UNIVERSITY OF CALIFORNIA STUDENT ASSOCIATION v. DENISE CARTER, Aсting Secretary of Education, et al.
Civil Action No. 25-354 (RDM)
UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLUMBIA
February 17, 2025
Case 1:25-cv-00354-RDM Document 20 Filed 02/17/25
Plaintiff, an organization representing students in the University of California school system, moves for an emergency order temporarily restraining Acting Secretary of Education Denise Carter and the Department of Education (collectively, “ED“) “from disclosing information” about Plaintiff‘s members “to individuals affiliated with the so-called Department of Government Efficiency (DOGE).” Dkt. 9-4 at 1. Plaintiff further seeks an order requiring ED “to retrieve and safeguard any such information that has already been obtained by and shared or transferred by DOGE or individuals associated with it.” Id. For the reasons that follow, the Court will deny Plaintiff‘s motion.
I. BACKGROUND
A. Statutory and Regulatory Background
Each year, “Congress provides billions of dollars through loan and grant programs to help students pay tuition for their postsecondary education.” Ass‘n of Priv. Sector Colls. & Univs. v. Duncan, 681 F.3d 427, 433 (D.C. Cir. 2012). The Department of Education “administers these programs, which were established under Title IV of the Higher Education Aсt of 1965.” Id. In that role, “ED collects and maintains [students‘] sensitive personal and financial information, including their name, Social Security number (SSN), date of birth, student loan account information, contact information, driver‘s license number, and financial information.” Dkt. 1 at 2 (Compl. ¶ 2) (internal quotation marks, citation, and alteration omitted). These data are maintained in various ED systems and databases, at least one of which
As a federal agency, ED is subject to the
ED has published the “routine uses” applicable to its various databases, which permit certain disclosures. See, e.g., 89 Fed. Reg. 44652 (May 21, 2024) (National Student Loan Data System; 88 Fеd. Reg. 41942 (June 28, 2023) (Common Origination and Disbursement System); 88 Fed. Reg. 42220 (June 29, 2023) (FUTURE Act System); 73 Fed. Reg. 177 (January 2, 2008) (Financial Management System). For example, ED may disclose records in the National Student Loan Database to other federal agencies for “routine uses” including “[t]o support auditors and program reviewers” of the federal student aid programs, “[t]o assist program administrators with tracking refunds and discharges” of loans, as well as “[t]o support the investigation of рossible fraud or abuse and to detect and prevent fraud or abuse” in ED‘s loan programs, among others uses. 89 Fed. Reg. 44652, 44657-58 (May 21, 2024).
The Privacy Act authorizes both criminal penalties and private enforcement for violations of its provisions. In particular, “[a]ny officer or employee of an agency, who by virtue of his employment or official position, has possession of, or access to, agency records which contain individually identifiable information the disclosure of which is prohibited by [the Privacy Act] and who knowing that disclosure of the specific material is so prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor.”
Like the Privacy Act, the Internal Revenue Code also controls disclosure of individuals’ personal information, both within and outside the government. Section 6103 of the Internal Revenue Code provides that, as a “general rule,” “returns and return information shall be confidential.”
To enforce these limits, the Internal Revenue Code also provides for criminal penalties and private enforcement. The private enforcement provision provides that if “any officer or employee of the United States knowingly, or by reason of negligence, inspects or discloses any return or return information . . . in violation of any provision of [S]ection 6103,” the affected individual may bring an action against the United States for damages of $1,000 or more.
B. Factual and Procedural Background
On the day of his inauguration, President Trump issued an Executive Order creating the “Department of Government Efficiency,” commonly known as “DOGE.” Exec. Order No. 14,158, 90 Fed. Reg. 8441 (Jan. 20, 2025). The Executive Order did three things. First, it renаmed the United States Digital Service2 as the United States DOGE Service (“USDS“) and established it in the Executive Office of the President. 90 Fed. Reg. at 8441. Second, it established a “temporary organization” under
According to the Executive Order, DOGE‘s purpose is to “improve the quality and efficiency of government-wide software, network infrastructure, and information technology (IT) systems.” 90 Fed. Reg. at 8441. To that end, the Executive Order directs “Agency Heads” to
“take all necessary steps, in coordination with the USDS Administrator and to the maximum extent consistent with law, to ensure USDS has full and prompt access to all unclassified agency records, software systems, and IT systems.” Id. at 8442. “Since his inauguration,” however, “President Trump has not formally identified the individual who would serve as USDS Administrator.” Dkt. 1 at 14 (Compl. ¶ 49).
