Electronic Privacy Information Center v. US Department of Commerce and Bureau of the Census, 928 F.3d 95

Background

In March 2018 Commerce Secretary Wilbur Ross announced adding a citizenship question to the 2020 Census; EPIC sued claiming the agency violated the E‑Government Act by not completing required Privacy Impact Assessments (PIAs) before that announcement.
Section 208 of the E‑Government Act requires agencies to conduct, review, and publish a PIA before "initiating a new collection of information" involving personally identifiable information collected via information technology.
The Census Bureau maintains PIAs for multiple IT systems (e.g., CEN08) and represented it would complete updated PIAs before distributing 2020 census questionnaires; one updated PIA (for CEN08) was published during litigation.
EPIC sought injunctions vacating or staying the citizenship-question decision and requiring completion/publication of PIAs; the district court denied EPIC’s preliminary‑injunction motion for lack of likelihood of success and irreparable harm.
On appeal, the D.C. Circuit held EPIC lacked Article III standing (organizational and associational), concluding EPIC’s asserted privacy and informational injuries were speculative and insufficient to show the concrete harm § 208 was meant to prevent.
Court vacated the district court’s denial of the preliminary injunction and remanded with instructions to dismiss for lack of jurisdiction (standing).

Issues

Issue	Plaintiff's Argument	Defendant's Argument	Held
Does §208 require PIAs before the agency decision to add a census question (i.e., when is a collection "initiated")?	The decision to add the question is the "initiation" of a new collection, so PIAs were required before the March 2018 announcement.	Initiation occurs when the agency actually solicits information (mailing questionnaires); PIAs need only be completed before distribution.	Not reached on the merits: court resolved case on standing; government represented PIAs would be completed before questionnaires distributed.
Does EPIC have organizational standing to compel PIAs or enjoin collection under §208?	EPIC argued organizational injury from lack of PIAs.	Govt. argued EPIC lacks concrete organizational injury; precedent rejects such standing.	No — organizational standing foreclosed by precedent (EPIC v. PACEI).
Can EPIC assert associational standing via members harmed by delayed PIAs?	Members suffer privacy and informational injuries from collection without PIAs.	Any alleged privacy/disclosure harms are speculative; disclosure is prohibited by statute; §208 protects privacy, not a public informational right.	No — members did not allege concrete, imminent privacy or the specific informational harm §208 seeks to prevent.
Is a bare procedural violation of §208 sufficient for Article III injury?	A procedural violation itself establishes injury.	Spokeo and related precedent require a concrete harm beyond a bare procedural violation.	No — a bare procedural violation without concrete harm is insufficient for standing.

Key Cases Cited

Arizonans for Official English v. Arizona, 520 U.S. 43 (1997) (appellate courts must ensure jurisdiction and standing)
Steel Co. v. Citizens for a Better Env’t, 523 U.S. 83 (1998) (federal courts limited to Article III cases and controversies)
Spokeo, Inc. v. Robins, 136 S. Ct. 1540 (2016) (procedural violations require concrete harm for Article III injury)
Clapper v. Amnesty Int’l USA, 568 U.S. 398 (2013) (speculative chains of harm insufficient for standing)
Lujan v. Defenders of Wildlife, 504 U.S. 555 (1992) (elements of injury-in-fact; burden of proof for standing)
EPIC v. Presidential Advisory Comm’n on Election Integrity, 878 F.3d 371 (D.C. Cir. 2017) (EPIC lacked organizational standing re: PIAs)
Friends of Animals v. Jewell, 828 F.3d 989 (D.C. Cir. 2016) (framework for informational‑injury standing)
Food & Water Watch, Inc. v. Vilsack, 808 F.3d 905 (D.C. Cir. 2015) (evaluating standing as part of preliminary‑injunction analysis)