C. § 552a(e)(3)(C). The Parties do not brief this issue. But without question, the record provides nothing supporting that the Plaintiffs’ members received actual notice that their SSA data would be used for voter verification purposes when they disclosed that information to SSA.

52

omitted). As an initial matter, it is unclear what the Federal Defendants believe to be the upshot of this argument. Asking about the “purpose for which [a record] was collected” is an inquiry prompted by the routine-use exception, 5 U.S.C. § 552a(a)(7), not the Privacy Act’s prohibition on disclosure, 5 U.S.C. § 552a(b), or the definition of record, 5 U.S.C. § 552a(a)(4). The Federal Defendants do not explain why the source of Social Security numbers permits them to circumvent the Privacy Act’s disclosure prohibition.

If the Federal Defendants are arguing that Social Security numbers are not records subject to the Privacy Act’s prohibition on disclosure, that position does not square with the statutory text. Under the Privacy Act, a “record” encompasses any “grouping of information about an individual”—which includes an “identifying number” (such as an SSN), the individual’s “name,” and any other particularized information about that individual (e.g., “criminal or employment history”). 5 U.S.C. § 552a(a)(4). The disclosure prohibition comes into effect whenever such a record becomes retrievable by that “name,” “identifying number,” or “identifying particular.” Id. § 552a(a)(5), (b). Further, the contemporary ordinary meaning of the verb “collect” at the time the Privacy Act was passed was: “[t]o bring together into a group; gather; assemble”; “[t]o accumulate as a hobby or study”; “[t]o recover control of”; “[t]o gather together; congregate; accumulate.” Collect, American Heritage Dictionary of the English Language 261 (New Coll. Ed. 1976). And the contemporary ordinary meaning of the adjective “collected” was “brought together or placed from various sources.” Id. Thus, both the statutory definitions and the ordinary meaning of the Privacy Act’s text suggest that an SSN is a record—at least when it is grouped, gathered together, or placed with other personal information. So when an individual fills out a Social Security application with her name and other personal information and SSA attaches an “identifying number” to that information, a record is “collected” within the meaning of the Privacy Act. And

53

undoubtedly, SSA’s master file is a system of records containing private data organized by these identifiers. The Court thus concludes that an SSN and any information accumulated with it are records that are subject to the non-disclosure provisions of the Privacy Act.

As icing on the cake, this understanding is supported by the enactment history of the Privacy Act. When Congress enacted the statute, it created an expert “Privacy Protection Study Commission” to examine government “data banks, automated data processing programs, and information systems”; to recommend practices consistent with “the requirements and principles” of the Act to the President; and to make “legislative recommendations” to Congress “to protect the privacy of individuals while meeting the legitimate needs of government.” Privacy Act of 1974 § 5(b), 88 Stat. at 1906 (codified at 5 U.S.C. § 552a note). In particular, Congress instructed the Commission to study the “use of social security numbers . . . to gain access to, integrate, or centralize information systems and files.” Id. § 5(c)(1)(C), 88 Stat at 1906.

That Commission examined the Internal Revenue Service’s (IRS) existing practice of disclosing individuals’ “name[s], address[es],” and “Social Security number[s]” “primarily to identify individuals who may have failed to file.” Priv. Prot. Study Comm’n, Federal Tax Return Confidentiality, at 46 (June 1976). The Commission concluded that there was “uncertainty” about the IRS’s privacy obligations, that the Privacy Act “would appear to constrain [the IRS’s] disclosure[] of data about taxpayers,” and that the IRS had continued such disclosures after the passage of the Act. Id. at 15. The Commission thus recommended “that the Congress permit the Internal Revenue Service to disclose the Social Security numbers of Federal taxpayers in a locality” in certain circumstances. Id. at 4. Congress thereafter amended the Internal Revenue Code to authorize this use of Social Security numbers and implement the Commission’s recommendation. Tax Reform Act of 1976, Pub. L. No. 94–455, § 1211(c), 90 Stat. 1520, 1712

54

(codified as amended at 26 U.S.C. § 6109(a), (d)). Indeed, since the enactment of the Privacy Act, Congress has consistently employed express statutory authorizations when it permits disclosure or use of Social Security numbers for verification purposes. Lawyers Defending American Democracy Amicus Br. 12–13 (collecting statutes), ECF No. 87. These provisions would be superfluous if the Federal Defendants were correct and SSNs were not subject to the non- disclosure requirements of the Privacy Act. The Court declines to adopt such an interpretation. Nielsen v. Preap, 586 U.S. 392, 414 (2019) (recognizing that courts generally do not construe statutes such that they cause other statutory provisions “to have no consequence” (quoting Antonin Scalia & Bryan A. Garner, Reading Law: The Interpretation of Legal Texts 174 (2012))).

The Federal Defendants next argue that sharing SSA records to verify U.S. citizenship for voting is a proper routine use because government agencies have widely used the Social Security number as a “means of identifying and gathering information about an individual.” Fed Defs.’ Mot. 58 (citation omitted). But this is irrelevant, as it does not go to why a Social Security number and the accompanying information were “collected” in the first place. 5 U.S.C. § 552a(a)(7). The routine-use inquiry looks to whether the disclosure is “compatible with the purpose for which [the record] was collected.” Id. And the Defendants fail to explain why the federal government’s collection of private information to assess Social Security benefits has any nexus to state governments’ voter verification efforts.

