Asylum Seekers Trying to Assure Their Safety v. Johnson

                                UNITED STATES DISTRICT COURT
                                FOR THE DISTRICT OF COLUMBIA

 ASYLUM SEEKERS TRYING TO
 ASSURE THEIR SAFETY, et al.,

         Plaintiffs,

 v.                                                                 Case No. 1:23-cv-163-RCL

 PATRICK “P.J.” LECHLEITNER, in his
 official capacity as Acting Director of U.S.
 Immigration and Customs Enforcement, et
 al.,

          Defendants.


                                      MEMORANDUM OPINION

        This case arises out of an incident in which an employee of U.S. Immigration and Customs

Enforcement (ICE), an agency of the Department of Homeland Security, posted to the agency’s

public-facing website information concerning 6,252 noncitizens currently or formerly in ICE

custody. Forty-nine of these individuals have now sued Patrick “P.J.” Lechleitner, in his official

capacity as Acting Director of ICE,1 Alejandro Mayorkas, in his official capacity as Secretary of

Homeland Security, Merrick Garland, in his official capacity as Attorney General of the United

States, and John Doe 1, the ICE employee who allegedly posted the information, in their official

capacity as an ICE employee.

        Defendants have moved to dismiss plaintiffs’ First Amended Complaint (FAC), ECF No.

6. The Court concludes it must dismiss the complaint in its entirety. Plaintiffs lack Article III

standing to seek injunctive or declaratory relief, and three of their four claims for damages are




1
  Plaintiffs initially named Tae D. Johnson but substituted Mr. Lechleitner as a named party under Federal Rule of
Civil Procedure 25(d). See ECF No. 50.



                                                        1
barred by sovereign immunity. Plaintiffs also lack Article III standing to pursue the remaining

claim, for violation of the Privacy Act, and in any event have failed to state a claim upon which

relief can be granted.

       In dismissing this action, the Court does not downplay the gravity of ICE’s alleged failure

to safeguard the data of vulnerable people in its custody. But for the reasons discussed below, the

Court must GRANT defendants’ motion to dismiss plaintiffs’ complaint in its entirety. Since the

Court will dismiss plaintiffs’ action, it must also DENY AS MOOT plaintiffs’ pending motions

to certify a class and to compel. However, it will GRANT plaintiffs’ motion for leave to file a

document under seal.

                                     I.    BACKGROUND

   A. Factual Background

       Plaintiffs are non-United States citizens who came to the United States to seek asylum and

were then detained by ICE. FAC ¶ 2. They hail from Colombia, the Dominican Republic,

Ecuador, El Salvador, France, Guatemala, Haiti, Honduras, India, Jamaica, Mexico, Nicaragua,

Peru, Tunisia, and Venezuela. Id. ¶ 1. Many fled their native lands to escape “gang violence,

government retaliation, and persecution on the basis of protected grounds.” Id. ¶ 6. By now,

plaintiffs are at various stages in the asylum process. Some have already had their asylum claims

adjudicated, some have submitted an application that is awaiting adjudication, and some have not

yet submitted an application. Id. ¶ 3. Some but not all plaintiffs are still detained by ICE. Id. ¶ 1.

       On November 28, 2022, ICE employee John Doe 1 allegedly posted a document containing

the names, other personally identifiable information, and immigration information of 6,252

noncitizens currently or formerly in ICE custody, including plaintiffs, to the agency’s public-

facing website. Id. ¶ 68. For about five hours, the information remained up on the website, where




                                                  2
it “was able to be downloaded, copied, captured by screenshot, and otherwise preserved by the

public.” Id. ¶¶ 71–72.

         Two days later, ICE acknowledged the release of information and explained that after this

“breach of policy,” “the agency [was] investigating the incident and taking all corrective actions

necessary.” Id. ¶ 73. ICE has since announced a range of mitigation efforts. See Exhibit B, ECF

No. 6-2 (“FAQ”). For one thing, ICE has sought to separately notify each affected individual.2

Id. 2. ICE also delayed the removal of affected noncitizens, initially for 30 days, id., and then

indefinitely “to allow them time to further discuss their options with a legal representative.”