Following issuance of the Executive Order, DOGE began hiring new employees and working with agencies, including ED. There are currently at least “[s]ix individuals at the Department of Education, all federal emрloyees, [] assisting with implementing” the Executive Order “as part of [ED‘s] DOGE Team.” Dkt. 16-1 at 2-3 (citing Ramada Decl. ¶¶ 3-7); Dkt. 17 at 1, 24. According to Adam Ramada, a DOGE employee, ED “is the ‘home’ agency of two of these employees,” and the others, including Ramada, “are on detail to the Department.” Dkt. 18-2 at 2 (Supp. Ramada Decl. ¶ 3). Ramada attests that he and one other detailed employee are on detail from DOGE, while the remaining two employeеs “are on detail from other federal agencies.” Id. Ramada further reports that he spends “50-60 hours per week working at Department facilities, as do the two employees whose home agency is the Department.” Id. (Supp. Ramada Decl. ¶ 4). “Of the other detailed employees, two spend [about] 20-30 hours per week at the Department, and the last spends [about] 5 hours per week at the Department.” Id. According to Ramаda, “[a]ll six employees . . . assist the Department of Education with auditing contract, grant, and related programs for waste, fraud, and abuse” and “help senior Department leadership obtain access to accurate data and data analytics to inform their policy decisions at the Department.” Id. (Supp. Ramada Decl. ¶ 5). Ramada further avers that he is unaware “of any DOGE-affiliated individual other than [these] six . . . who have beеn granted access to Department information technology and data systems or who have otherwise received any Department information protected by the Privacy Act or [S]ection 6103 of the Internal Revenue Code.” Id. at 3 (Supp. Ramada Decl. ¶ 7). To date, according to Ramada, the six DOGE-affiliated employees “have primarily worked to identify contracts and grants that are wasteful, abusive, or inconsistent with leadеrship‘s policy priorities.” Id. (Supp. Ramada Decl. ¶ 8). All but one of the employees has “completed ethics [and] information security trainings,” and the sixth employee has “been directed to complete” those trainings “this week.” Id. (Supp. Ramada Decl. ¶ 9).
News reports of DOGE staffers’ access to student data prompted Plaintiff University of California Student Association (“UCSA“) to file the instant complaint, Dkt. 1, as well as an emergency motion for a temporary restraining order three days later, Dkt. 9. UCSA is a nonprofit organization whose membership consists of over 230,000 students across the University of California‘s nine undergraduate campuses. Dkt. 1 at 6-7 (Compl. ¶ 15). More than 70% of USCA‘s members receive federal financial aid through programs administered by ED, which means that those members have shared a significant amount of their personal information with ED.
UCSA seeks an emergency order enjoining ED from sharing UCSA members’ data with DOGE staffers, as well as an order requiring ED to retrieve any data already shared. Dkt. 9-4 at 1. UCSA asserts three counts under the
II. ANALYSIS
A temporary restraining order (“TRO“) is “an extraordinаry form of relief.” Banks v. Booth, 459 F. Supp. 3d 143, 149 (D.D.C. 2020). A TRO is analyzed using the same “factors applicable to preliminary injunctive relief,” and “may only be awarded upon a clear showing that the plaintiff is entitled to such relief.” Id. (quoting Sherley v. Sebelius, 644 F.3d 388, 391 (D.C. Cir. 2011)). To obtain a TRO, a movant “must show that (1) it is likely to succeed on the merits; (2) it is likely to suffer irreparable harm in the absence of preliminary relief; (3) the balance of equities tips in its favor; and (4) the issuance of a preliminary injunction is in the public interest.” Alpine Sec. Corp. v. FINRA, 121 F.4th 1314, 1324 (D.C. Cir. 2024) (internal quotations and alterations omitted).
