Matthew LeFande v. United States of America Bureau of Alcohol, Tobacco, Firearms and Explosives

• Court: District Court, E.D. Virginia
• Decided: March 20, 2026
• Docket: 1:24-cv-02311
• Status: Unknown

Opinion

IN THE UNITED STATES DISTRICT COURT FOR THE EASTERN DISTRICT OF VIRGINIA Alexandria Division

MATTHEW LEFANDE, ) ) Plaintiff, ) ) v. ) Civil Action No. 1:24-cv-2311 (RDA/LRV) ) UNITED STATES OF AMERICA ) BUREAU OF ALCOHOL, TOBACCO, ) FIREARMS AND EXPLOSIVES, ) ) Defendant. )

MEMORANDUM OPINION AND ORDER This matter comes before the Court on Defendant United States of America Bureau of Alcohol, Tobacco, Firearms and Explosives’s (“ATF”) Motion to Dismiss (the “Motion”) (Dkt. 8). This Court has dispensed with oral argument as it would not aid in the decisional process. See Fed. R. Civ. P. 78(b); Local Civil Rule 7(J). This matter is fully briefed and ripe for disposition. Considering the Complaint (Dkt. 1), Defendant’s Memorandum in Support (Dkt. 8), Plaintiff’s Opposition (Dkt. 12), and Defendant’s Reply (Dkt. 18), this Court GRANTS the Motion for the reasons that follow. I. BACKGROUND A. Factual Background1 Plaintiff Matthew LeFande is the founder, Training Director, Secretary and Treasurer of the Commonwealth Protection Institute (“CPI”), a non-stock corporation registered with the Virginia State Corporation Commission and an Internal Revenue Code 501(c)(3) Training School

1 For purposes of considering the Motion to Dismiss, the Court accepts all facts contained within the Complaint as true, as it must at the motion-to-dismiss stage. Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009); Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007). regulated by the Virginia Department of Criminal Justice Services. Dkt. 1 ¶ 12. Plaintiff formed CPI in 2005 and appointed two other persons and himself to the Board of Directors. Id. ¶ 13. Upon Plaintiff’s motion to the Board of Directors, Virginia resident Floyd Allen was appointed as CPI’s Executive Officer in 2005. Id. ¶ 14. Such appointment allowed Allen to act on behalf of

CPI, but only at the direction of the Board of Directors. Id. At that time, Plaintiff was appointed Secretary and Treasurer to CPI upon a unanimous vote of the CPI Board of Directors. Id. ¶ 15. As Secretary and Treasurer, Plaintiff was delegated complete authority and control over the books and accounts of the organization. Id. Such authority was unchanged as of the filing of the Complaint. Id. CPI holds an ATF Federal Firearms License (“FFL”). Id. ¶ 16. CPI is a Special Occupational Taxpayer, authorized by the ATF to manufacture and deal in firearms regulated by the National Firearms Act of 1934, Internal Revenue Code, Chapter 53 (the “NFA”). Id. ¶ 17. Plaintiff is CPI’s designated “responsible person.” Id. ¶ 18. Plaintiff has been the sole signatory to every transaction of CPI with ATF since its inception in 2005. Id. ¶ 21.

The eForms system is an internet portal maintained by ATF, which is used by Special Occupational Taxpayers to conduct transactions and notices required by the NFA. Id. ¶ 22. Use of the eForms system requires registration of individual users who then affiliate in the system as employees of FFL entities. Id. ¶ 23. Access to the portal is then controlled by usernames and passwords unique to the individual user. Id. The eForms login page warns that the unauthorized or improper use of the portal may result in civil or criminal penalties. Id. ¶ 24. Plaintiff registered with eForms and began using the current version of the portal in March 2022 based on his affiliation with CPI as its “responsible person.” Id. ¶ 25. On September 22, 2023, Plaintiff reported to the Prince William County Police that, on or about September 14, 2023, he had been assaulted by Jona Blocker, a woman he lived with at the time in Woodbridge, Virginia. Id. ¶ 26. On September 25, 2023, Plaintiff appeared before the Juvenile and Domestic Relations Court of Prince William County. Id. ¶ 27. On that date, the court