Finally, the Defendants ask this Court to defer to an OMB interpretation, promulgated over a decade after the Privacy Act was enacted, stating that a routine use encompasses any use that the Executive considers “necessary and proper.” Texas Mot. 29 (citing OMB, Guidance on the Privacy Act, 52 Fed. Reg. 12,990, 12,993 (Apr. 20, 1987)); Fed. Defs.’ Mot. 57 (same). The Defendants concede that the OMB interpretation is less “searching” than the widely accepted interpretation of

55

the Privacy Act “articulated by the Third Circuit and cited approvingly by the D.C. Circuit” and other courts nationwide, see Tex. Mot. 29, but they advance it, nonetheless. It is hard to understand how this argument could survive the Supreme Court’s recent instruction to not afford blind deference to agency interpretations. See generally Loper Bright Enters. v. Raimondo, 603 U.S. 369 (2024); see also USPS v. Nat’l Ass’n of Letter Carriers, 9 F.3d 138, 148–49 (D.C. Cir. 1993) (Randolph, J., dissenting) (suggesting that the prior regime of “judicial deference” to agency interpretations of the Privacy Act has allowed “the federal government [to] cede[]—lock, stock and barrel—its statutory responsibility under the Privacy Act to preserve the confidentiality of records pertaining to individuals”). And regardless, the statute does not contain the sort of ambiguity that would previously have invited such deference—“the term ‘routine use’ means, with respect to the disclosure of a record, the use of such record for a purpose which is compatible with the purpose for which it was collected.” 5 U.S.C. § 552a(a)(7). Indeed, the Defendants fail to identify any language in the statute that supports interpreting the routine-use exception to mean any use designated “necessary and proper” by the Executive Branch. See Texas Mot. 29; Fed. Defs.’ Mot. 57.

Without question, it is the duty of Congress, not federal agencies, to determine what is “necessary and proper for carrying into [e]xecution” other enactments. Art. I, § 8, cl. 18. Congress determined that “it is necessary and proper for the Congress” itself, not agencies, “to regulate the collection, maintenance, use, and dissemination of information” “to protect the privacy of individuals identified in information systems maintained by Federal agencies.” Privacy Act of 1974 § 2(a)(5), 88 Stat. at 1896 (codified at 5 U.S.C. § 552a note). And Congress provided that it is the duty of federal agencies to not disclose records for any purpose not “compatible with the purpose for which [the record] was collected.” 5 U.S.C. § 552a(a)(7), (b)(3). SSA’s disclosure of

56

Social Security numbers and associated information that SSA collected to DHS and states for voter verification is not such a “compatible” use.

Meanwhile, Texas argues that the disclosure is authorized under another exception altogether—the law enforcement exception in 5 U.S.C. § 552a(b)(7). That exception permits disclosure for law enforcement “within or under the control of the United States” when “the head of the agency or instrumentality has made a written request to the agency which maintains the record specifying the particular portion desired and the law enforcement activity for which the record is sought.” Id.; Texas Mot. 29–30. As the Plaintiffs correctly point out, there is no suggestion that any such request was made. See Pls.’ Opp’n 19. Texas does not dispute this point and candidly admits that the “Plaintiff[s] identified several errors in Texas’s Motion.” Texas Reply 1 n.1. So this argument is unavailing as well. The Federal Defendants clearly violated the Privacy Act’s non-disclosure bar by disclosing SSA records to DHS and SAVE users (including states) without the consent of the Plaintiffs’ members. See 5 U.S.C. § 552a(b).

3. Procedural Claims

Next, the Plaintiffs argue that the establishment of the modified SAVE system outlined in the 2025 SORNs without notice and comment violates the Privacy Act’s procedural protections. Pls.’ Mot. 38–44. The Court agrees.

The Privacy Act requires notice and comment at least thirty days in advance of a “new use or intended use of the information” in a system of records. 5 U.S.C. § 552a(e)(11). The statute further requires the publication of a SORN “upon establishment or revision” of such a system. Id. § 552a(e)(4). Undoubtedly, SAVE is a system of records under the statute—a fact that DHS has

57

acknowledged in at least eight SORNs,13 and in a May 2025 agreement governing data sharing between DHS and SSA, DHS AR 420–31. At a prior stage of these proceedings, the Federal Defendants even conceded that the 2025 modifications to SAVE were substantial enough that the Privacy Act would require notice if it covered SAVE. Mot Hr’g Tr. 69:21–24.

Yet the Defendants failed to publish SORNs at least thirty days before overhauling SAVE.

They instead launched the modified SAVE system without a SORN on May 22, 2025. See DHS AR 491; DHS AR 493; DHS AR 1385. And they continued the new uses for five months before DHS issued a SORN on October 31, 2025, and SSA issued a SORN on November 12, 2025. See Notice of a Modified System of Records, 90 Fed. Reg. at 48,948 (DHS AR 114); Notice of a Modified System of Records, 90 Fed. Reg. at 50,879–80 (SSA AR 206–07). Further, the SORNs—when eventually published—had some curious features. The DHS SORN made clear that the modification was already “effective upon publication”; that relevant individuals could “[s]ubmit comments on or before December 1, 2025”; and that “[n]ew or modified routine uses w[ould] be effective December 1, 2025,” regardless. Notice of a Modified System of Records, 90 Fed. Reg. at 48,949 (DHS AR 115).

The Plaintiffs argue that the establishment of the modified SAVE system as described in the 2025 SORNs—as well as the SORNs themselves—violated a long line of D.C. Circuit cases holding that an opportunity to comment must be “meaningful,” Rural Cellular Ass’n v. FCC, 588 F.3d 1095, 1101 (D.C. Cir. 2009), and that a postponed opportunity for notice and comment can

13 See Notice of Modified System of Records, 85 Fed. Reg. at 31,798 (DHS AR 108); DHS USCIS–004 SAVE Program System of Records, 81 Fed. Reg. at 78,619; DHS USCIS—004— SAVE Program System of Records, 77 Fed. Reg. at 47,415; USCIS–004 Verification Information System of Records Notice, 73 Fed. Reg. at 75,445; USCIS VIS System of Records Notice, 73 Fed. Reg. at 10,793; Privacy Act: VIS Records Notice, 72 Fed. Reg. at 17,569; Privacy Act of 1974 System of Records, 67 Fed. Reg. at 64,134; Privacy Act of 1974 System of Records, 66 Fed. Reg. at 46,812.