FAC ¶ 82. ICE also sent “clawback” letters to “all external entities or individuals that may have

downloaded, received, or accessed the document” requesting that recipients destroy the document

and refrain from using or disclosing the information it contained. FAQ at 4. Finally, ICE has

committed to affording all affected noncitizens an opportunity to raise the data breach issue in

removal proceedings, so that they can argue for asylum on the basis that the breach created a

danger that their persecutors will use the information to target them should they be deported. See

FAQ 2–4; FAC ¶ 87.3

    B. Procedural Background

         Plaintiffs filed their complaint in January, 2023. See Complaint, ECF No. 1. On February

17, they filed the First Amended Complaint. See FAC. Plaintiffs bring four claims. First, plaintiffs



2
  All of the plaintiffs received written notice from ICE. Declaration in Support of Pls.’ Mot. for Class Certification,
ECF Nos. 16-1–16-49.
3
  Plaintiffs allege that another breach occurred in December 2022. They state that DHS informed the Government of
Cuba that some of the 103 Cuban nationals awaiting removal from the United States to Cuba were among the
individuals who data was leaked in the November 28 breach—and thus revealed to the Cuban authorities that some of
the individuals due to be removed to Cuba had sought asylum. FAC ¶ 78. Plaintiffs allege that forty-six of the
individuals had in fact been named in the November leak, and that after the December incident ICE released some or
all of the 103 affected individuals. Id. However, plaintiffs have not alleged that any of the plaintiffs belong to this
group of forty-six people. Plaintiffs have apparently included this allegation to show DHS and ICE’s laxity on
information security, rather than to allege a separate violation of the law.


                                                          3
allege that defendants violated the Privacy Act of 1974 because DHS and ICE “did not establish

appropriate administrative, technical, and physical safeguards to prevent the data breach” (First

Claim for Relief). FAC ¶ 119. Second, plaintiffs assert a claim under the Administrative

Procedure Act for a host of reasons, including that “Defendants’ failure to safeguard plaintiffs’

personal information from public disclosure constitutes agency action taken not in accordance with

the law” (Second Claim for Relief). Id. ¶ 127. Third, plaintiffs venture a freestanding claim for

violation of the Accardi doctrine, according to which an administrative agency must follow its own

regulations and procedures (Third Claim for Relief). Id. ¶¶ 133–34; see also United States ex rel.

Accardi v. Shaughnessy, 

 (1954). Fourth, plaintiffs assert that defendants violated

“equal protection principles of the Fourteenth Amendment, embedded in the Due Process Clause

of the Fifth Amendment” by breaching “affirmative duties of care and protection” (Fourth Claim

for Relief). 

 ¶¶ 147–48 (quoting DeShaney v. Winnebago Cnty. Dep’t of Soc. Servs., 

 (1989)).

        As for remedies, plaintiffs seek money damages, see FAC, Prayer for Relief ¶¶ H–I, as

well as a declaration that the defendants violated the Privacy Act, the APA, and the Constitution.

 ¶ B.    Plaintiffs also seek wide-ranging injunctive relief against ICE and the Department of

Justice. They ask for the Court to order ICE “to extend the original 30-day stay of removal for all

impacted individuals to one year,” notify those who opted out of the initial stay “that they may

take advantage of the additional stay,” and “cease the removal of Plaintiffs, and others similarly

situated until their asylum and withholding of removal claims can be re-adjudicated, with the

presumption of risk of danger created by the data breach and a presumption that each asylee’s fear

is well-founded.” 

 ¶¶ C–D. In addition, they request that the Court order “DOJ”4 “to rescind


4
 The Department of Justice is not a party to this case. The plaintiffs apparently have in mind the Attorney General,
who has been named a defendant in his official capacity.


                                                         4
removal orders and reopen removal proceedings” for affected individuals, “to extend

accommodations to Plaintiffs and others similarly situated so that the merits of any application for

asylum, withholding of removal, and/or protection under the Convention Against Torture can be

considered or reconsidered in light of the data breach, with the presumption of risk of danger

created by the data breach and a presumption that each asylee’s fear is well-founded,” and “to

instruct immigration judges to take administrative notice to recognize a presumption of risk of

danger created by the data breach and a presumption that each asylee’s fear is well-founded.” 

¶¶ C–G.

          Defendants moved to dismiss the FAC in its entirety for lack of subject matter jurisdiction

under Federal Rule of Civil Procedure 12(b)(1) and failure to state a claim under Rule 12(b)(6).

