Elec. Privacy Info. Ctr. v. Fed. Aviation Admin., 892 F.3d 1249

Background

In June 2016 the FAA issued a final rule (Operation and Certification of Small Unmanned Aircraft Systems) implementing an expedited regulatory regime for certain nonrecreational small drones under the FAA Modernization and Reform Act of 2012 §333. The rule focused on safety (line-of-sight, daylight operations, speed/altitude limits).
EPIC challenged the rule, arguing the FAA unlawfully omitted privacy protections and that the Modernization Act required the FAA to consider and protect privacy in drone regulation. EPIC sought review in this court.
The FAA responded that privacy regulation is outside its traditional safety-focused statutory authority and that the Modernization Act did not direct the FAA to address privacy. The FAA noted interagency work on privacy and that cameras/sensors unrelated to airworthiness historically were not regulated by the FAA.
EPIC submitted member affidavits alleging increased drone testing (e.g., package delivery, autonomous systems) near members’ locales and apprehensions about privacy invasions. EPIC also asserted organizational injury from impeded advocacy but submitted no organizational affidavits.
The court framed the central threshold issue as standing (Article III). It considered associational standing (members’ injuries) and organizational standing (EPIC’s own activities) and concluded EPIC failed to carry its burden to show a concrete, particularized, and traceable injury. The court therefore dismissed the petition without reaching the merits.

Issues

Issue	Plaintiff's Argument	Defendant's Argument	Held
Whether Modernization Act required FAA to address drone privacy in this rulemaking	EPIC: Act implicitly requires FAA to consider and protect privacy when integrating UAS	FAA: Act did not direct FAA to regulate privacy; privacy regulation exceeds FAA's safety-focused authority	Not reached — petition dismissed for lack of standing
Associational standing (members’ alleged privacy injuries)	EPIC: Members face increased, concrete privacy invasions from drones authorized by the rule (e.g., delivery, autonomous drones)	FAA: Alleged delivery/autonomous operations are largely excluded/unauthorized under the rule; alleged harms are speculative and not traceable to this rule	No — members’ affidavits too speculative and attenuated to establish Article III injury
Organizational standing (EPIC’s own activities impeded)	EPIC: FAA inaction impairs EPIC’s advocacy and educational activities and denies avenues for redress	FAA: EPIC made no evidentiary showing (no declarations) of concrete injury to its activities; claims are pure issue advocacy	No — EPIC failed to submit evidence showing concrete, programmatic injury
Whether FAA unlawfully engaged in piecemeal regulation / failed to promulgate comprehensive rules	EPIC: FAA’s omission of privacy and staged approach is unlawful and piecemeal	FAA: Rule is an expedited, safety-focused integration under §333; comprehensive privacy regulation not mandated here	Not reached — court dismissed for lack of standing

Key Cases Cited

Summers v. Earth Island Inst., 555 U.S. 488 (standing requires concrete, particularized injury)
Lujan v. Defenders of Wildlife, 504 U.S. 555 (standing principles; causation and redressability)
Clapper v. Amnesty Int'l USA, 568 U.S. 398 (speculative chain of causation insufficient for Article III injury)
Sierra Club v. EPA, 754 F.3d 995 (speculative injuries and causation in administrative-review standing)
Public Citizen, Inc. v. Nat'l Highway Traffic Safety Admin., 489 F.3d 1279 (probabilistic standing requires substantial increase and substantial probability of harm)
Abigail Alliance for Better Access to Developmental Drugs v. Eschenbach, 469 F.3d 129 (organizational and standing standards)
Americans for Safe Access v. DEA, 706 F.3d 438 (requirement to support standing allegations with affidavits/evidence)
PETA v. USDA, 797 F.3d 1087 (example of organization establishing standing with declarations of concrete programmatic injury)