58

have a “curative effect depend[ing] on the agency’s mind remaining open enough at [that] later stage,” McLouth Steel Prods. Corp. v. Thomas, 838 F.2d 1317, 1323 (D.C. Cir. 1988). Undoubtedly, the Federal Defendants’ process was anything but open-minded. The DHS SORN made clear that the modifications to SAVE were immediately effective and that new uses would go into effect automatically on December 1, 2025, on the last day that comments were still being solicited. See Notice of a Modified System of Records, 90 Fed. Reg. at 48,949 (DHS AR 115). And the SSA SORN added the disclosure of Social Security numbers to DHS as a new routine use long after SSA had already begun such disclosures, offering no opportunity for benefits applicants and concerned persons to offer comments prior to the sharing of their data. See DHS AR 431 (May 2025 agreement authorizing disclosure of records); Notice of a Modified System of Records, 90 Fed. Reg. at 50,880 (SSA AR 207) (notice of new routine use on November 12, 2025). The SAVE notice and comment process thus provided little opportunity for meaningful input and consideration of comments.

The Defendants argue that the line of D.C. Circuit precedents upon which the Plaintiffs rely was overturned by the Supreme Court’s recent instruction in Little Sisters of the Poor Saints Peter & Paul Home v. Pennsylvania that “the APA imposes no general ‘open-mindedness’ requirement on agencies beyond the statute’s specific ‘objective criteria.’” Bahman Grp. v. Palluconi, No. 22-cv-3826, 2025 WL 3225196, at *5 (D.D.C. Sep. 29, 2025) (quoting Little Sisters of the Poor Saints Peter & Paul Home v. Pennsylvania, 591 U.S. 657, 685 (2020)); Fed. Defs.’ Mot. 55; Texas Mot. 30–31. But Little Sisters was just an application of the “general proposition that courts are not free to impose upon agencies specific procedural requirements that have no basis in the APA.” Little Sisters, 591 U.S. at 685 (quoting Pension Benefit Guar. Corp. v. LTV Corp., 496 U.S. 633, 654 (1990)). That rule has little relevance here.

59

Indeed, in Little Sisters, the lower court held that an agency failed to maintain an open mind when its “final rules” were “virtually identical” to their pre-comment counterparts. Id. (citation omitted). The Supreme Court recognized that the APA, among other things, “requires that final rules must be published 30 days before they become effective” and that “interested persons” must be provided an opportunity to comment. Id. at 685–86. There, the rules at issue “were published on November 15, 2018, [and] did not become effective until January 14, 2019—more than 30 days after being published” and subject to comment. Id. at 686. Since the agency “complied with . . . these statutory procedures,” the Supreme Court ruled that the lower court erred in “impos[ing] judge-made procedures in addition to the APA’s mandates” by requiring the agency to “maintain[] an open mind” as well. Id. at 684–86 (cleaned up).

Here, unlike in Little Sisters, SAVE’s “modified system [was] effective upon publication”

of the SORNs, and public comment was permitted only after the modified SAVE system was implemented. Notice of a Modified System of Records, 90 Fed. Reg. at 48,949 (DHS AR 115); see also Notice of a Modified System of Records, 90 Fed. Reg. at 50,880 (SSA AR 207). This is flatly inconsistent with the Privacy Act’s statutory requirement that “notice of any new use or intended use of the information in the system” and “an opportunity” for comment must be provided “at least 30 days prior” to the final SORN. 5 U.S.C.§ 552a(e)(11). And a final SORN must be published “subject to the provisions” of the Act requiring notice and comment. Id. § 552a(e)(4). The SSA and DHS SORNs—as well at the modified SAVE system they describe—fail to meet these statutory requirements because they were never preceded by proposed revision notice and comment periods “30 days prior.” Id. § 552a(e)(11). Unlike in Little Sisters where the final rule was promulgated “more than 30 days after” they were proposed, the 2025 SORNs at issue here

60

were not in compliance with the “procedural requirements that Congress”—not the courts— established. Little Sisters, 591 U.S. at 686 (cleaned up).

“The Privacy Act’s public notice and comment structure is an essential component of the Act and an essential piece of American democracy. Americans deserve to know the nature, scope, and routine uses of the records before they are collected by the federal government.” Weber, 816 F. Supp. 3d at 1193 (emphasis added); see also Privacy Act of 1974 § 2(b)(1), 88 Stat. at 1896 (noting the Privacy Act’s protections seek to “permit an individual to determine what records pertaining to him are collected, maintained, used, or disseminated by such agencies”). Indeed, “[i]t is flatly inconsistent with the text, structure, and purpose of the Privacy Act for an agency to initiate a major new data-sharing program affecting the sensitive data of millions of Americans, then validate that program as a ‘routine use’ months after it has begun.” League of United Latin Am. Citizens, 818 F. Supp. 3d at 115–16. These requirements were imposed by Congress—they are not “judge-made.” Little Sisters, 591 U.S. at 685 (quoting Perez v. Mortg. Bankers Ass’n, 575 U.S. 92, 102 (2015)).

Assuming that the Federal Defendants are correct and Little Sisters abrogated the D.C.

Circuit’s use of the open-mindedness test, the Federal Defendants are no better off. The open- mindedness test is at best a “judge-made procedur[e]” to excuse failure to comply with statutory obligations. Id. at 685 (quoting Mortg. Bankers Ass’n, 575 U.S. at 102). Without it, there is no basis to conclude that the Federal Defendants may ever use “additional commentary” to excuse failure to provide notice “without actual suspension of the [agency action] in question.” Forester v. Consumer Prod. Safety Comm’n, 559 F.2d 774, 788 n.19 (D.C. Cir. 1977). Thus, since the Federal Defendants have neither shown compliance with the open-mindedness test nor the Privacy

61

Act’s notice and comment requirements, 5 U.S.C. § 552a(e)(11), they have acted “without observance of procedure required by law,” 5 U.S.C. § 706(2)(D).14 E. The Administrative Procedure Act The Plaintiffs also argue that the establishment of the SAVE modified system was arbitrary and capricious under the APA, 5 U.SC. § 706(2)(A). Pls.’ Mot. 40–44. The Court is persuaded.