See MTD, ECF No. 33. Plaintiffs filed a response, see Pls.’ Opp’n, ECF No. 39, to which

defendants filed a reply, see Defs.’ Reply, ECF No. 45. In addition, the Immigration Reform Law

Institute moved for leave to file an amicus curiae brief, which the Court granted. See IRLI Amicus,

ECF No. 51.5 Plaintiffs have twice filed notices of change in material facts. See ECF No. 46; ECF

No. 49.

          Three other motions are pending. First, plaintiffs moved to certify a class under Federal

Rule of Civil Procedure 23. See ECF No. 16. The Court deferred ruling on that matter. See ECF

No. 36. Second, plaintiffs moved to compel defendants to produce a “certified list of the

administrative record” pursuant to Local Civil Rule 7(n). See ECF No. 34. Defendants filed a

response, see ECF No. 41, and plaintiffs filed a reply, see ECF No. 43. Third, plaintiffs have filed

a sealed motion for leave to file under seal exhibits relating to the second notice of change in

material facts. See ECF No. 47.


5
 Because the Court does not reach the merits of plaintiffs’ constitutional claims, it will not consider the arguments
advanced by amicus.


                                                         5
                                 II.    LEGAL STANDARDS

   C. Federal Rule of Civil Procedure 12(b)(1)

       A defendant in a civil action may move to dismiss a complaint under Federal Rule of Civil

Procedure 12(b)(1) for lack of subject-matter jurisdiction. See Fed. R. Civ. P. 12(b)(1). If the

Court lacks subject matter jurisdiction, it must dismiss the claim or action. Fed. R. Civ. P. 12(h)(3).

Article III of the Constitution vests in the federal court authority to adjudicate “Cases” and

“Controversies.” U.S. Const., art. III, § 2. For a lower federal court to have subject-matter

jurisdiction over a case or controversy, Congress must provide such jurisdiction by statute within

the bounds of the Constitution’s grant of jurisdiction. Kokkonen v. Guardian Life Ins. Co. of Am.,

 (1994).

       A court considering a motion to dismiss for lack of subject matter jurisdiction must take

all the well-pleaded allegations in the complaint as true and draw all reasonable inferences in the

plaintiff’s favor. Doe v. Wash. Metro. Area Transit Auth., 

, 361 (D.D.C. 2020).

“However, those factual allegations receive closer scrutiny than they do in the Rule 12(b)(6)

context,” and the court “may look to documents outside of the complaint in order to evaluate

whether or not it has jurisdiction to entertain a claim.” 

 (internal quotation marks and citations

omitted). It is the “[p]laintiff [who] bears the burden of proving subject matter jurisdiction by a

preponderance of the evidence.” Am. Farm Bureau v. EPA, 

 (D.D.C. 2000).

   D. Federal Rule of Civil Procedure 12(b)(6)

       A defendant in a civil action may also move to dismiss a complaint under Federal Rule of

Civil Procedure 12(b)(6) for “failure to state a claim upon which relief can be granted.” See Fed.

R. Civ. P. 12(b)(6). To survive a Rule 12(b)(6) motion, a complaint must contain sufficient factual

allegations, accepted as true, to “state a claim to relief that is plausible on its face.” Ashcroft v.

Iqbal, 

 (2009) (quoting Bell Atl. Corp. v. Twombly, 

 (2007)).


                                                  6
A claim is plausible on its face if it “pleads factual content that allows the court to draw the

reasonable inference that the defendant is liable for the misconduct alleged.” 

 A court

evaluating a Rule 12(b)(6) “motion presumes that the complaint’s factual allegations are true and

construes them liberally in the plaintiff's favor.” Alemu v. Dep’t of For-Hire Vehicles, 

 (D.D.C. 2018). However, “[a] court need not accept a plaintiff’s legal conclusions

as true, . . . nor must a court presume the veracity of legal conclusions that are couched as factual

allegations.” 

 (citation omitted).

                                        III.   DISCUSSION

        The Court concludes that it lacks subject matter jurisdiction to entertain this action.

Plaintiffs lack Article III standing to seek injunctive or declaratory relief because they have not

alleged an ongoing or future violation of their rights by defendants. And plaintiffs’ claims for

money damages under the APA, Accardi, and the Due Process Clause are barred by sovereign

immunity because Congress has not consented to such suits. Plaintiffs’ Privacy Act claim fails

because they have not established Article III standing to seek damages under the Act. Even if they

have standing, they have not plausibly alleged a cognizable violation of the statute.