issued a Preliminary Protective Order against Blocker. Id. Sometime prior to March 22, 2024, Allen and Blocker added themselves as “responsible persons” to the CPI FFL, allegedly as part of an ongoing effort to wrest control of CPI away from Plaintiff and to retaliate for Plaintiff’s ongoing protective order proceedings. Id. ¶ 28. Allen was without authority from the CPI Board of Directors to take any act regarding the CPI FFL. Id. ¶ 29. Such authority was solely delegated to Plaintiff by CPI’s Board of Directors through his appointment as Secretary and Treasurer. Id. Blocker was not an officer or employee of CPI and is alleged to be a user of or addicted to a controlled substance. Id. ¶ 30. Upon Blocker’s addition to the CPI FFL, she contacted ATF, falsely claimed that she was a Director of CPI and that Plaintiff was “unavailable” to administer the ATF internet account for

CPI. Id. ¶ 31. Plaintiff asserts that, as a result of Blocker’s false statements and without any attempt by ATF to verify her claims, Plaintiff was removed from the ATF eForms account for CPI and has not been able to restore his access. Id. ¶ 32. Blocker further sent ATF a change of address notification, causing a new FFL certificate for CPI to be mailed to her at a private mailbox service in Woodbridge, Virginia. Id. ¶ 33. As a result of losing access to the ATF account, Plaintiff has been unable to conduct transactions on the account or provide a complete accounting of the inventory of CPI’s ATF-regulated firearms. Id. ¶ 35. In March 2024, Plaintiff began notifying administrators of the eForms portal and employees of the ATF NFA Branch that Blocker had fraudulently gained access to CPI’s eForms account and was now unlawfully accessing transaction data and taxpayer information to the exclusion of Plaintiff and potentially conducting unauthorized firearms transactions. Id. ¶ 36. ATF personnel did not revoke Blocker’s access. Id. ¶ 37. Plaintiff has been repeatedly told by ATF personnel that he needs to contact Blocker—the account administrator—and ask her permission to

obtain access to the CPI account. Id. ¶ 38. In March 2024, Plaintiff made Privacy Act requests through the ATF Freedom of Information Act (“FOIA”) internet portal. Id. ¶ 39. On March 25, 2024, Elizabeth Wood, Acting Chief of ATF’s Information and Privacy Governance Division, responded to the requests, and Plaintiff provided the requested documentation and an affidavit of his identity. Id. ¶ 40. As of the filing of the Complaint, Plaintiff had not received any further response to his Privacy Act requests. Id. ¶ 41. On August 8, 2024, Plaintiff wrote to the ATF Information and Privacy Governance Division and demanded a response to his Privacy Act requests. Id. ¶ 42. He further demanded remediation of the allegedly unauthorized access of the CPI eForms account and his exclusion

from the same, and he demanded ATF void any transaction using the eForms portal by Allen and Blocker. Id. Plaintiff received confirmation of delivery to ATF from the Postal Service, but, as of the filing of the Complaint, he had not received a response. Id. ¶ 43. Plaintiff alleges, upon information and belief, that Blocker has since received an NFA tax stamp for an ATF Form 1 approval submitted by Plaintiff on July 30, 2024, on behalf of CPI. Id. ¶ 44. B. Procedural Background On December 18, 2024, Plaintiff filed the instant Complaint. Dkt. 1. Plaintiff asserts four counts for violations of the Privacy Act. Id. After receiving an extension, on March 4, 2025, Defendant filed its Motion to Dismiss. Dkt. 7. On March 13, 2025, Plaintiff filed his Opposition.2 Dkt. 12. On March 31, 2025, Defendant filed its Reply. Dkt. 18. II. LEGAL STANDARD Federal Rule of Civil Procedure 12(b)(1) provides for dismissal when the Court lacks