The APA “requires agencies to engage in reasoned decision-making” and “to reasonably explain to reviewing courts the bases for the actions they take and the conclusions they reach.” Bhd. Of Locomotive Eng’rs v. Fed. R.R. Admin., 972 F.3d 83, 115 (D.C. Cir. 2020) (quoting DHS v. Regents of the Univ. of Cal. (Regents), 591 U.S. 1, 16 (2020)). To do so, an agency must “examine the relevant data and articulate a satisfactory explanation for its action.” FCC v. Fox Television Stations, Inc., 556 U.S. 502, 513 (2009) (quoting Motor Vehicle Mfrs. Ass’n of U.S. v. State Farm Mut. Auto. Ins. Co., 463 U.S. 29, 43 (1983)). Agency action is arbitrary and capricious if it “has relied on factors which Congress has not intended it to consider, entirely failed to consider an important aspect of the problem, offered an explanation for its decision that runs counter to the evidence before the agency, or is so implausible that it could not be ascribed to a difference in view or the product of agency expertise.” State Farm, 463 U.S. at 43.

14 The Defendants claim that the comment period provided by the SORNs render the notice-and-comment claim moot and suggest that the Plaintiffs must establish standing for each component of the modified SORN (i.e., bulk searches). See Fed. Defs.’ Mot. 33; Texas Reply 6–7. But the Plaintiffs’ notice-and-comment claim is not moot because notice and comment is required “prior to” the new use. 5 U.S.C. § 552a(e)(11). The Plaintiffs have shown procedural standing to challenge the agency action—the 2025 SORNs and the modified SAVE detailed in the 2025 SORNs—which the record shows affected their privacy disclosure and voter registration interests. That injury is not moot. The Defendants’ point about each component of the modified SORN perhaps goes to severability. But that is an issue that was not properly raised before this Court and is thus conceded.

62

Importantly, this “standard demands that an agency give a reasoned justification for its decision to alter an existing regulatory scheme,” Farmers Union Cent. Exch., Inc. v. FERC, 734 F.2d 1486, 1500 (D.C. Cir. 1984), a principle known as the “change-in-position doctrine,” FDA v. Wages & White Lion Invs., L.L.C., 604 U.S. 542, 568 (2025). “An agency may not, for example, depart from a prior policy sub silentio or simply disregard rules that are still on the books.” Fox Television, 556 U.S. at 515 (citing United States v. Nixon, 418 U.S. 683, 696 (1974)). “And of course the agency must show that there are good reasons for the new policy.” Id. Under the doctrine, agencies are “free to change their existing policies as long as they provide a reasoned explanation for the change, display awareness that they are changing position, and consider serious reliance interests.” Wages & White Lion Invs., 604 U.S. at 568 (cleaned up).

Here, the Federal Defendants concede that they changed position, but they stress that they expressed awareness of the change through press releases. Fed. Defs.’ Mot. 56. But by failing to engage in notice and comment when “expanding the scope” of the SAVE program, the Federal Defendants neither “consider[ed] serious reliance interests” nor considered opposing views. Fox Television, 556 U.S. at 515,517. Indeed, the “central object of requiring that the public be afforded notice and an opportunity to comment is to assure that the agency fully understands the potential impact of a proposed rule before finalizing it. Public notice and comment, that is, might alter an agency’s initial assumptions about whether (and how) a proposed rule affects the public at large.” City of Billings v. TSA, 153 F.4th 46, 53 (D.C. Cir. 2025). By changing their position without the statutorily required notice and comment, the Federal Defendants both failed to consider “factors which Congress . . . intended [them] to consider” (i.e., the “written data, views, or arguments” of impacted persons, 5 U.S.C. § 552a(e)(11)), and they “entirely failed to consider an important aspect of the problem” (i.e., the reliance interests of persons who had provided information to SSA

63

or failed to update SSA data without knowledge of how it would now be used). State Farm, 463 U.S. at 43. Even “[s]tanding alone, a notice and comment violation establishes that the government’s conduct was arbitrary and capricious.” See In re Long-Distance Tel. Serv. Fed. Excise Tax Refund Litig., 751 F.3d 629, 637 (D.C. Cir. 2014).

Furthermore, even if the Federal Defendants later considered comments in response to the modified SORNs, those comments could not provide a “reasoned explanation for the change” that the Federal Defendants undertook. Wages & White Lion Invs., 604 U.S. at 568 (citation omitted). Indeed, an agency’s “explanation ‘must be viewed critically’ to ensure that the [change] is not upheld on the basis of impermissible ‘post hoc rationalization.’” Regents, 591 U.S. at 21 (quoting Citizens to Pres. Overton Park, Inc. v. Volpe (Overton Park), 401 U.S. 402, 420 (1971)). “It is a ‘foundational principle of administrative law’ that judicial review of agency action is limited to ‘the grounds that the agency invoked when it took the action.’” Id. at 20 (quoting Michigan v. EPA, 576 U.S. 743, 758 (2015)). This is mandated by the APA’s instruction to consider “the ‘whole record’” before the agency when engaging in judicial review. Overton Park, 401 U.S. at 419 (quoting 5 U.S.C. § 706). Since the Federal Defendants implemented the SAVE modified system in May 2025, the explanations in the 2025 SORNs and the comments received thereafter are not properly before the Court because they postdate the decision to implement the challenged program. And without the statutorily mandated comments, the Federal Defendants were unable to “assess whether there were reliance interests, determine whether they were significant, and weigh any such interests against competing policy concerns.” Regents, 591 U.S. at 33. To state the obvious, this was arbitrary and capricious. Id.