    A. Plaintiffs Lack Standing to Seek Injunctive or Declaratory Relief

        The Court lacks jurisdiction to entertain plaintiffs’ claims for injunctive or declaratory

relief because plaintiffs lack Article III standing to seek such relief.

        “The doctrine of standing implements” the requirement of an Article III case or

controversy “by insisting that a litigant ‘prove that he has suffered a concrete and particularized

injury that is fairly traceable to the challenged conduct, and is likely to be redressed by a favorable

judicial decision.’” Carney v. Adams, 

 (2020) (quoting Hollingsworth v. Perry,

 (2013)). A litigant may have standing to pursue certain forms of relief but not

others. See, e.g., Friends of the Earth, Inc. v. Laidlaw Env’t Servs. (TOC), Inc., 

, 185


                                                   7
(2000) (“[A] plaintiff must demonstrate standing separately for each form of relief sought.”). “[A]t

the pleading stage, a plaintiff must allege facts demonstrating each element” of standing. Friends

of Animals v. Jewell, 

 (D.C. Cir. 2016). If the plaintiff lacks standing, the court

lacks subject matter jurisdiction. Haase v. Sessions, 

 (D.C. Cir. 1987). Here,

defendants correctly argue that “Plaintiffs lack standing to seek declaratory and injunctive relief

because they allege a past legal harm (the inadvertent disclosure), not an ongoing alleged violation

or imminent future violation.” MTD at 1.

        To the extent plaintiffs seek injunctive and declaratory relief, this case is squarely

controlled by Supreme Court and D.C. Circuit precedent. In City of Los Angeles v. Lyons, a

plaintiff brought a civil rights action against the City of Los Angeles and certain police officers,

alleging that L.A. police had subjected him to an unconstitutional chokehold after stopping him

for a traffic violation, and that L.A. had authorized police officers to routinely apply unwarranted

chokeholds. 

, 97–98 (1983). Lyons sought damages as well as injunctive and

declaratory relief. 

. The Supreme Court held that because Lyons was not immediately

threatened by the prospect of another chokehold, he had “failed to demonstrate a case or

controversy . . . that would justify the equitable relief sought.” 

. In coming to this

conclusion, the Court emphasized that “[p]ast exposure to illegal conduct does not in itself show

a present case or controversy regarding injunctive relief . . . if unaccompanied by any continuing,

present adverse effects.” 

 at 102 (quoting O’Shea v. Littleton, 

, 495–96 (1974))

(alternation in original).

        Applying Lyons, the D.C. Circuit has explained that “[t]o pursue an injunction or a

declaratory judgment,” plaintiffs “must allege a likelihood of future violations of their rights by”

the defendant, “not simply future effects from past violations.” Fair Emp. Council of Greater




                                                 8
Washington, Inc. v. BMC Mktg. Corp., 

 (D.C. Cir. 1994); see also Dearth v.

Holder, 

 (D.C. Cir. 2011) (“In a case of this sort, where the plaintiffs seek

declaratory and injunctive relief, past injuries alone are insufficient to establish standing. Rather,

Dearth must show he is suffering an ongoing injury or faces an immediate threat of injury.”); Black

Lives Matter D.C. v. Trump, 

, 36 (D.D.C. 2021) (applying holding of Fair Emp.

Council of Greater Washington), aff’d sub nom. Buchanan v. Barr, 

 (D.C. Cir. 2023).

       Here, plaintiffs do not seek injunctive or declaratory relief to remedy future violations of

their rights by the defendants. Plaintiffs argue that they have “never alleged the injury was the

publishing of their [personally identifiable information] itself,” but rather that the leak put

plaintiffs in danger by providing their “persecutors with information that makes it easier for

Plaintiffs to be located today or in the future.” See Pls.’ Opp’n at 10–11; FAC ¶¶ 6, 120–22, 131.

But that means plaintiffs do not “allege a likelihood of future violations of their rights by” the

governmental defendants, but instead seek relief addressed at “future effects” (i.e., harm by third

parties) “from past violations” by ICE. See Fair Emp. Council of Greater Washington, 

. And although plaintiffs suggest they may suffer emotional distress from the future effects

of the leak, FAC ¶ 122, “[t]he emotional consequences of a prior act simply are not a sufficient

basis for an injunction absent a real and immediate threat of future injury by the defendant.” Lyons,

 n.8.

