Common Cause v. U.S. Department of Justice

UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLUMBIA COMMON CAUSE, et al., Plaintiffs, Civil Action No. 26 - 1352 (SLS) v. Judge Sparkle L. Sooknanan U.S. DEPARTMENT OF JUSTICE, et al., Defendants. MEMORANDUM OPINION The Civil Rights Division has been dubbed the “crown jewel” of the Justice Department. President Dwight D. Eisenhower authorized the Division as part of the Civil Rights Act of 1957, and three months later, it was born. The Division was forged in the Civil Rights Movement in response to massive resistance against racial integration. The Supreme Court’s landmark decision in Brown v. Board of Education, 344 U.S. 1 (1952), and our Nation’s new voting laws gave the Division its first missions. Even in its infancy, the Division stood at the forefront of the federal government’s efforts to protect Americans’ right to vote. And since then, generations of Civil Rights Division attorneys and staff have worked to protect that right—a sacred right that gives our citizenry a say in its government and secures all other individual rights against government interference. Against that backdrop, this case is anomalous. The Plaintiffs, a voting-rights organization and four individual voters, allege that the Civil Rights Division has set out on a mission antithetical to its purpose and history: to remove voters from voter rolls across the country, including United States citizens. They challenge a policy adopted by the current Civil Rights Division seeking unprecedented influence over states’ longstanding authorities to register eligible voters and maintain their voter rolls. Under the policy, the Plaintiffs say, the Division is demanding voter registration lists from all states, comparing those lists against a citizenship-status database plagued with inaccuracies, and urging states to remove voters who the Division deems ineligible. This policy, the Plaintiffs contend, has left untold numbers of disenfranchised voters in its wake and inflicted injuries to the Plaintiffs’ privacy and informational rights to boot. The Defendants, the Department of Justice (DOJ) and the Attorney General, insist that DOJ has the statutory authority to adopt this policy. But their claimed sources of authority raise eyebrows. The Defendants claim that statutes aimed at expanding the Civil Rights Division’s tools to protect the right to vote—the Civil Rights Act of 1960, the National Voter Registration Act, and the Help America Vote Act—give the Division the authority to demand that states remove United States citizens from their rolls. In furtherance of this position, the Defendants make other startling arguments. They suggest that every American citizen who registers to vote is the subject of a voter fraud investigation underway in the Civil Rights Division simply because they registered to vote. And the Defendants downplay the risk of voter disenfranchisement—despite knowingly relying on an inaccurate database to check voter eligibility. Behind all the window dressing, the challenged policy represents the federal government’s attempt to decide who gets to vote. But Congress has left that authority where our Constitution has always placed it: with the states. DOJ cannot run roughshod over longstanding laws that were carefully crafted to protect the rights of the American people. The Civil Rights Division’s policy is unlawful in several respects. First, the Defendants’ claimed authorities—Civil Rights Act of 1960, the National Voter Registration Act, and the Help America Vote Act—do not authorize the policy. Second, the policy is arbitrary and capricious under the Administrative Procedure Act. Third, the policy violates both substantive and procedural protections in the Privacy Act, a statute designed to ban federal data 2 banks and preserve the American tradition of limited, transparent government. And fourth, the policy violates limits imposed by the Paperwork Reduction Act. The Court therefore sets aside and vacates the challenged policy under the Administrative Procedure Act. Today’s decision does not prevent the federal government from taking lawful steps to support states’ efforts to maintain accurate voter rolls. Neither does it prevent states from maintaining their own voter rolls. And to state the obvious, the Court’s decision does not pave the way for ineligible voters to vote in our elections. Rather, the Court vacates a policy that has removed United States citizens from the voter rolls in their home states and risks disenfranchising many more—a policy that flies in the face of duly enacted laws designed to protect Americans. When the federal government defies federal laws, our system of checks and balances permits