Since the Federal Defendants are unable to rely on “belated justifications” to explain their failure to comply with the procedural requirements of the APA and Privacy Act, they must “deal

64

with the problem afresh” should they wish to implement any SAVE modifications not barred by the substantive provisions of the Privacy Act or Social Security Act. Id. at 21, 23 (first quoting SEC v. Chenery Corp. (Chenery I), 318 U.S. 80, 94 (1943); and then quoting SEC v. Chenery Corp. (Chenery II), 332 U.S. 194, 201 (1947)). In the words of the Supreme Court:

The Government . . . protests that requiring a new decision before considering . . .

new justifications would be “an idle and useless formality.” Procedural requirements can often seem such. But here the rule serves important values of administrative law. Requiring a new decision before considering new reasons promotes “agency accountability[]” by ensuring that parties and the public can respond fully and in a timely manner to an agency’s exercise of authority.

Id. at 23 (citations omitted). Accordingly, this Court must vacate the modified SAVE system and the Federal Defendants “must comply with the procedural requirements for new agency action.” Id. at 21. That means revising SAVE or authorizing any other “new use or intended use of the information in the system” only after engaging in notice and comment. 5 U.S.C. § 552a(e)(11).

Finally, the Federal Defendants argue that they are not required to comply with the APA’s arbitrary and capricious procedural requirement because:

Unlike for an APA rulemaking . . . —which starts with a notice of proposed rulemaking and ends with a final rule—a Privacy Act SORN publication does not end with any agency obligation to state “in the rules adopted a concise general statement of their basis and purpose.” 5 U.S.C. § 553(c). So arbitrary-and-capricious review—which is typically based on the quality and the content of the agency’s explanation in that “statement” of the final rule’s “basis and purpose,” id.—does not make sense in this . . . context.

Fed. Defs.’ Mot. 54 (emphasis omitted). But this argument is not supported by the text of the APA. The arbitrary-and-capricious principle is laid out in Section 706 of the APA, not Section 553(c). And the argument has also been rejected by the Supreme Court. See Overton Park, 401 U.S. at 417–21 (holding that an agency that was exempt from making findings under Section 553(c) due to exclusion in Section 553(a)(2) was nevertheless subject to arbitrary- and-capricious review, with review focusing on the “whole record” before the agency when it took the decision).

65

“Justice Holmes famously wrote that ‘men must turn square corners when they deal with the Government.’ But it is also true, particularly when so much is at stake, that the Government should turn square corners in dealing with the people. The basic rule here is clear . . . [t]his is not the case for cutting corners to allow DHS to rely upon reasons absent from its original decision.” Regents, 591 U.S. at 24 (cleaned up).

F. Other Statutes Having flunked compliance with the Social Security Act, the Privacy Act, and the APA, the Defendants look to other statutes to justify the establishment of the modified SAVE system. They contend that even if the agency action violates the Social Security Act, the Privacy Act, or the APA, it is nevertheless authorized by provisions of the Immigration Reform and Control Act of 1986 (1986 Act), Pub. L. No. 99–603, 100 Stat. 3359, and the Illegal Immigration Reform and Immigrant Responsibility Act of 1996 (1996 Act), Pub. L. No. 104–208, 110 Stat. 3009–546. Fed. Defs.’ Mot. 45–53; Texas Mot. 25–27. This argument is not a winner either.

Start with this: The Defendants are effectively arguing that the 1986 Act and the 1996 Act displace or supersede the relevant provisions of the Social Security Act, the Privacy Act, and the APA. But that argument runs contrary to the “strong presumption that repeals by implication are disfavored and that Congress will specifically address pre-existing law when it wishes to suspend its normal operations in a later statute.” Epic Sys. Corp. v. Lewis, 584 U.S. 497, 510 (2018) (cleaned up). When interpreting statutory provisions that appear to be in tension, a court “must . . . strive to give effect to both” and is not at “liberty to pick and choose among” them. Id. (quoting Morton v. Mancari, 417 U.S. 535, 551 (1974)). A court will only imply otherwise “if there is a ‘positive repugnancy’ between overlapping statutes,” and even then, the court must cure such a conflict only “to the extent of the repugnancy.” United States v. Philip Morris Inc. 263 F. Supp. 2d

66

72, 76 (D.D.C. 2003) (quoting United States v. Borden Co., 308 U.S. 188, 198–99 (1939)). Thus, courts find implied repeals only in cases where: (1) “two statutes are in ‘irreconcilable conflict,’” or (2) “the latter Act covers the whole subject of the earlier one and ‘is clearly intended as a substitute.’” Branch v. Smith, 538 U.S. 254, 273 (2003) (Scalia, J.) (quoting Posadas v. Nat’l City Bank, 296 U.S. 497, 503 (1936)).

The Federal Defendants argue that applying this canon runs contrary to the understanding that “statutes enacted by one Congress cannot bind a later Congress, which remains free to repeal the earlier statute, to exempt the current statute from the earlier statute, to modify the earlier statute, or to apply the earlier statute but as modified.” Fed. Defs.’ Mot. 49 (quoting Dorsey v. United States, 567 U.S. 260, 274 (2012)). But this argument misapprehends the basis of the presumption against implied repeals. The presumption is founded on the principle that:

Since laws are presumed to be passed with deliberation, and with full knowledge of existing ones on the same subject, it is but reasonable to conclude that the legislature, in passing a statute, did not intend to interfere with or abrogate any former law relating to the same matter, unless the repugnancy between the two is irreconcilable.

Scalia & Garner, Reading Law 328 (citation omitted). Undoubtedly then, requiring a “clear[] statement” for implied repeals does not in any way impair Congress’ authority to undo or modify its predecessors’ actions but merely “reflect[s] ‘common sense as to the manner in which Congress is likely’” to do so. See Biden v. Nebraska, 600 U.S. 477, 511 (2023) (Barrett, J., concurring) (quoting FDA v. Brown & Williamson Tobacco Corp., 529 U.S. 120, 133 (2000)).