       Perhaps sensing a need to tie their harm to future action by the defendants rather than third

parties, plaintiffs justify their standing to seek injunctive and declaratory relief because “DHS must

be held accountable to end what appears to be a Department-wide culture of disregarding the

privacy of asylum seekers.” Pls.’ Opp’n at 11 (quoting FAC ¶ 8). But under Lyons, standing to

seek such relief cannot be premised on a desire to hold the government “accountable” for harmful




                                                  9
practices, even if widespread. See Lyons, 

 (noting that although L.A. police may

continue to use illegal chokeholds, “it is surely no more than speculation to assert” that Lyons

himself would face the risk of a chokehold in the future).

        Finally, plaintiffs cannot evade Lyons by recasting their allegations about past violations

as a challenge to ongoing agency failures. Plaintiffs object to “ICE’s failure to sufficiently address

the harm the agency caused” and “DOJ’s failure to account for the harms to Plaintiffs and proceed

with removal processes despite those harms.” See FAC ¶¶ 129–30. But they have not explained

how either of these failures to adequately “address” or “account for” the harm plaintiffs

experienced in the data breach are themselves violations of plaintiffs’ rights. And if “the injury

ICE’s victims face was not incurred in the moment of Defendants’ unlawful act,” Pls.’ Opp’n at

10, then it is unclear how ICE’s inadequate mitigation of the non-injury could itself be an injury

sufficient for Article III standing. And even if plaintiffs had alleged an injury from the data breach

itself, inadequate mitigation of the effects of a past harm is not necessarily itself a continuing harm.

Indeed, plaintiffs do not allege that the mitigation efforts themselves violate any specific legal

right; plaintiffs simply label these responses “not in accordance with the law” and “an abuse of

discretion.” See FAC ¶¶ 129–30.

        In light of Lyons and its progeny, plaintiffs lack standing to seek injunctive or declaratory

relief. The Court, then, may not entertain these requests for relief.




                                                  10
   B. Sovereign Immunity Bars Plaintiffs’ Claims Under the APA, Accardi, and the Due
      Process Clause, But Not Plaintiffs’ Claims under the Privacy Act

         Plaintiffs’ claims for damages fare only slightly better. Sovereign immunity bars plaintiffs’

claims under the APA, Accardi, and the Due Process Clause. However, it does not bar plaintiffs’

claims under the Privacy Act.

         “Absent [consent by the federal government] the doctrine of sovereign immunity shields

the federal government from suit” by depriving courts of jurisdiction. Tri-State Hosp. Supply

Corp. v. United States, 

 (D.C. Cir. 2003). Sovereign immunity does not just

protect employers; it also “bar[s] suits for money damages against officials in their official capacity

absent a specific waiver by the government.” Clark v. Libr. of Cong., 

 (D.C. Cir.

1984). Since plaintiffs have sued the defendants in their official capacity, sovereign immunity

clearly bars all of plaintiffs’ claims for money damages, except for the Privacy Act claim—as

plaintiffs concede, see Pls.’ Opp’n at 16–17 (“[I]f Defendants wish to use the sovereign immunity

defense to only pay damages exclusively to ROE #3, and other victims from predominantly white

European countries, when most of their victims are Black and Brown and from predominantly

non-white countries in the Global South, plaintiffs concede that is something they can lawfully

do.”).

         First, plaintiffs’ APA claim is clearly barred by sovereign immunity. In 1976, Congress

amended the APA to effect a broad waiver of sovereign immunity for certain suits against federal

agencies “seeking relief other than money damages.” See 

 (emphasis added). Here,

plaintiffs are seeking money damages from the United States, which is plainly beyond the scope

of the APA’s waiver of sovereign immunity. Second, even if plaintiffs have a cause of action

under Accardi, any such suit for money damages would be barred by sovereign immunity because

plaintiffs have failed to identify a Congressional waiver of sovereign immunity for such claims.



                                                  11
Third, “it is well settled ‘that Congress has not waived immunity for suits seeking monetary

damages that arise under the Constitution.’” Scinto v. Fed. Bureau of Prisons, 

 (D.D.C.) (quoting Zinda v. Johnson, 

, 48–49 (D.D.C. 2006), aff’d, 

 (D.C. Cir. 2009). Therefore, the Court lacks jurisdiction to entertain plaintiffs’ claims

for money damages under the APA, Accardi, or the Constitution.