individuals to turn to federal courts for recourse. And if they prevail, courts are duty-bound to step in under the Constitution. BACKGROUND A. Statutory Background This case involves a quintet of statutes: the Civil Rights Act of 1960, the National Voter Registration Act, the Help America Vote Act, the Privacy Act, and the Paperwork Reduction Act. 1. Voter Protection Laws Congress passed the Civil Rights Act of 1960, Pub. L. No. 86-449, 74 Stat. 86 (1960) (codified at 52 U.S.C. § 20701 et seq.), to buttress the “voting provisions of the Civil Rights Act of 1957” and to “assur[e] full rights of suffrage to all Americans,” United States v. Mayton, 335 F.2d 153, 159 (5th Cir. 1964); see also Alabama ex rel. Gallion v. Rogers, 187 F. Supp. 848, 852 (M.D. Ala. 1960) (“[T]he entire history of the [1960 Civil Rights Act] reflects that it was and is designed to provide a means of enforcing the basic federally guaranteed rights of citizenship (to vote) against state action.”), aff’d sub nom. Dinkens v. Att’y Gen., 285 F.2d 430 (5th Cir. 1961). 3 Title III of the 1960 Act provides that “[e]very officer of election shall retain and preserve . . . all records and papers which come into his possession relating to any application, registration, payment of poll tax, or other act requisite to voting” “for a period of twenty-two months from the date of any general, special, or primary election of which candidates for the [federal offices] are voted for[.]” 52 U.S.C. § 20701. To enforce that record-retention requirement, Title III requires that any record covered by Section 20701 be made available to the Attorney General upon “demand in writing,” so long as the demand “contain[s] a statement of the basis and the purpose therefor.” Id. § 20703. And Title III vests district courts with “jurisdiction by appropriate process to compel the production” of records demanded under Section 20703. Id. § 20705. Roughly three decades later, in 1993, Congress enacted the National Voter Registration Act (NVRA), Pub. L. No. 103-31, 107 Stat. 77 (1993) (codified at 52 U.S.C. § 20501 et seq.), “to address concerns that voter registration laws and procedures were depressing voter turnout,” United States v. Evans, No. 25-cv-4403, 2026 WL 2267774, at *2 (D.D.C. Aug. 6, 2026). Accordingly, “[t]he NVRA requires States to provide simplified systems for registering to vote in federal elections[.]” Young v. Fordice, 520 U.S. 273, 275 (1997) (emphasis omitted). And it “imposes requirements about just when, and how, States may remove people from the federal voter rolls.” Id. at 276 (citing 52 U.S.C. § 20507(a)(3)–(4)). Relevant here, the NVRA requires that each state “conduct a general program that makes a reasonable effort to remove the names of ineligible voters from the official lists of eligible voters by reason of . . . the death of the registrant; or . . . a change in the residence of the registrant[.]” 52 U.S.C. § 20507(a)(4). But states must complete “any program the purpose of which is to systematically remove the names of ineligible voters from the official lists of eligible voters” no later than 90 days before “a primary or general election for Federal office[.]” Id. § 20507(c)(2)(A). If a state fails to comply with the NVRA, “[t]he Attorney 4 General may bring a civil action in an appropriate district court for such declaratory or injunctive relief as is necessary to carry out [the NVRA].” Id. § 20510(a). Nine years later, Congress supplemented the NVRA with the Help America Vote Act (HAVA), Pub. L. No. 107-252, 116 Stat. 1666 (2002) (codified at 52 U.S.C. § 20901 et seq.). Enacted following the contentious 2000 presidential election, “HAVA aimed to alleviate a significant problem voters experience—eligible voters being turned away at the polls because their names were missing from voter registration lists.” United States v. Benson, 179 F.4th 470, 476 (6th Cir. 2026) (cleaned up). It “require[s] every State to create and maintain a computerized statewide list of all registered voters.” Crawford v. Marion Cnty. Election Bd., 553 U.S. 181, 192 (2008); see 52 U.S.C. § 21083(a). And states must “ensure that voter registration records in the State are accurate and are updated regularly” and “make[] a reasonable effort to remove registrants who are ineligible to vote from the official list of eligible voters.” 52 U.S.C. § 21083(a)(4), (a)(4)(A). HAVA empowers the Attorney General to enforce its provisions by “bring[ing] a civil action against any State or jurisdiction in an appropriate United States District Court for such declaratory and injunctive relief . . . as may be necessary to carry out [HAVA’s] uniform and nondiscriminatory election technology and administration requirements.” Id. § 21111. 