Here, the Defendants have failed to meet their “heavy burden of showing” that the statutes they cite and the Privacy Act “cannot be harmonized.” Epic Sys. Corp., 584 U.S. at 510. Indeed, none of the provisions that the Defendants cite support their proposition.

The Defendants first point to the 1986 Act, which provides that DHS “shall implement a system for the verification of immigration status under paragraphs (3) and (4)(B)(i) of

67

section 1137(d) of the Social Security Act (as amended by this section) so that the system is available to all the States.” § 20(c)(1), 100 Stat. at 3391 (codified at 42 U.S.C. § 1320b–7 note). But this provision, alongside its cross-references, has little relevance to this case. Section 1137(d) governs “income and eligibility verification,” “documentation,” and “denial of benefits” under the Social Security Act. 42 U.S.C. § 1320b–7(d). Paragraph (3) provides that “the State shall utilize the individual’s alien file or alien admission number to verify with [DHS] the individual’s immigration status through an automated or other system” when a non-citizen or non-national applies for certain benefits. Id. § 1320b–7(d)(3). It is expressly limited to benefits applications for applicants who are “not a citizen or national of the United States” and makes no reference to using a Social Security number as opposed to “the individual’s alien file or alien admission number.” Id. § 1320b–7(d)(2), (3). Paragraph (4)(B)(i) provides that if a State finds that a non-citizen has other documentation which “constitutes reasonable evidence” that he is eligible for benefits, then the State must provide “photostatic or other similar copies of such documents, or information from such documents, as specified by [DHS], for official verification.” Id. § 1320b–7(4)(B)(i).

While SAVE was originally established to effectuate the 1986 Act’s benefit-verification provisions, DHS AR 420, these provisions govern benefits, not voter eligibility. And nothing in the 1986 Act suggests that any resulting system could not be harmonized with the protections in the Privacy Act. To the contrary, the 1986 Act expressly amended the Social Security Act to ensure that the “automated or other system . . . protects the individual’s privacy to the maximum degree possible.” § 121(d)(3)(B), 100 Stat. at 3385 (codified at 42 U.S.C. § 1320b–7(d)(3)(B)).

Next, the Defendants rely on a provision in the 1996 Act that provides that DHS “shall respond to an inquiry by a Federal, State, or local government agency, seeking to verify or ascertain the citizenship or immigration status of any individual within the jurisdiction of the agency for any

68

purpose authorized by law, by providing the requested verification or status information.” 8 U.S.C. § 1373(c). The Federal Defendants argue that this provision authorizes the modified SAVE and permits DHS to verify citizenship in any manner that it sees fit—notwithstanding prior statutory limitations on inter-agency data sharing and disclosure of private information. See Fed. Defs.’ Mot 46–49. But such a reading is inconsistent with normal rules of statutory interpretation.15 “[N]o statute pursues any single purpose at all costs,” and courts no longer depart from a statute’s ordinary meaning merely to effectuate the executive’s claim that doing so would merely help it “make effective a statute’s purpose.” See Medina v. Planned Parenthood S. Atl., 606 U.S. 357, 368 (2025) (cleaned up). Rather, “[i]t is a fundamental canon of statutory construction that the words of a statute must be read in their context and with a view to their place in the overall statutory scheme.” West Virginia v. EPA, 597 U.S. 697, 721 (2022) (quoting Davis v. Mich. Dep’t of Treasury, 489 U.S. 803, 809 (1989)).

“Context is not found exclusively within the four corners of a statute”; “[b]ackground legal conventions, for instance, are part of the statute’s context.” Nebraska, 600 U.S. at 512 (Barrett, J., concurring) (cleaned up). One such convention is that the 1996 Act should not be read to impliedly amend or repeal the Privacy Act’s protections unless it “expressly contradicts” those protections or “such a construction is absolutely necessary in order [for] the words” of the 1996 Act to “have any meaning at all.” Nat’l Ass’n of Home Builders v. Defs. of Wildlife, 551 U.S. 644, 662–63

15 Because the Defendants lack a basis for their actions based on the plain meaning of the statutes that they cite, the Court does not address whether they would also satisfy the “clear statement” rule of the major questions doctrine—should that rule apply in this context. See Biden v. Nebraska, 600 U.S. 477, 505–06 (2023); but see Louis J. Capozzi III, Biden v. Nebraska and the Continued Refinement of the Major Questions Doctrine, Harv. J.L. & Pub. Pol’y: Per Curiam, Summer 2024 No. 13, at 6–7 (suggesting that an action is politically significant for purposes of the major questions doctrine if it raises concerns that the Executive is using vague terms to “try to enact policies circumventing Congress,” especially on an issue of ongoing public debate).

69

(2007) (cleaned up); see also id. at 664 n.8 (“[W]e have repeatedly recognized that implied amendments are no more favored than implied repeals.”). As evidenced by the record before this Court, the Federal Defendants do not need to depart from the Privacy Act’s procedural requirements or its substantive protections to verify citizenship requests. Indeed, since the 1996 Act’s passage, the Federal Government has never needed SSA data or to depart from Privacy Act procedures to verify citizenship requests. See supra Bkd. (noting that SAVE did not access SSA data until 2025). Furthermore. the ordinary meaning of “verify ‘is “to establish the truth, accuracy, or reality of” something. Verify, Merriam Webster’s Collegiate Dictionary (10th Ed. 1996); see also Verification, Merriam Webster’s Collegiate Dictionary (10th Ed. 1996) (“the act or process of verifying”; “the state of being verified”). And the record shows that the modified SAVE has caused inaccurate rather than accurate matching of citizenship data. See, e.g., DHS AR 240 (finding “risk” that the modified SAVE “may share inaccurate information with registered agencies”); DHS AR 260 (recognizing the modified SAVE’s “[s]hortfalls in data accuracy”); DHS AR 302 (same); SSA AR 44 (“[C]itizenship information in SSA’s records might not be current.”). Simply put, there is no reason to believe that an implied repeal or amendment of the protections of the Privacy Act or Social Security Act is “absolutely necessary” for the verification provisions in Section 1373(c) to have any effect. Mittleman v. Postal Regul. Comm’n, 757 F.3d 300, 306 (D.C. Cir. 2014) (quoting Nat’l Ass’n of Home Builders, 551 U.S. at 662–63).