jurisdiction over the subject matter of the action. A district court must dismiss an action over which it lacks subject-matter jurisdiction. Fed. R. Civ. P. 12(b)(1), (h)(3). In considering a 12(b)(1) motion to dismiss, the burden is on the plaintiff to prove that subject-matter jurisdiction is proper. See United States v. Hays, 515 U.S. 737, 743 (1995) (citing McNutt v. Gen. Motors Acceptance Corp., 298 U.S. 178, 189 (1936)); see also Adams v. Bain, 697 F.2d 1213, 1219 (4th Cir. 1982). There are two ways in which a defendant may prevail on a 12(b)(1) motion. First, a defendant may attack the complaint on its face when the complaint “fails to allege facts upon which subject matter jurisdiction may be based.” Adams, 697 F.2d at 1219. Under this method of attack, all facts as alleged by the plaintiff are assumed to be true. Id. Alternatively, a 12(b)(1) motion to

dismiss may attack the existence of subject-matter jurisdiction over the case apart from the pleadings. Williams v. United States, 50 F.3d 299, 304 (4th Cir. 1995). In such a case, “[n]o presumptive truthfulness attaches to the plaintiff’s allegations, and the existence of disputed material facts will not preclude the trial court from evaluating for itself the merits of the

2 It appears that Plaintiff’s Opposition was filed on Thursday, March 13, 2025, but was not entered on the docket until Monday, March 17, 2025. Dkt. 12. On Friday, March 14, 2025, before the Opposition was entered on the docket, the Court issued a Roseboro notice. Dkt. 10. Because Plaintiff filed an Opposition, any failure to comply with the strictures of Roseboro or the Local Rules is harmless. See Petros v. Sanitation Dep’t, 993 F.2d 1538, 1993 WL 174158, at *1 n* (4th Cir. May 25, 1993) (noting that the failure to issue a Roseboro notice was harmless where the plaintiff responded to the motion); Brooks v. Mahon, 33 F.3d 51, 1994 WL 416403, at *1 n.* (4th Cir. Aug. 10, 1994) (noting that the failure to issue a Roseboro notice was harmless because “Appellant actually responded”). jurisdictional claims.” Mortensen v. First Fed. Sav. & Loan Ass’n, 549 F.3d 884, 891 (3d Cir. 1977). III. ANALYSIS In its Motion, Defendant argues that (1) the Court lacks jurisdiction over the action because

Count 3 is moot and Plaintiff lacks standing to assert the remaining counts, and (2) Plaintiff has failed to state a claim on Counts 1, 2, and 4. Jurisdiction is a threshold requirement, so the Court addresses these arguments first. See Steel Co. v. Citizens for a Better Env’t, 523 U.S. 83, 94-95 (1998) (“The requirement that jurisdiction be established as a threshold matter ‘spring[s] from the nature and limits of the judicial power of the United States’ and is ‘inflexible and without exception.’” (alteration in original) (quoting Mansfield, C. & L.M.R. Co. v. Swan, 111 U.S. 379, 382 (1884)). Because the Court finds that it lacks jurisdiction over the action, it does not reach Defendant’s remaining arguments. A. Standing (Counts 1, 2, and 4) Article III, Section 2, clause 1 of the Constitution limits federal court jurisdiction to