2. Privacy Act Enacted in 1974, the Privacy Act establishes “certain safeguards for an individual against an invasion of personal privacy by requiring Federal agencies” to “collect, maintain, use, or disseminate any record of identifiable personal information in a manner that assures that such action is for a necessary and lawful purpose.” Pub. L. No. 93-579, § 2(b), (b)(4), 88 Stat. 1896, 1896 (1974). The Act imposes several limits on the ability of federal agencies to collect and disseminate the personal information of American citizens. Four such restrictions are relevant here. 5  First, the Privacy Act furnishes certain procedural safeguards. When an agency “establish[es] or revis[es]” any “system of records”—that is, “a group of any records” from which an individual’s information may be retrieved—the agency must “publish in the Federal Register . . . a notice of the existence and character of the system of records.” Id. § 552a(a)(5), (e)(4). And the Act specifies that these Systems of Records Notices (SORNs) “shall include” nine categories of information. Id. § 552a(e)(4). For instance, a SORN must include “each routine use of the records contained in the system, including the categories of users and the purpose of such use[.]” Id. § 552a(e)(4)(D). Second, the Privacy Act limits when federal agencies may disclose government records, whether within or outside the federal government—subject to certain exceptions. See 5 U.S.C. § 552a(b). Under the “routine use” exception, an agency may disclose a record “for a purpose which is compatible with the purpose for which it was collected[.]” Id. § 552a(a)(7), (b)(3); see also League of Women Voters v. DHS, 835 F. Supp. 3d 79, 98 (D.D.C. 2026). Separately, the “law enforcement” exception permits disclosure to another agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States for a civil or criminal law enforcement activity if the activity is authorized by law, and if the head of the agency or instrumentality has made a written request to the agency which maintains the record specifying the particular portion desired and the law enforcement activity for which the record is sought[.] 5 U.S.C. § 552a(b)(7). Third, the Privacy Act imposes record-accuracy requirements. It requires agencies to “maintain all records . . . with such accuracy, relevance, timeliness, and completeness as is reasonably necessary to assure fairness[,]” id. § 552a(e)(5), and to “make reasonable efforts to assure that such records are accurate, complete, timely, and relevant for agency purposes” “prior 6 to disseminating any record about an individual to any person other than an agency,” id. § 552a(e)(6). Finally, the Privacy Act limits federal collection of information about First Amendment protected activities. It forbids agencies from “maintain[ing]” any record “describing how any individual exercises rights guaranteed by the First Amendment unless expressly authorized by statute or by the individual about whom the record is maintained or unless pertinent to and within the scope of an authorized law enforcement activity[.]” Id. § 552a(e)(7). 3. Paperwork Reduction Act The Paperwork Reduction Act (PRA), Pub. L. No. 96-511, 94 Stat. 2812, 2812 (1980) (codified as amended at 44 U.S.C. § 3501 et seq.), “sets standards for federal agencies when collecting information from the public[,]” United to Protect Democracy v. Presidential Advisory Comm’n on Election Integrity, 288 F. Supp. 3d 99, 101–02 (D.D.C. 2017). It requires federal agencies to follow certain procedural steps before and during the “collection of information.” 44 U.S.C. §§ 3506(c), 3507(a). As relevant here, the PRA defines “collection of information” as “the obtaining, causing to be obtained, soliciting, or requiring the disclosure to third parties or the public, of facts or opinions by or for an agency, regardless of form or format, calling for . . . answers to identical questions posed to, or identical reporting or recordkeeping requirements imposed on, ten or more persons, other than agencies, instrumentalities, or employees of the United States[.]” Id. § 3502(3). States are “persons” for PRA purposes. See id. § 3502(10). And while the PRA does not apply to the “collection of information . . . during the conduct of a Federal criminal investigation or prosecution” or a “civil action to which the United States or any official or agency thereof is a party[,]” it nevertheless governs “the collection of information during the conduct of 7 general investigations . . . undertaken with reference to a category of individuals or entities such as a class of licensees or an entire industry.” Id. § 3518(c). When agencies propose a “collection of information,” they must “provide 60-day notice in the Federal Register, and otherwise consult with members of the public and affected agencies . . . to solicit comment[.]” Id. § 3506(c)(2)(A). 