Finally, the Defendants argue that Section 1373(a) of the 1996 Act authorized the establishment of the modified SAVE system of records. See Fed Defs.’ Mot. 45–46. That provision states: “Notwithstanding any other provision of Federal, State, or local law, a Federal, State, or local government entity or official may not prohibit, or in any way restrict, any government entity or official from sending to, or receiving from, [DHS] information regarding the citizenship or

70

immigration status, lawful or unlawful, of any individual.” 8 U.S.C. § 1373(a). But prohibitory language such as “shall not” or “may not” is generally not read as an “an affirmative grant of power.” See New England Power Co. v. New Hampshire, 455 U.S. 331, 341 (1982). Nothing in this provision permits the Federal Defendants to create a new system of records with complete disregard for the Privacy Act’s protections. Indeed, the “Executive Branch interpretation . . . issued roughly contemporaneously with enactment of the statute” and “the longstanding ‘practice of the government’” since the 1996 Act’s enactment confirms that this is not the case. Loper Bright, 603 U.S. at 386 (quoting NLRB v. Noel Canning, 573 U.S. 513, 525 (2014)); see Relationship Between Illegal Immigr. Reform & Immigrant Resp. Act of 1996 & Statutory Requirement for Confidentiality of Census Info., 23 Op. O.L.C. (May 18, 1999) (slip op. at 6), 1999 WL 34995963 (recognizing that Section 1373(a) does “not clearly invest governmental officials or entities with the affirmative authority to disclose information in circumstances where they otherwise would be prohibited from doing so by a federal statute”); see supra Bkd. (explaining that DHS complied with the Privacy Act in instituting SAVE up until 2025). Simply put, Section 1373(a) does not on its own authorize the establishment of the SAVE modified system—it is merely a prohibition on conduct.

Moreover, “the overall statutory scheme” of the 1996 Act also does not support the Defendants’ interpretation. West Virginia, 597 U.S. at 721 (quoting Davis, 489 U.S. at 809). For instance, another provision of the 1996 Act authorizes SSA to “compare[] the name and social security account number provided in an inquiry” to its own files, but only “to confirm (or not confirm) the validity of the information provided regarding an individual whose identity and employment eligibility must be confirmed,” and only as part of a temporary employment verification pilot program (E-Verify) that, among others, states and the “Department[s] of the

71

Federal Government shall elect to participate in.” §§ 402(e)(1)(A)(i), 404(e), 110 Stat. at 658, 665 (codified at 8 U.S.C. § 1324a note). Importantly, that temporary “system” does not permit SSA to “disclose or release social security information (other than such confirmation or nonconfirmation)” and prohibits SSA from “utiliz[ing] any information, data base, or other records” in the program “for any other purpose.” Id. § 404(e), (h)(1), 110 Stat. at 3009–665. The 1996 Act also provides that the authorization for this matching system would be temporary and only last a “4-year period.” Id. § 401(b), 110 Stat. at 3009–655–56 (codified at 8 U.S.C. § 1324a note).16 The 1996 Act’s authorization for limited Social Security number verification for employment purposes only, its strict controls on what SSA information can be accessed and how it is used, and the limited program duration would make little sense if another provision of that same Act, e.g., Section 1373(a) or (c), already authorized SSA to share any of its records regardless of any other law, as the Defendants suggest. Cf. 1986 Act § 101(a), 100 Stat. at 3361–65 (codified as amended at 8 U.S.C. § 1324a(b), (d)) (establishing that, like voter eligibility, the Federal Government is also authorized to verify employment eligibility of non-citizens). Courts generally presume that Congress does not enact such “surplusage.” Preap, 586 U.S. at 414 (recognizing that courts are hesitant to adopt an interpretation that “causes [a provision] to duplicate another provision” (quoting Scalia & Garner, Reading Law 174)). And “[w]here Congress uses certain language in one part of a statute and different language in another, it is generally presumed that Congress acts intentionally.” Nat’l Fed’n of Indep. Bus. v. Sebelius, 567 U.S. 519, 544 (2012). Here, the statutory scheme of the 1996 Act shows that “Congress knew how to” permit Social Security number verification “when it wanted to” and chose not to in Section 1373(a) or (c). Allina Health Servs. v.

16 Congress has since extended the deadline for termination of that program to September 30, 2026. Consolidated Appropriations Act of 2026, Pub. L. No. 119–75, § 5014, 140 Stat. 173, 631 (codified at 8 U.S.C. § 1324a note).

72

Price, 863 F.3d 937, 944 (D.C. Cir. 2017) (Kavanaugh, J.). None of the provisions that the Defendants cite support the overhaul of SAVE.

G. Comity and Equitable Considerations Finally, the Defendants ask this Court to deny relief to the Plaintiffs based on “principles of equity and comity”; entering a judgment for the Plaintiffs, they say, may interfere with consent decrees entered during this litigation in other federal courts while this litigation was ongoing. See Fed. Defs.’ Mot. 62. The Court is not convinced for two reasons.

First, the Defendants’ argument necessarily requires this Court to construe the Defendants’

consent decrees before other courts—something that this Court lacks the authority to do. See Martini v. Republic Steel Corp., 532 F.2d 1079, 1081 (6th Cir. 1976) (“As to those counts of appellants’ complaint which allege that the consent decree is not being properly implemented we note that . . . [t]he consent decree applies nationwide, but principles of comity certainly require that these issues be raised before the court which granted the decree.”). This alone is a basis to reject the Defendants’ argument.

