Electronic Privacy Information Center v. U.S. Department of Education, 48 F. Supp. 3d 1

Background

Plaintiffs EPIC and four individual EPIC board members sued the U.S. Department of Education to challenge a 2011 Final Rule amending FERPA definitions ("directory information," "authorized representative," and "education program").
The Final Rule: (1) treats certain student ID numbers as directory information (with authentication safeguards), and (2) broadens who may be an "authorized representative" for audits/evaluations.
Plaintiffs alleged the Rule increases the risk that student personally identifiable information (PII) will be disclosed to unregulated third parties and misused (identity theft, insurance discrimination), and that EPIC must divert resources to oppose the Rule.
The Department moved to dismiss for lack of standing or, alternatively, for summary judgment; plaintiffs cross‑moved for summary judgment. The jurisdictional/standing record included declarations from individual plaintiffs, EPIC staff, and an NCES official.
The district court held that neither the individuals nor EPIC (as an association or on its own behalf) established Article III standing and dismissed for lack of subject matter jurisdiction.

Issues

Issue	Plaintiff's Argument	Defendant's Argument	Held
Whether individual plaintiffs have injury in fact from an "increased risk" of identity theft caused by the Rule	The Rule increases disclosure risk (ID numbers and broader "authorized representatives"), creating a substantial increased risk of identity fraud	Plaintiffs offered no evidence of a substantial increase or of a substantial absolute probability of misuse; many plaintiffs are long-removed from institutions; safeguards/controls exist	No — plaintiffs failed Public Citizen’s two‑prong increased‑risk test (no proof of substantial increase or substantial probability)
Whether causation and redressability exist for individual claims	Invalidating the Rule will prevent institutions/third parties from disclosures that create the risk	The Rule does not compel disclosures; institutions retain discretion; prior rules already allowed broad disclosures; statutory/regulatory safeguards and enforcement exist	No — chain of events is too attenuated; plaintiffs did not show the Rule causes the alleged injuries or that relief would redress them
Whether EPIC has associational standing on behalf of its members	EPIC alleges its members (the four individual plaintiffs) are harmed and thus at least one member has standing	If the individual members lack standing, the association cannot claim member standing	No — associational standing fails because none of the identified members have standing in their own right
Whether EPIC has organizational standing based on diversion of resources or impaired advocacy (Havens theory)	EPIC spent staff time and resources responding to the Rule; this diversion is a concrete injury to EPIC’s programs and mission	The expenditures are ordinary advocacy activities (core to EPIC’s mission) and self‑directed; they do not show a perceptible impairment to programs	No — EPIC’s resource use is routine issue‑advocacy, not a cognizable Havens injury; the organization’s activities were not adversely impaired

Key Cases Cited

Lujan v. Defenders of Wildlife, 504 U.S. 555 (1992) (standing requires injury in fact, causation, and redressability)
Public Citizen, Inc. v. NHTSA, 489 F.3d 1279 (D.C. Cir. 2007) (increased‑risk standing requires a substantial increase in risk and a substantial probability of harm)
Havens Realty Corp. v. Coleman, 455 U.S. 363 (1982) (an organization suffers cognizable injury when the defendant’s conduct perceptibly impairs its ability to provide services and forces diversion of resources)
Sierra Club v. EPA, 292 F.3d 895 (D.C. Cir. 2002) (associational standing requirements and need to supplement administrative record for standing)
Gonzaga Univ. v. Doe, 536 U.S. 273 (2002) (FERPA’s purpose and structure regarding educational records)