Although “the movant has the burden to show that all four factors, taken together, weigh in favor of the injunction,” Abdullah v. Obama, 753 F.3d 193, 197 (D.C. Cir. 2014) (quoting Davis v. Pension Benefit Guar. Corp., 571 F.3d 1288, 1292 (D.C. Cir. 2009)) (internal quotation marks omitted), “the basis of injunctive relief in the federal courts has always been” the second factor—“irreparable harm.” Chaplaincy of Full Gospel Churches v. England, 454 F.3d 290, 297 (D.C. Cir. 2006) (quoting Sampson v. Murray, 415 U.S. 61, 88 (1974)). “[A] showing that irreparable harm is ‘likely’ is [thus] the sine qua non for obtaining [a TRO]—it is what justifies the extraordinary remedy of granting relief before the parties have had the opportunity fully to develop the evidence and fully to rеpresent their respective cases.” Cal. Ass‘n of Private Postsecondary Schs. v. DeVos, 344 F. Supp. 3d 158, 167 (D.D.C. 2018) (quoting Achagzai v. Broad. Bd. of Governors, No. 14-cv-768, 2016 WL 471274, at *3-4 (D.D.C. Feb. 8, 2016)). It follows that “[a] movant‘s failure to show any irreparable harm is therefore grounds for refusing to issue” a TRO, “even if the other three factors entering the calculus merit such relief.” Chaplaincy of Full Gospel Churches, 454 F.3d at 297; see also Ashland Oil, Inc. v. F.T.C., 409 F. Supp. 297, 309 (D.D.C.), aff‘d, 548 F.2d 977 (D.C. Cir. 1976) (“If irreparable injury cannot be established, . . . injunctive relief is not warranted.“).
The Court, accordingly, starts by considering whether UCSA has made a “clear showing” that “it will likely suffer
The D.C. Circuit “has set a high standard for irreparable injury.” Chaplaincy of Full Gospel Churches, 454 F.3d at 297. It “must be both certain and great,” “actual and not
theoretical,” and “beyond remediation.” Id. (quoting Wisc. Gas. Co. v. F.E.R.C., 758 F.2d 669, 674 (D.C. Cir. 1985)). UCSA avers that it has met this high bar. On UCSA‘s telling, its members “are suffering, and will continue to suffer, irreparable injury” due to ED‘s making their data “accessible” to DOGE staffers. Dkt. 9 at 40. UCSA observes that once information is “disseminat[ed],” it cannot be contained—the proverbial cat is out of the bag. Id. at 40-42. UCSA reasons that this “ongoing injury” of “exposure” of their data “cannot be remedied after the fact.” Id.
UCSA is correct that a disclosure of information generally cannоt be “undone,” id. at 43, but that is not sufficient to show irreparable harm. What UCSA overlooks is that the context of the dissemination matters. Courts find dissemination of information to be an irreparable injury where, for example, highly sensitive information will be made public, or ends up in the hands of someone with no obligation to keep it confidential. Indeed, the cases upon which UCSA relies recognize this principle. See id. at 42 (citing Hospitality Staffing Sols., LLC v. Reyes, 736 F. Supp. 2d 192, 200 (D.D.C. 2010) (finding “disclosing [defendant‘s] confidеntial and proprietary information” to competitors would be “irreparable“); then citing Wilcox v. Bastiste, No. 17-cv-122, 2017 WL 2525309, at *1-3 (E.D. Wash. June 9, 2017) (finding irreparable injury where state agency was “sell[ing] [automobile] collision reports to any third party without redacting various types of personal information“)); see also Dkt. 17 at 31 (citing United States v. Miami University, 294 F.3d 797, 803, 817-19 (6th Cir. 2002) (finding disclosure of student disciplinary records “and the personally identifiable information contained therein” to a newspaper would cause irreparable harm)).