Second, even if it were a proper consideration, comity does not favor dismissing or abstaining in this circumstance. “[T]he doctrine of federal comity . . . permits one federal district court to defer to the jurisdiction of another federal district court on an issue properly before the latter court in order to avoid unnecessarily burdening the federal judiciary and delivering conflicting judgments.” Beck v. U.S. DOJ, No. 88-cv-3433, 1991 WL 519827, at *5 (D.D.C. Jan. 31, 1991) (citing Kerotest Mfg. Co. v. C–O–Two Fire Equipment Co., 342 U.S. 180 (1952)). The doctrine applies most readily “where previously-filed litigation is brought promptly to the attention of the district court” and comity considerations are asserted early in litigation. See Church of Scientology of Cal. v. U.S. Dep’t of the Army, 611 F.2d 738, 750 (9th Cir. 1979), overruled on

73

other grounds by Animal Legal Def. Fund v. U.S. FDA, 836 F.3d 987, 989 (9th Cir. 2016) (per curiam). The Court’s decision is “equitable in nature,” with an eye towards “[w]ise judicial administration, giving regard to conservation of judicial resources and comprehensive disposition of litigation[.]” Kerotest Mfg., 342 U.S. at 183. And this Court has “ample . . . discretion” in assessing these interests, Stone & Webster, Inc. v. Ga. Power Co., 779 F.3d 614, 617 (D.C. Cir. 2015) (quoting Kerotest Mfg., 342 U.S. at 183–84), which “requires a balancing not of empty priorities but of equitable considerations genuinely relevant to the ends of justice,” Columbia Plaza Corp. v. Sec. Nat. Bank, 525 F.2d 620, 628 (D.C. Cir. 1975) (quoting Polaroid Corp. v. Casselman, 213 F. Supp. 379, 381 (S.D.N.Y. 1962)). See Kline v. Burke Constr. Co., 260 U.S. 226, 229 (1922) (“The forbearance which courts of co-ordinate jurisdiction, administered under a single system, exercise towards each other . . . [has] perhaps no higher sanction than the utility which comes from concord[.]” (quoting Covell v. Heyman, 111 U.S. 176, 182 (1884))).

The Court doubts that judicial administration and efficiency warrant dismissing this case for comity reasons at this late stage of proceedings—where all Parties have briefed the merits and the Court is ready to enter final relief. Nor is it apparent that the Federal Defendants having entered a consent decree purportedly barring the very relief sought in this litigation while it was ongoing is consistent with the equitable considerations of clean hands, “good faith,” and the prevention of “forum shopping.” EEOC v. Univ. of Pa., 850 F.2d 969, 972, 979 (3d Cir. 1988), aff’d, 493 U.S. 182 (1990). The Court finds that equity would not bar this suit where the result would be “to circumvent” the APA action at issue. Id. at 978. Indeed, comity does not favor deferring to another forum when it is not “apparent that a remedy is available there”—and the Plaintiffs have no say in the consent decrees that the Federal Defendants enter in other districts. Mann Mfg., Inc. v. Hortex,

74

Inc., 439 F.2d 403, 408 (5th Cir. 1971) (quoting Lapin v. Shulton, Inc., 333 F.2d 169, 172 (9th Cir. 1964)).

Simply put, even if they were appropriately before the Court in these circumstances, the Defendants’ comity arguments are unavailing. See Emrick v. Bethlehem Steel Corp., 624 F.2d 450, 454 (3d Cir. 1980) (affirming the district court’s dismissal of a direct challenge to a consent decree for comity purposes but reversing the district court’s dismissal of other statutory claims merely because they may implicate the consent decree).

H. Constitutional Claims Finally, because this case can be resolved on a statutory basis, the Court does not reach the Plaintiffs’ constitutional claims. See Pls.’ Mot. 33. “[C]ourts ‘ought not to pass on questions of constitutionality unless such adjudication is unavoidable.’” United States v. Gaffney, 812 F. Supp. 3d 49, 81 (D.D.C. 2025) (quoting Matal v. Tam, 582 U.S. 218, 231 (2017)).

REMEDY

The APA mandates that a “reviewing court shall . . . hold unlawful and set aside agency action” that is in excess of statutory authority, contrary to law, unconstitutional, arbitrary and capricious, or procedurally defective. 5 U.S.C. § 706(2)(A)–(D) (emphasis added). Setting aside an agency action means “re-establish[ing] the status quo absent the unlawful agency action.” Las Ams. Immigrant Advoc. Ctr. v. U.S. DHS, 783 F. Supp. 3d 200, 233 (D.D.C. 2025) (citation omitted); see also Ctr. for Biological Diversity v. Haaland, No. 22-cv-3588, 2023 WL 5161741, at *7 (D.D.C. Aug. 11, 2023) (“The remedy of vacatur under the Administrative Procedure Act restores the prior regulatory status quo; the invalid rule is eliminated and replaced by any preexisting rule it had superseded.” (cleaned up)). Accordingly, the Court sets aside and vacates the 2025 DHS and SSA SORNs as unlawful. Notice of a Modified System of Records, 90 Fed. Reg. 48,948 (DHS AR 114–21); Notice of a Modified System of Records, 90 Fed. Reg. 50,879

75

(SSA AR 205–11). The Court further sets asides and vacates the SAVE “modified system” described in the 2025 DHS SORN. Notice of a Modified System of Records, 90 Fed. Reg. at 48,948 (DHS AR 114–21).

CONCLUSION

For the foregoing reasons, the Court grants the Plaintiffs’ Motion for Summary Judgment, ECF No. 66, and denies the Federal Defendants’ Motion to Dismiss (or in the alternative Motion for Summary Judgment), ECF No. 77, and the State of Texas’ Motion to Dismiss, ECF No. 97.

A separate order will issue.

SPARKLE L. SOOKNANAN

United States District Judge

Date: June 22, 2026