1 And when agencies collect information, they must “inform[] the person receiving the collection of information of . . . the reasons the information is being collected [and] the way such information is to be used[.]” Id. § 3506(c)(1)(B)(iii)(I)–(II). B. Factual Background The Court draws the facts from the Parties’ Joint Appendix, ECF No. 45. See 5 U.S.C. § 706; LCvR 7(n). In March 2025, President Donald J. Trump signed an Executive Order related to election administration. Exec. Order No. 14248, 90 Fed. Reg. 14005 (Mar. 25, 2025). Relevant here, it directed the Attorney General to “take all appropriate action to enter into information-sharing agreements” with state officials, with the goal of “provid[ing] the Department of Justice with detailed information on all suspected violations of State and Federal election laws discovered by State officials, including information on individuals” who, among other things, voted despite being ineligible. Id. § 5(a), (a)(i). The Executive Order also instructed the Attorney General to “prioritize 1 There are exceptions to this notice requirement not applicable here. See 44 U.S.C. § 3506(c)(2)(B) (permitting “notice and comment” on proposed rules to suffice for PRA purposes); id. § 3507(j) (allowing the Director of the Office of Management and Budget to temporarily authorize collections of information without the 60-day notice when “public harm is reasonably likely to result if normal clearance procedures are followed[,] an unanticipated event has occurred[,] or . . . the use of normal clearance procedures is reasonably likely to prevent or disrupt the collection of information or is reasonably likely to cause a statutory or court ordered deadline to be missed”). 8 enforcement of Federal election integrity laws” in states that refused to enter into information- sharing agreements or otherwise cooperate with DOJ. Id. § 5(b)(i). To implement the Executive Order, DOJ’s Civil Rights Division launched what the administrative record refers to as the “list maintenance project,” e.g., CRT-7; CRT-27, or the “NVRA List Maintenance Project,” CRT-3397. Broadly speaking, the Division began requesting states’ unredacted voter rolls, disclosing the lists to other federal agencies, comparing them against a federal database to identify purportedly ineligible voters, and demanding that states remove voters from their rolls based on the results of those comparisons. Consistent with the administrative record, the Court will refer to the challenged policy as the “Voter List Maintenance Policy.” And drawing the facts from the administrative record, the Court will describe the policy in detail. In May 2025, the Civil Rights Division began contacting states to request complete and unredacted copies of their computerized statewide voter registration lists (SVRLs), including voters’ full names, dates of birth, residential addresses, and state driver’s license numbers or last four digits of Social Security numbers. E.g., CRT-2496. The Division assured states that “all data received . . . w[ould] be kept securely and treated consistently with the Privacy Act.” E.g., CRT- 2686. The administrative record reflects that the Division made these requests to 49 states and the District of Columbia. 2 States responded in different ways. At least 18 states fully cooperated, 2 See CRT-2107 (DOJ letter to Alabama); CRT-2327 (Alaska); CRT-2396 (Arizona); CRT-2407 (Arkansas); CRT-2428 (California); CRT-2432 (proposed MOU between DOJ and Colorado stating “[t]he Justice Department is requesting your state’s [voter registration list]”); CRT-2496 (Connecticut); CRT-2522 (Delaware); CRT-2548 (District of Columbia); CRT-2558 (Florida); CRT-2572 (Georgia); CRT-2593 (Hawaii); CRT-2647 (Idaho); CRT-2679 (Illinois); CRT-2688 (Indiana); CRT-2699 (Iowa); CRT-2710 (Kansas); CRT-2730 (Kentucky); CRT-2744 (Louisiana); CRT-2763 (Maine); CRT-2766 (Maryland); CRT-2774 (Massachusetts); CRT-2783 (Michigan); CRT-2818 (Minnesota); CRT-2838 (Mississippi); CRT-2858 (Missouri); CRT-2872 (Montana); CRT-2891 (Nebraska); CRT-2905 (Nevada); CRT-2908 (New Hampshire); CRT- 2923 (New Jersey); CRT-2948 (New Mexico); CRT-2952 (New York); CRT-2959 (North Carolina); CRT-2986 (Ohio); CRT-2989 (Oklahoma); CRT-3051 (Oregon); CRT-3068 9 turning over their unredacted SVRLs. See Pls.’ Mem. Supp. Partial Summ. J. Mot. (Mot.) at 7, ECF No. 29-1; Defs.’ Combined Mem. Supp. Mot. Dismiss/Mot. Summ. J. and Opp’n to Pls.’ Mot. (Cross-Mot. & Opp’n) at 8–9, ECF No. 32-1. But others refused, leading DOJ to file a bevy of lawsuits seeking to compel compliance. To date, every court to rule on motions to dismiss filed by state defendants have dismissed DOJ’s enforcement actions. 