       As for plaintiffs’ claims for damages under the Privacy Act, however, defendants concede

that this statute does indeed waive sovereign immunity. MTD at 21; see In re U.S. Office of Pers.

Mgmt. Data Sec. Breach Litig. (OPM Breach Litig.), 

 (D.C. Cir. 2019) (“The

Privacy Act waives sovereign immunity by expressly authorizing a cause of action for damages

against federal agencies that violate its rules protecting the confidentiality of private information

in agency records.”).

   C. Plaintiffs Lack Article III Standing to Sue Under the Privacy Act

       Plaintiffs have failed to establish Article III standing to bring their Privacy Act claim.

Alternatively, even if they have standing they have failed to state a claim upon which relief can be

granted.

       1. Plaintiffs Lack Standing to Sue Under the Privacy Act

       Since plaintiffs say their injury is not the leak of their information but instead the risk that

persecutors will one day use this information to target them, they have failed to sufficiently allege

Article III standing to pursue a remedy under the Privacy Act.

       “To qualify for standing, a claimant must present an injury that is [1] concrete,

particularized, and actual or imminent; [2] fairly traceable to the defendant’s challenged behavior;

and [3] likely to be redressed by a favorable ruling.” Davis v. Fed. Election Comm’n, 

 (2008). If the purported injury were the disclosure of private information, plaintiffs might

have standing. As the Supreme Court recently observed, one example of an intangible harm that


                                                 12
is nonetheless concrete is “disclosure of private information.” TransUnion LLC v. Ramirez, 

 (2021) (citing Davis, 

). It would seem that plaintiffs suffered a

concrete, particularized, and actual injury, redressable through damages, when ICE released

private information related to them. One could argue that this harm is fairly traceable at least to

John Doe #1, the Director of ICE, and the Secretary of Homeland Security.

       However, plaintiffs have expressly disclaimed reliance on the breach itself as their injury.

See Pls.’ Opp’n at 10 (“Plaintiffs never alleged the injury was the publishing of their [personally

identifiable information] itself . . . . [T]he injury ICE’s victims face was not incurred in the moment

of Defendants’ unlawful act”). Instead, plaintiffs argue that “[a]s a result of Defendants’ actions,

Plaintiffs have an enhanced risk of injury” in the future from persecutors who may have greater

ability and motivation to harm them because of the breach. See Pls.’ Opp’n at 10–11; FAC ¶¶ 6,

120–22, 131. Plaintiffs do not have Article III standing based on the future risk that persecutors

will harm them because they have not met their burden to allege facts demonstrating any of the

three elements of standing. See Friends of Animals, 

.

       First, an injury must be “actual or imminent, not ‘conjectural’ or ‘hypothetical.’” Lujan v.

Defs. of Wildlife, 

 (1992) (quoting Whitmore v. Arkansas, 

(1990)). A theory based on a “speculative chain of possibilities” does not suffice. See Clapper

v. Amnesty Int’l USA, 

 (2013). Here, plaintiffs’ theory of future injury is “riddled

with contingencies and speculation.” Trump v. New York, 

 (2020). For

instance, they state that they will be at increased risk of retaliation even within the United States,

FAC ¶ 121, without offering facts to indicate a realistic possibility of asylees being tracked down

and attacked by persecutors on American soil. And although plaintiffs state that they “face a real

risk of persecution and/or death if they are forced to return to their home countries where, as a




                                                  13
result of the data breach, the foreign governments may know or learn that they sought asylum in

the U.S.,” id. ¶ 120, they do not explain why foreign persecutors would subject them to additional

harm for having sought asylum in the United States.