“Cases” and “Controversies.” U.S. Const. art. III, § 2, cl. 1. As the Supreme Court has explained, an “essential and unchanging part of the case-or-controversy requirement” is that a plaintiff must establish Article III standing to sue. Lujan v. Defs. of Wildlife, 504 U.S. 555, 560 (1992). Plaintiff bears the burden of properly alleging standing. Lujan, 504 U.S. at 561; see also Balzer & Assocs., Inc. v. Union Bank & Trust Co., 2009 WL 1675707, at *2 (E.D. Va. June 15, 2009) (“On a motion to dismiss pursuant to Rule 12(b)(1), the party asserting jurisdiction has the burden of proving subject matter jurisdiction.” (citing Richmond, Fredericksburg & Potomac R.R. v. United States, 945 F.2d 765, 768 (4th Cir. 1991))). “Where, as here, a case is at the pleading stage, the plaintiff must ‘clearly . . . allege facts demonstrating’ each element.” Spokeo, Inc., 578 U.S. at 338 (quoting Warth v. Seldin, 422 U.S. 490, 518 (1975)). Specifically, Article III standing requires a plaintiff to have “(1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision.” Id. (quoting Lujan, 504 U.S. at 560-61). To establish injury in fact, a plaintiff must show that he or she suffered

‘an invasion of a legally protected interest’ that is ‘concrete and particularized’ and ‘actual or imminent, not conjectural or hypothetical.’” Id. at 339 (quoting Lujan, 504 U.S. at 560). “For an injury to be ‘particularized,’ it ‘must affect the plaintiff in a personal and individual way.’” Id. at 339. The Privacy Act allows an individual to sue where an agency “(A) makes a determination . . . not to amend an individual’s record in accordance with his request . . . ; (B) refuses to comply with an individual[‘s] request” for access to his records; (C) fails to maintain any record “with such accuracy, relevance, timeliness and completeness as is necessary to assure fairness in any determination relating to the qualifications, character, rights or opportunities of, or benefits to the individual that may be made on the basis of such record, and consequently a determination is made

which is adverse to the individual”; or (D) “fails to comply with any other provision of this section . . . in such a way as to have an adverse effect on an individual . . . .” 5 U.S.C. § 552a(g)(1)(A)- (D); see also F.A.A. v. Cooper, 566 U.S. 284, 287 (2012) (“If an agency fails to comply with [Privacy Act] requirements ‘in such a way as to have an adverse effect on an individual,’ the Act authorizes the individual to bring a civil action against the agency.” (quoting 5 U.S.C. § 522a(g)(1)(D))). The Supreme Court has clarified the term “adverse effect” in subsection (D) “acts as a term of art identifying a potential plaintiff who satisfies the injury-in-fact and causation requirements of Article III standing, and who may consequently bring a civil action without suffering dismissal for want of standing to sue.” Doe v. Chao, 540 U.S. 614, 624 (2004). Here, in Counts 1, 2, and 4, Plaintiff asserts that ATF has violated the Privacy Act by allowing unauthorized persons access to CPI’s eForms internet portal, Dkt. 1 ¶ 48, failing to establish appropriate safeguards to prevent unauthorized access to that portal, id. ¶¶ 55, 56, and failing to respond to Plaintiff’s demand to restore his access to the portal, id. ¶¶ 69, 70. Plaintiff

asserts that, due to these actions and inactions by ATF, he is facing personal legal jeopardy because he has been continuing to manufacture firearms “for his corporation,” despite his knowledge that he is no longer a responsible person on CPI’s license.3 Dkt. 12 at 13-16. But any personal jeopardy Plaintiff might face from his continued manufacture of firearms is not traceable to any violation of the Privacy Act by ATF. In his Complaint, Plaintiff asserts that the relevant “record” under the Privacy Act is CPI’s eForms internet portal. Dkt. 1 ¶¶ 48, 55, 56, 69, 70. But CPI’s eForms internet portal is not plausibly alleged to contain any of Plaintiff’s personal information such that it could qualify as an individual record under the Privacy Act and grant him standing to sue under the same. Plaintiff has not alleged any specific facts indicating that information that personally describes him, such

as information about his “education, financial transactions, medical history, and criminal or employment history,” 5 U.S.C. § 552a(a)(4), is contained in CPI’s eForms internet portal. See, e.g., Williams v. Dep’t of Veterans Affs., 104 F.3d 670, 674 (4th Cir. 1997) (describing as “records” under the statute those documents that discussed “medical history, clinical observations concerning [plaintiff], suggested past therapies that were not undertaken, a possible future course