3 (Pennsylvania); CRT-3071 (Rhode Island); CRT-3076 (South Carolina); CRT-3130 (South Dakota); CRT-3137 (Tennessee); CRT-3144 (Texas); CRT-3159 (Utah); CRT-3187 (Vermont); CRT-3190 (Virginia); CRT-3196 (Washington); CRT-3200 (West Virginia); CRT-3231 (email from DOJ attorney to Wisconsin Elections Commission “demand[ing] . . . [a]n electronic copy of the full Wisconsin statewide voter registration list”); CRT-3401 (Wyoming). North Dakota does not maintain a statewide voter registration list, see Brakebill v. Jaeger, 905 F.3d 553, 556 (8th Cir. 2018) (“North Dakota has no voter registration requirement”), so DOJ did not demand one from that state. 3 By this Court’s count, at least 25 federal district courts have dismissed enforcement actions brought by DOJ to obtain SVRLs, and one circuit court has affirmed dismissal. See United States v. Fontes, 832 F. Supp. 3d 944, 954 (D. Ariz. 2026); United States v. Weber, 816 F. Supp. 3d 1168, 1196 (C.D. Cal. 2026); United States v. Griswold, No. 25-cv-03967, 2026 WL 2235374, at *6 (D. Colo. Aug. 3, 2026); United States v. Thomas, No. 26-cv-21, 2026 WL 2070437, at *7 (D. Conn. July 17, 2026); United States v. Evans, No. 25-cv-4403, 2026 WL 2267774, at *11 (D.D.C. Aug. 6, 2026); United States v. Matthews, No. 25-cv-3398, 2026 WL 2212877, at *6 (C.D. Ill. July 31, 2026); United States v. Adams, 837 F. Supp. 3d 881, 888 (E.D. Ky. 2026); United States v. Bellows, 834 F. Supp. 3d 113, 128 (D. Me. 2026); United States v. DeMarinis, No. 25-cv-3934, 2026 WL 1780586, at *6 (D. Md. June 18, 2026); United States v. Galvin, 830 F. Supp. 3d 122, 131 (D. Mass. 2026); United States v. Benson, 819 F. Supp. 3d 753, 770 (W.D. Mich. 2026), aff’d, 179 F.4th 470 (6th Cir. 2026), reh’g en banc denied, 187 F.4th 462 (6th Cir. 2026); United States v. Simon, No. 25-cv-3761, 2026 WL 2389778, at *13 (D. Minn. Aug. 17, 2026); United States v. Aguilar, No. 25-cv-00728, 2026 WL 2364502, at *6 (D. Nev. Aug. 14, 2026); United States v. Scanlan, 838 F. Supp. 3d 150, 165 (D.N.H. 2026); United States v. Caldwell, No. 26-cv-2025, 2026 WL 2186515, at *8 (D.N.J. July 29, 2026); United States v. Oliver, No. 25-cv-01193, 2026 WL 2031479, at *10 (D.N.M. July 14, 2026); United States v. Bd. of Elections of N.Y., No. 25-cv- 1338, 2026 WL 1999921, at *14 (N.D.N.Y. July 10, 2026); United States v. Oregon, 828 F. Supp. 3d 1092, 1109 (D. Or. 2026); United States v. Schmidt, 835 F. Supp. 3d 697, 700 (W.D. Pa. 2026); United States v. Amore, 831 F. Supp. 3d 149, 158 (D.R.I. 2026); United States v. Koski, No. 26-cv-42, 2026 WL 2032532, at *6 (E.D. Va. July 14, 2026); United States v. Hanzas, No. 25- cv-00903, 2026 WL 2754349, at *6 (D. Vt. Sep. 17, 2026); United States v. Hobbs, No. C25-6078, 2026 WL 2833713, at *6 (W.D. Wash. Sep. 22, 2026); United States v. Warner, No. 26-cv-00156, 2026 WL 2018877, at *8 (S.D. W. Va. July 13, 2026); United States v. Wisc. Elections Comm’n, 833 F. Supp. 3d 949, 955–56 (W.D. Wis. 2026). 10  After obtaining unredacted SVRLs from the states who volunteered them, the Civil Rights Division shared that data with the Department of Homeland Security (DHS). In turn, DHS would run that data through the Systematic Alien Verification for Entitlements (SAVE) system administered by the U.S. Citizenship and Immigration Services (USCIS), a component of DHS. See CRT-30–40. “SAVE is an online service for registered federal, state, territorial, tribal, and local government agencies to verify immigration status and U.S. citizenship of applicants seeking benefits or licenses.” SAVE, U.S. Citizenship & Immig. Servs., https://www.uscis.gov/save [https://perma.cc/LLZ2-VHFT]. In 2025, the federal government modified SAVE to include Social Security Administration (SSA) records for the first time. See Decl. of John B. Hill Ex. 17 at 213–14 (Hill Decl.), Pls.’ Ex. A, ECF No. 29-2 (SSA-AR-41–42); League of Women Voters, 835 F. Supp. 3d at 101; see also Press Release, U.S. Dep’t of Homeland Sec., DHS, USCIS, DOGE Overhaul Systematic Alien Verification for Entitlements Database (Apr. 22, 2025), https://www.dhs.gov/news/2025/04/22/dhs-uscis-doge-overhaul-systematic-alien-verification- entitlements-database [https://perma.cc/8XRG-PMSH]. 