       Another problem for plaintiffs is causation. “[T]he injury has to be ‘fairly . . . trace[able]

to the challenged action of the defendant, and not . . . th[e] result [of] the independent action of

some third party not before the court.’” Lujan, 504 U.S. at 560–61 (alterations in the original)

(quoting Simon v. Eastern Ky. Welfare Rights Organization, 

, 41–42 (1976)). To

establish a sufficient chain of causation between the governmental act and the conduct of third

parties, a plaintiff’s theory of standing cannot “rest on mere speculation about the decisions of

third parties” but instead must rely “on the predictable effect of Government action on the

decisions of third parties.” See Dep’t of Com. v. New York, 

 (2019); see also

Clapper, 

 (noting the Supreme Court’s “usual reluctance to endorse standing

theories that rest on speculation about the decisions of independent actors”); Allen v. Wright, 

 (1984) (concluding that an “alleged injury is not fairly traceable to the

assertedly unlawful conduct of the” government when the link between the injury and the

government’s conduct involves an attenuated “chain of causation” involving third parties). In this

case, plaintiffs’ theory that the data breach will lead persecutors to target them relies on several

intervening steps, including the persecutors being willing and able to target them for having sought

asylum and the persecutors obtaining access to the leaked information. At each stage, plaintiffs

can only speculate about what the third parties will do. Plaintiffs have therefore not established

that the “predictable effect” of ICE’s data breach “on the decisions of third parties” will result in

injury to plaintiffs. See Dep’t of Com., 

.




                                                 14
         For similar reasons, it is not “‘likely,’ as opposed to merely ‘speculative,’ that the injury

will be ‘redressed by a favorable decision.’” Lujan, 

 (quoting Simon, 

). While money damages could be used to pay for such protective steps as purchasing

security systems, see FAC ¶ 121, and such mitigation measures as counseling, id. ¶ 122, plaintiffs

have not alleged that they will likely do any of these things, only that they “may” do so.

         By asserting the risk of future harm by third parties as their injury, plaintiffs have failed to

establish Article III standing to pursue a claim under the Privacy Act.

         2. Even If Plaintiffs Could Establish Standing, They Have Not Plausibly Alleged a
            Violation of the Privacy Act

         Were standing no obstacle, plaintiffs’ Privacy Act claim would still fail because plaintiffs

have not adequately alleged a violation of the statute. For every plaintiff except Roe #3, the statute

does not authorize recovery of damages for the violation alleged. For Roe #3, the complaint fails

to adequately allege key elements of the claim.

         The Privacy Act provides that “[n]o agency shall disclose any record which is contained in

a system of records by any means of communication to any person, or to another agency, except

pursuant to a written request by, or with the prior written consent of, the individual to whom the

record pertains” in the absence of exceptions not relevant in this case. See 5 U.S.C. § 552a(b).

Plaintiffs state that “[o]n information and belief, DHS and ICE specifically, did not establish

appropriate administrative, technical, and physical safeguards to prevent the data breach.” FAC

¶ 119.

         The first problem for plaintiffs is that “the Privacy Act protects only ‘individuals.’” Soto

v. United States Dep’t of State, 

 (D.D.C. 2017) (citing 5 U.S.C.

§§ 552a(b)–(f)). And it defines an individual to be “a citizen of the United States or an alien

lawfully admitted for permanent residence.” 5 U.S.C. § 552a(a)(2). To be sure, the Judicial



                                                   15
Redress Act expanded the right to pursue claims under the Privacy Act to citizens of designated

foreign countries or regional economic integration organizations. See Judicial Redress Act of

2015, 

 Stat. 282 (2016). The Attorney General is authorized to make

such designations. Judicial Redress Act, § 2(d)(1); see also 

 (Jan. 23, 2017).

However, plaintiffs acknowledge that none of the plaintiffs are citizens of designated countries

except for plaintiff Roe #3, who is a citizen of France. Pls.’ Opp’n at 16; FAC ¶¶ 17, 97, 118, 143.

Accordingly, in response to defendants’ Motion to Dismiss, plaintiffs conceded “Plaintiffs ROE

#1-#2, and ROE #4-#49 do not state viable Privacy Act claims.” Pls.’ Opp’n at 17.6 However,

plaintiffs still maintain that Roe #3 states a viable claim.

         But even Roe #3’s Privacy Act claim must fail because the FAC does not plausibly allege

a claim under the Act. The D.C. Circuit has explained that “[t]o unlock the Privacy Act’s waiver

of sovereign immunity and state a cognizable claim for damages, a plaintiff must allege that (i) the

agency ‘intentional[ly] or willful[ly]’ violated the Act’s requirements for protecting the

confidentiality of personal records and information; and (ii) she sustained ‘actual damages’ (iii)

‘as a result of’ that violation.” OPM Breach Litig., 

 (alterations in the original)

(quoting 5 U.S.C. § 552a(g)(4)).               In this context, “willfulness means more than ‘gross

negligence.’” Id. (quoting Maydak v. United States, 

 (D.C. Cir. 2010)).