3 Plaintiff attaches to his Opposition a copy of a February 13, 2025 warning letter from ATF informing him that his “unlawful possession of an unregistered firearm, regulated under the National Firearms Act, has come to the attention” of ATF, and warning him that he is “prohibited . . . from possessing and/or manufacturing a firearm as defined by 26 U.S.C. § 5845(a) without first registering the firearm” and that “[c]ontinued and/or future violations . . . could result in a recommendation for criminal prosecution.” Dkt. 12-27. of treatment, and information pertaining to [plaintiff’s] personal relationships”). Moreover, as alleged, the eForms account merely allowed Plaintiff to submit and view CPI’s forms and submission to ATF—thus it is not a reasonable inference that the eForms account would have any personally descriptive information about Plaintiff that would confer standing under the Privacy

Act. In his Opposition, Plaintiff argues that his status as a “responsible person” for CPI (or lack thereof) qualifies as a record under the Privacy Act. But, as already noted, this status is not the type of information the Privacy Act protects. See Williams, 104 F.3d at 674. Thus, because Plaintiff’s alleged injury cannot be fairly traced to any violation of the Privacy Act by ATF, Plaintiff lacks standing to bring Counts 1, 2, and 4, and these counts will be dismissed.4 B. Mootness (Count 3) “When a case or controversy ceases to exist, the litigation is moot, and the court’s subject matter jurisdiction ceases to exist also.” S.C. Coastal Conservation League v. U.S. Army Corps of Eng’rs, 789 F.3d 475, 482 (4th Cir. 2015). The only relief the Court can grant for a request for Privacy Act access to documents is to “enjoin the agency from withholding the records and order

the production to the complainant of any agency records improperly withheld from him.” 5 U.S.C. § 552a(g)(3)(A); Biondo v. Dep’t of Navy, 928 F. Supp. 626, 631 (D.S.C. 1995), aff’d, 86 F.3d 1148 (4th Cir. 1996). A Privacy Act claim thus becomes moot once the documents sought are

4 To the extent Plaintiff seeks to bring these claims on behalf of CPI, he is foreclosed from doing so because the Privacy Act only applies to records of natural persons, not corporations. See, e.g., Hurry v. FINRA, 782 F. App’x 600, 602 (9th Cir. 2019) (“The Act applies to records of natural persons only, and only natural persons may sue under the Act.”); Dresser Indus., Inc. v. United States, 596 F.2d 1231, 1237 (5th Cir. 1979) (“[Plaintiff] . . . is without standing to pursue this issue because, being a corporation, it is not an ‘individual’ as defined in the Privacy Act.”).

The Court also notes that, even if it found that Plaintiff had adequately asserted standing to bring these claims, it would otherwise dismiss Counts 1, 2, and 4 for failure to state a claim under the Privacy Act on this basis. See Dkt. 8 at 14-19; Dkt. 18 at 9-11. released to the plaintiff. Biondo, 928 F. Supp. at 631 (“[O]nce the requested documents have been produced, the claim for relief . . . becomes moot.”); see also Crummey v. Soc. Sec. Admin., 794 F. Supp. 2d 46, 60 (D.D.C. 2011) (“[B]ecause [Plaintiff] has already received all the records responsive to his requests that are in the [agency]'s possession, custody, or control, his requests for

access are moot and the associated relief unavailable.”), aff’d, 2012 WL 556317 (D.C. Cir. Feb. 6, 2012). Here, Plaintiff premises Count 3 on Defendant’s alleged failure to respond to requests 2024-PA-21 and 2024-00953. Dkt. 1 ¶¶ 39, 60-62. Without conceding that any of the documents requested qualify as records under the Privacy Act, Defendant reports that on March 3, 2025, it produced all requested documents not within a Privacy Act or FOIA exception to Plaintiff. Dkt. 8 at 9. In support of its assertion, Defendant attached copies of the requests, Dkts. 8-1, 8-2, and Defendant’s cover letter for its response to Plaintiff, Dkt. 8-3. Plaintiff does not dispute that Defendant produced all requested documents not within a Privacy Act or FOIA exception. Dkt. 12. Plaintiff instead argues that his claim is not moot because Defendant’s production was “an