And, by the same token, courts have declined to find irreparable injury where the challenged disclosure is not “public,” but involves individuals obligated to keep it confidential. See, e.g., Ashland Oil, Inc., 409 F. Supp. at 308 (declining to find that disclosure of trade secrets to congressional subcommittee would cause irreparable harm because it would “not lead inexorably to either public dissemination or disclosure“); Baker DC v. Nat‘l Lab. Rels. Bd., 102 F. Supp. 3d 194, 203 (D.D.C. 2015) (declining to find that employеes would suffer irreparable harm from disclosure of their personal information to a union because regulations placed “limits” on the union‘s use of the information). Here, the Ramada declaration attests that the six employees at issue “understand that—like all Department of Education employees—they must comply with all applicable laws and regulations should they wish to share any information garnered during their work,” Dkt. 16-1 at 4 (Ramada Decl. ¶ 16), and he attests that, to his knowledge, none of the information at issue has been shared with any other “DOGE-affiliated individuals,” Dkt. 18-2 at 3 (Supp. Ramada Decl. ¶ 7). He further attests, moreover, that none of the six employees at issue will access “any tax-related information” without first obtaining the “appropriate authorization,” and even then, those employees will access the information only “for purposes consistent with applicable law, such as conducting analyses to estimate costs related to student loan repayment plans, awards, or debt discharges.” Dkt. 16-1 at 3 (Ramada Decl. ¶ 11). Notably, all of the “applicable laws and regulations,” which Ramada attests the six employees will follow, impose strict limits on the use and disclosure of Privacy Act protected records and tax return information, and they impose criminal penalties and potential сivil liability on those who willfully ignore their obligations.
UCSA, in contrast, cites no authority for the proposition that mere “access” to personal data by government employees who are not formally authorized to view it, without more, creates an irreparable injury. Perhaps implicitly recognizing this infirmity, UCSA suggests that emergency relief is nonetheless needed to prevent future injuries. UCSA argues that there is a “risk” of “identity theft,” a “risk” of “further dissemination” of their dаta, and a “risk” that ED will “share[]” members’ data with other agencies to use for “immigration enforcement.” Dkt. 9 at 33, 40. These harms, however, are entirely conjectural. UCSA provides no evidence, beyond sheer speculation, that would allow the Court to infer that ED or DOGE staffers will misuse or further disseminate this information.4 Moreover, “the courts must presume” that the government will exercise its powers “responsibly” and with “due regard” to affected individuals. Ashland Oil, Inc., 409 F. Supp. at 308. This “presumption of regularity supports the official acts of public officers, and, in the absence of clear evidence to the contrary, courts presume that they have properly discharged their official duties.” United States v. Chem. Found., 272 U.S. 1, 14-15 (1926).
ED and DOGE staffers are obligated to use UCSA members’ information for lawful purposes within the mission of the Department of Education and to keep it confidential, in accordance with the Privacy Act, tax laws, and other federal laws. Ramada attests that he and the other DOGE-affiliated employees had access to ED‘s systems, “to audit those programs for waste, fraud, and abuse,” Dkt. 16-1 at 3 (Ramada Decl. ¶ 9), and to identify “contracts
therefore, far from likely, let alone “certain” and “great.” Chaplaincy of Full Gospel Churches, 454 F.3d at 297.
Finally, the remedies provided in the Privacy Act and the Internal Revenue Code confirm that UCSA‘s members are not suffering (and will not suffer) an irreparable harm. In general, injuries are not “irreparable” if there is a “possibility” that “adequate compensatory or other corrective relief will be available at a later date.” Chaplaincy of Full Gospel Churches, 454 F.3d at 297 (quoting Wisc. Gas. Co., 758 F.2d at 674); see Richards v. Delta Air Lines, Inc., 453 F.3d 525, 531 n.6 (D.C. Cir. 2006) (“The general rule is that injunctive relief will not issue whеn an adequate remedy at law exists.“). Here, both the Privacy Act and the Internal Revenue Code provide a private right of action and money damages for certain unauthorized disclosures. See
CONCLUSION
For the reasons explained above, UCSA‘s motion for a temporary restraining order, Dkt. 9, is DENIED.
SO ORDERED.
/s/ Randolph D. Moss
RANDOLPH D. MOSS
United States District Judge
Date: February 17, 2025