Therefore, “[a]llegations . . . that errors were ‘inadvertent[]’ will not suffice.” 

 (alteration in the

original) (quoting Maydak, 

). As for “actual damages,” that refers only “to proven

pecuniary or economic harm.” 

 at 64 (citing Federal Aviation Admin. v. Cooper, 

,




6
  Plaintiffs at first acknowledged that only Roe #3 had a statutory right to pursue civil remedies under the Privacy Act
but contended that “other Plaintiffs are deserving of the same rights as ROE #3 under the Accardi doctrine.” FAC
¶ 143. But courts cannot disregard federal statutes to serve general notions of fairness. Any contention to the contrary
pushes the boundary of what can be considered “a nonfrivolous argument for extending, modifying, or reversing
existing law or for establishing new law.” See Fed. R. Civ. P. 11(b)(2).


                                                          16
298–299 (2012)). This “actual pecuniary loss” “must be specially pleaded and proved.” Cooper,

.

        Here, plaintiffs have failed to adequately allege either willfulness or actual damages. There

is nothing in plaintiffs’ complaint to suggest that “the agency’s security failures were ‘in flagrant

disregard of [their] rights under the Act,’ were left in place ‘without grounds for believing them to

be lawful,’ or were ‘so patently egregious and unlawful that anyone undertaking the conduct

should have known it unlawful.’” OPM Breach Litig., 

 (quoting Maydak, 

). Indeed, plaintiffs do not attempt to argue that they have alleged facts showing willfulness.

In arguing that their complaint alleged a willful violation, plaintiffs cite only two passages, which

read: “Whether the actions of Defendant JOHN DOE 1 were intentional or willful?” and “What

caused ICE to release a statement determining the data breach was ‘unintentional’ before the

conclusion [of] its investigation?” Pls.’ Opp’n 17 (quoting FAC ¶¶ 110(b), 110(h)). These

passages are drawn from the “Common Questions of Law and Fact” section in which the plaintiffs

seek to establish the existence of a class. But there is a difference between a mere question and a

factual allegation. To survive a motion to dismiss, a plaintiff’s complaint must “contain sufficient

factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.’” Iqbal, 

 (quoting Twombly, 

). Plaintiffs have both styled and labeled these

sentences as questions. These are not rhetorical or suggestive questions, but instead take the form

of open questions whose answers are unknown to plaintiffs. They are not “factual matter” that the

Court must accept in considering whether plaintiffs have adequately pleaded a claim. Plaintiffs

have therefore failed to allege the willfulness element necessary for a claim under the Privacy Act.

        Neither have plaintiffs alleged that Roe #3 incurred actual damages. Plaintiffs state that

they “face[]”actual damages because the data breach will make it easier for persecutors to locate




                                                   17
them, thus “imposing a lifetime of added security needs that will be expensive to meet.”

FAC ¶ 120. In particular, they may need to “adopt a nomadic lifestyle,” “purchase security

systems, change door and window locks, private mailboxes or obtain other protection to ensure

their physical safety,” and “incur costs related to legally changing their name.” Id. ¶ 121. They

“may also require counseling to process their experience.” Id. ¶ 122. But this litany consists only

of speculative, future costs. Plaintiffs speak of costs they “may” need to incur in the future, not

costs that Roe #3 has already experienced. Plaintiffs have thus failed to allege “proven pecuniary

or economic harm.” See OPM Breach Litig., 

.

        Therefore, even if Roe #3 has standing, plaintiffs have failed to adequately plead the only

claim over which the Court has subject matter jurisdiction.

   D. Plaintiffs’ Pending Motions to Certify a Class and to Compel Are Moot

    “Under Article III of the United States Constitution,” a federal court “‘may only adjudicate

actual, ongoing controversies.’” D.C. v. Doe, 

 (D.C. Cir. 2010) (quoting Honig

v. Doe, 

 (1988)). As the Court concludes that it must dismiss this action for

lack of subject matter jurisdiction and failure to state a claim, plaintiffs’ pending motions to certify

a class and to compel do not concern an ongoing controversy. They must therefore be denied as

moot.




                                                  18