4 The information-sharing memorandum between the Civil Rights Division and DHS acknowledged certain limitations on SAVE’s ability to verify citizenship. For instance, the memorandum states that “SAVE may only be able to verify acquired U.S. citizens in certain 4 In June 2026, this Court found that the modified SAVE database—including the incorporation of Social Security records—violated the Privacy Act, the Social Security Act, and the APA. League of Women Voters v. DHS, 835 F. Supp. 3d 79, 100–04, 132 (D.D.C. 2026). It therefore set aside and vacated the modifications. Id. at 138. In September 2026, the Supreme Court stayed this Court’s Order, concluding that the Government was likely to prevail on its argument that 8 U.S.C. § 1373 authorized the modifications to SAVE. See DHS v. League of Women Voters, No. 26A308, 2026 WL 2879700, at *2–3 (U.S. Sep. 25, 2026) (per curiam). Dissenting, three Justices concluded that “nothing in § 1373 authorize[d] the modified SAVE system or overr[ode] the provisions of the Social Security Act and the Privacy Act” that the modified SAVE system was found to have violated. Id. at *8 (Jackson, J., dissenting). Neither Party argues that Section 1373 is implicated in this case or that the stay issued by the Supreme Court has any bearing on this case. 11 situations.” 5 CRT-32. Indeed, SSA has long recognized that its citizenship data contains certain inaccuracies. See Hill Decl. Ex. 17 at 216 (SSA-AR-44); Hill Decl. Ex. 18 at 237 (SSA-AR-0103). For one, SSA “did not begin to consistently maintain citizenship information until 1981,” and therefore “does not have citizenship information for all individuals who have been issued an SSN.” Hill Decl. Ex. 19 at 245. Moreover, because SSA merely captures an individual’s citizenship “at the time of their interaction with SSA”—that is, when they apply for a Social Security number— SSA does not update its records to reflect changes to an individual’s immigration status “unless the individual is receiving Social Security payments.” Id. In other words, if an individual received a Social Security number while a noncitizen—as the law permits, see 42 U.S.C. § 405(c)(2)(B)(i)(I)—and that individual later became a U.S. citizen through naturalization or acquired citizenship, SSA records would likely misclassify her as a noncitizen. This data error is far from abstract. A 2006 SSA audit found that 7% of the non-U.S. citizen records in SSA’s database—totaling approximately 3.3 million people—misidentified U.S. citizens as noncitizens. See Hill Decl. Ex. 20 at 253–54. In addition to its agreement with SSA, the Civil Rights Division entered into a separate arrangement with Homeland Security Investigations (HSI), another DHS component housed under Immigration and Customs Enforcement (ICE). DOJ agreed to provide HSI with the states’ SVRL datasets so that HSI could “conduct appropriate investigation of potential violations of federal election law” and “enrich the SVRL datasets with OHS records to allow for vetting via the SAVE system.” CRT-3400; see also CRT-3330 (“In response to the President’s order to identify those 5 Acquired citizenship is “citizenship conveyed to children through the naturalization of parents or, under certain circumstances, at birth to foreign-born children of U.S. citizens, provided certain conditions are met.” CRT-32 n.2. 12 who may be voting illegally . . . the Civil Rights Division . . . proposed to seek statewide voter lists, and then to share the lists with [HSI] or another unit within DHS.”). Finally, the Civil Rights Division reserved the option to share SVRLs outside of DOJ and DHS. In its memoranda of understanding with some of the complying states, the Division explained that it could disclose SVRL data to “a contractor with the Department of Justice who needs access to the [SVRL] information in order to perform duties related to the Department’s list maintenance verification procedures.” E.g., CRT-7 (Alaska); CRT-27 (South Carolina); CRT- 2042 (Texas). The Civil Rights Division used the modified SAVE database to “verify the U.S. citizenship and immigration status information of registrants or registered voters” listed on the SVRLs that it received. CRT-31–32. And it agreed to alert the states of any voters listed on the SVRLs whom it deemed to be noncitizens. See, e.g., CRT-5 (Alaska); CRT-2058 (Texas); CRT-25 (South Carolina). The states, in turn, agreed to “clean” their SVRLs within 45 days of notification by DOJ by removing those voters deemed ineligible by the Division. See, e.g., CRT-5 (Alaska); CRT-2058 (Texas); CRT-25 (South Carolina). C. Procedural Background In April 2026, the Plaintiffs—Common Cause, the Common Cause Education Fund, and individuals Anthony Nel, Haley Smith, Linda Duckworth, and Ruth Nasrullah—filed a Complaint challenging the Civil Rights Division’s policy on statutory and constitutional grounds. Compl., ECF No. 1. The Plaintiffs then moved for summary judgment on their statutory claims only, asking this Court to set aside and vacate the policy under the APA and declare it unlawful, or, alternatively, permanently enjoin the policy’s implementation. Pls.’ Partial Summ. J. Mot., ECF No. 29-1. The Defendants—DOJ and the Attorney General—cross-moved for either dismissal or 13 summary judgment on all the Plaintiffs’ claims. Defs.’ Mot. Dismiss/Mot. Summ. J., ECF No. 32. These motions are fully briefed and ripe for review. Pls.’ Combined Reply & Opp’n to Defs.’ Mot. (Reply & Cross-Opp’n), ECF Nos. 35 & 36; Defs.’ Reply (Cross-Reply), ECF No. 43. LEGAL STANDARD “A motion [to dismiss] under Rule 12(b)(1) presents a threshold challenge to a court’s [subject-matter] jurisdiction.” Ctr. for Biological Diversity v. U.S. Int’l Dev. Fin. Corp., 585 F. Supp. 3d 63, 69 (D.D.C. 2022) (cleaned up). A plaintiff bears the burden of establishing a court’s jurisdiction. See Kokkonen v. Guardian Life Ins. Co., 511 U.S. 375, 377 (1994). In evaluating whether a plaintiff has met that burden at the pleading stage, a court may “accept as true all of the factual allegations contained in the complaint.” Am. Freedom L. Ctr. v. Obama, 821 F.3d 44, 49 (D.C. Cir. 2016) (quoting Swierkiewicz v. Sorema N.A., 534 U.S. 506, 508 n.1 (2002)). “But [a] court is not limited to the allegations of the complaint and may consider such materials outside the pleadings as it deems appropriate.” New Mexico v. Musk, 824 F. Supp. 3d 80, 91 (D.D.C. 2026) (cleaned up). A court “shall grant summary judgment if the movant shows that there is no genuine dispute as to any material fact and the movant is entitled to judgment as a matter of law.” Fed. R. Civ. P. 56(a). In the context of an APA challenge, summary judgment “serves as a mechanism for deciding, as a matter of law, whether the administrative record supports the agency action and whether the agency action is consistent with the APA standard of review.” Int’l Swaps & Derivatives Ass’n v. Commodity Futures Trading Comm’n, 887 F. Supp. 2d 259, 266 (D.D.C. 2012) (citing Richards v. INS, 554 F.2d 1173, 1177 & n.28 (D.C. Cir. 1977)). DISCUSSION The Plaintiffs contend that the Voter List Maintenance Policy is unlawful three times over under the APA. They argue that the policy (1) exceeds DOJ’s statutory authority, 5 U.S.C. 14 §§ 706(2)(A), (C); (2) is arbitrary and capricious, id. § 706(2)(A); and (3) is contrary to law because it violates the Privacy Act and the PRA, id. § 706(2)(A), (D). The Court agrees. In brief, the Defendants have failed to show that any statute—including the 1960 Civil Rights Act, the NVRA, and HAVA—authorizes DOJ to collect and share unredacted statewide voter rolls. And the administrative record makes clear that in adopting the policy, DOJ entirely failed to consider the risk that its use of citizenship records known to be unreliable would lead the Civil Rights Division to demand that states remove U.S. citizens from their voter rolls. Along the way, DOJ also violated the Privacy Act by improperly disclosing records, maintaining records without a reasonable effort to ensure their accuracy, and unlawfully retaining records of First Amendment protected activity without statutory authorization. And although DOJ was required to abide by the PRA, it ignored its procedural requirements. For all these reasons, this Court must set aside the Voter List Maintenance Policy under the APA. A. Standing The Court begins, as it must, with standing. To establish the “irreducible constitutional minimum of standing,” Spokeo, Inc. v. Robins, 578 U.S. 330, 338 (2016) (cleaned up), “a plaintiff must show (i) that he suffered an injury in fact that is concrete, particularized, and actual or imminent; (ii) that the injury was likely caused by the defendant; and (iii) that the injury would likely be redressed by judicial relief,” TransUnion LLC v. Ramirez, 594 U.S. 413, 423 (2021). The Supreme Court has made clear that “plaintiffs must demonstrate standing for each claim that they press against each defendant, and for each form of relief that they seek.” Murthy v. Missouri, 603 U.S. 43, 44 (2024) (cleaned up). But “only one plaintiff needs standing for a suit to proceed[.]” Bost v. Ill. State Bd. of Elections, 607 U.S. 71, 76 n.3 (2026). 