untimely after the fact disclosure” that “violates the spirit of the Federal Privacy Act” and because it is a “controversy capable of repetition yet evading review.” Id. at 20. Plaintiff cites Greidinger v. Davis, 782 F. Supp. 1106 (E.D. Va. 1992), overruled on other grounds, 988 F.2d 1344 (4th Cir. 1993), for his first proposition. Dkt. 12 at 20. The Griedinger case involved a statutory requirement that Virginia notify individuals whether the disclosure of their social security numbers was mandatory or voluntary when it requested them. Griedinger, 782 F. Supp. at 1108. The court held that Virginia’s failure to provide this statutory “disclosure” before it requested an individual’s social security number “violates the spirit of the Federal Privacy Act.” Id. at 1109. By contrast, in the case at bar, Plaintiff requested access to records and ATF produced them. Accordingly, the Court finds that, rather than violate the spirit of the Privacy Act, Defendant’s actions in producing the requested records did the opposite, and thus the Court does not find that the logic of Greidinger applies here to avoid mootness. Moreover, the Court’s conclusion in this regard is consistent with other courts, discussed supra, addressing this specific

provision of the Privacy Act – which Greidinger did not address. As for Plaintiff’s “capable of repetition” argument, Plaintiff alleges no facts indicating that he has other pending Privacy Act requests or that he intends to request any more documents. The “wrongs capable of repetition yet evading review” exception to mootness “applies only if ‘(1) the challenged action is in its duration too short to be fully litigated prior to cessation or expiration, and (2) there is a reasonable expectation that the same complaining party will be subject to the same action again.’” Lighthouse Fellowship Church v. Northam, 20 F.4th 157, 165 (4th Cir. 2021) (quoting Fed. Election Comm’n v. Wis. Right to Life, Inc., 551 U.S. 449, 462 (2007)). Here, Defendant has produced all of non-exempted documents requested by Plaintiff; thus, there is no reasonable expectation that Plaintiff will request and have to wait for the production of the relevant documents again.5 Thus, this exception does not apply.

Accordingly, the Court finds that it lacks jurisdiction over Count 3 because it is moot. Thus, Defendant’s Motion will also be granted as to Count 3, and Count 3 will be dismissed. IV. CONCLUSION Accordingly, it is hereby ORDERED that Defendant ATF’s Motion to Dismiss (Dkt. 7) is GRANTED; and it is

5 Nor does Plaintiff allege that Defendant otherwise has a “pattern or practice” of unreasonable delay in responding to Privacy Act requests. Cf. Empower v. Nat’l Insts. of Health, 122 F.4th 92, 102 (4th Cir. 2024) (noting that other circuits have recognized a “pattern or practice” claim under FOIA). FURTHER ORDERED that the action is DISMISSED WITHOUT PREJUDICE for lack of subject matter jurisdiction. To appeal this decision, Plaintiff must file a written notice of appeal with the Clerk’s Office within sixty (60) days of the date of this Order. See Fed. R. App. 4(a). A written notice of appeal is a short statement indicating a desire to appeal and including the date of the Order that Plaintiff wishes to appeal. Failure to file a timely notice of appeal waives the right to appeal this decision. The Clerk is directed to forward copies of this Memorandum Opinion and Order to pro se Plaintiff Matthew LeFande and to all counsel of record and to place this matter among the ended causes. It is SO ORDERED. Alexandria, Virginia March 20, 2026 dsf_ Ng | Rossie D. Alston, Jr. United States District Judge