15  Recall that the Plaintiffs are four individual voters and two organizations, Common Cause and the affiliated Common Cause Education Fund. At the outset, the Court dismisses Common Cause Education Fund as a Plaintiff. The Complaint states that the two organizational Plaintiffs “bring this action jointly.” Compl. ¶ 17. But the Plaintiffs’ briefing does not mention Common Cause Education Fund or attempt to establish its standing. The Defendants pointed this out, see Cross-Mot. & Opp’n at 27; Cross-Reply at 11, and the Plaintiffs did not bother to respond. So the Court assumes that the organization is not continuing as a Plaintiff. See Hopkins v. Women’s Div., Gen. Bd. of Glob. Ministries, 284 F. Supp. 2d 15, 25 (D.D.C. 2003) (“It is well understood in this Circuit that when a plaintiff files an opposition to a dispositive motion and addresses only certain arguments raised by the defendant, a court may treat those arguments that the plaintiff failed to address as conceded.”), aff’d, 98 F. App’x 8 (D.C. Cir. 2004). As for the remaining Plaintiffs, they assert various theories of standing. Common Cause contends that it has: (1) organizational standing because the Voter List Maintenance Policy caused myriad disruptions to its organizational activities and informational injuries based on DOJ’s failure to comply with the public notice provisions of the Privacy Act and PRA, Mot. at 12–16; and (2) associational standing on behalf of its members, including the four individual Plaintiffs, Mot. at 16–19. For their part, the individual Plaintiffs claim that they have suffered privacy, voting, informational, and procedural harms because of the policy. Mot. at 16–18. 1. Organizational Standing The Court begins with Common Cause’s organizational standing. “Like an individual, an organization can establish standing by showing an actual or threatened injury in fact that is fairly traceable to the defendant’s allegedly unlawful conduct and likely to be redressed by a favorable court decision.” Ctr. for Biological Diversity v. Dep’t of the Interior (CBD II), 144 F.4th 296, 314 16 (D.C. Cir. 2025) (cleaned up). Common Cause urges two theories of organizational standing. It first claims that the Voter List Maintenance Policy “‘directly affect[s] and interfere[s] with [its] core business activities’ of providing services and educational resources to voters and its mission of promoting political participation.” Mot. at 12 (quoting CBD II, 144 F.4th at 315). Second, Common Cause contends that it has informational standing because “DOJ has deprived Common Cause of critical information required by the public notice provisions of the Privacy Act and PRA.” Mot. at 15. The Court considers each theory in turn, ultimately concluding that Common Cause establishes standing on both theories. a. Activity-Based Standing First up is Common Cause’s activity-based standing theory. Starting with the injury-in-fact requirement, “the first and foremost of standing’s three elements[,]” Spokeo, 578 U.S. at 338 (cleaned up), “an organization must allege a ‘concrete and demonstrable injury to the organization’s activities’ that is ‘more than simply a setback to the organization’s abstract social interests,’” Am. Anti-Vivisection Soc’y v. USDA, 946 F.3d 615, 618 (D.C. Cir. 2020) (quoting Havens Realty Corp. v. Coleman, 455 U.S. 363, 379 (1982)). The D.C. Circuit has set out a two- part inquiry to determine whether an organization has suffered an injury in fact. See Indep. Mkt. Monitor for PJM v. FERC (PJM), 162 F.4th 1167, 1172 (D.C. Cir. 2025). First, the organization must show “an injury to its organizational interests.” Id. (citation omitted). That injury “must be ‘concrete,’ meaning that it must be real.” Id. (quoting FDA v. All. for Hippocratic Med., 602 U.S. 367, 381 (2024)). For instance, injuries to an organization’s capacity to conduct “issue advocacy”—such as “urg[ing] the government” to act through lobbying or rulemaking petitions—are generally insufficient to confer standing. CBD II, 144 F.4th at 315; see also Ctr. for L. & Educ. v. Dep’t of Educ., 396 F.3d 1152, 1161 (D.C. Cir. 2005) (“This Court 17 has not found standing when the only ‘injury’ arises from the effect of the regulations on the organizations’ lobbying activities (as opposed to the effect on non-lobbying activities)[.]”). And “an organization’s diversion of resources to litigation or to investigation in anticipation of litigation” is a “self-inflicted budgetary choice” that does not confer standing. Am. Soc. for Prevention of Cruelty to Animals v. Feld Ent., Inc., 659 F.3d 13, 25 (D.C. Cir. 2011) (cleaned up). But an organization suffers a cognizable injury when a challenged action “directly affect[s] and interfere[s] with [its] core business activities.” CBD II, 144 F.4th at 315 (quoting All. for Hippocratic Med., 602 U.S. at 395). 6 Organizations can vindicate injuries to their “non-advocacy operations,” including, for instance, programmatic efforts to educate the public. Id.; see also Am. Anti-Vivisection Soc’y, 946 F.3d at 619 (finding standing where an organization “ha[d] been compelled to fill the void” left by an agency’s “failure to enact regulations” by “developing the guidance . . . that federal standards would otherwise provide[,]” causing a “‘drain on the organization’s resources’” (quoting Havens Realty, 455 U.S. at 379)); PETA v. USDA, 797 F.3d 1087, 1093–95 (D.C. Cir. 2015). Put d