UNITED STATES DISTRICT COURT

FOR THE DISTRICT OF COLUMBIA

ELECTRONIC PRIVACY 

INFORMATION CENTER,

Plaintiff,

v. 

UNITED STATES POSTAL SERVICE, et 

al., 

Defendants.

Case No. 1:21-cv-02156 (TNM)

MEMORANDUM OPINION

The Electronic Privacy Information Center (EPIC) is a frequent litigant in this circuit. 

Here, EPIC on its own behalf and on behalf of its members sues the U.S. Postal Service (USPS) 

and its law enforcement component for failure to comply with the E-Government Act. USPS 

disputes EPIC’s standing for these claims. Indeed, in EPIC’s prior actions the D.C. Circuit has 

rejected some of the standing theories that EPIC advances now. For all other theories, the Court 

agrees with USPS that EPIC has not met its burden to show a cognizable injury in fact. The 

Court will therefore grant USPS’s motion to dismiss the Complaint.

I.

Congress passed the E-Government Act to improve the Government’s use of information 

technology “in a manner consistent with laws regarding protection of personal privacy, national 

security, . . . and other relevant laws.” Pub. L. No. 107-347, § 2(b)(11), 116 Stat. 2899, 2901 

(2002) (Act), codified at 44 U.S.C. § 3501 note. Section 208 of the Act requires an agency to 

conduct, review, and, “if practicable,” publish a privacy impact assessment (PIA). Id.

§ 208(b)(1)(B). The agency must take these steps before it collects “information in an 
2

identifiable form permitting the physical or online contacting of a specific individual,” if the 

agency imposes the same reporting requirements on “10 or more persons.” Id. § 208(b)(1).

Since “at least 2018,” USPS has operated a “surveillance program known as the Internet 

Covert Operations Program (iCOP).” Am. Compl. ¶ 21, ECF No. 13 (Compl.). This program 

facilitates the identification of individuals and organizations who use “the mail or USPS online 

tools” for illegal purposes. Id. Through the program, USPS monitors social media posts to 

“search for potential threats of violence,” id. ¶ 33, and identifies the users of the most worrisome 

accounts, see id. ¶¶ 30–31. For that identification, USPS relies on facial recognition software. 

Particularly relevant here is Clearview AI, which provides “a database of over 3 million 

images scraped from Facebook and other social media sites.” Id. ¶ 24. When a user inputs a

person’s image, the software compares that image against others in the database. See id. If there 

is a match, Clearview AI gives “links to the individual’s personal information, social media 

profiles, and other related online material.” Id. Using iCOP, USPS has identified multiple 

individuals. See id. ¶¶ 30, 34.

Enter EPIC, a nonprofit membership organization committed to “oversight and analysis 

of government data collection activities.” Id. ¶ 6. In May 2021, EPIC submitted a FOIA request 

seeking a PIA for the facial recognition and social media monitoring systems used by iCOP. See 

id. ¶ 42. USPS conducted a search but found no PIA. See id. ¶ 43. EPIC renewed its request but 

never received a response. See id. ¶¶ 50–56.

EPIC then filed this suit, making three claims. Count I alleges “unlawful agency action” 

under the Administrative Procedure Act (APA) because USPS began using iCOP and its 

attendant tools without conducting a PIA as required by the E-Government Act. See id. ¶¶ 58–

65. Similarly, Count II alleges “agency action unlawfully withheld” because USPS “failed to 
3

conduct and publish” a PIA. Id. ¶ 67. And Count III seeks a writ of mandamus compelling 

USPS “to conduct and publish” a PIA and, until then, to suspend iCOP and the use of its 

software. Id. ¶ 78.

EPIC attached to its Complaint declarations from two of its members. See Hartzog Decl., 

ECF No. 13-5; Gropper Decl., ECF No. 13-6. Both members say that their personal data, 

including their “name and/or image,” “are likely contained in Clearview AI’s database” because 

both members habitually use social media and did so while iCOP “[was] known to have used 

social media monitoring tools.” Hartzog Decl. ¶¶ 9–10; Gropper Decl. ¶¶ 9–10.

USPS moves to dismiss EPIC’s Complaint, arguing that EPIC lacks standing and has 

failed to properly state a claim. See Defs.’ Mot. to Dismiss, ECF No. 14-1 (MTD). That motion 

is now ripe for decision.

II.

The Court begins and ends with standing. “[T]here is no justiciable case or controversy 

unless the plaintiff has standing.” West v. Lynch, 845 F.3d 1228, 1230 (D.C. Cir. 2017). As the 

party seeking federal jurisdiction, EPIC bears the burden to show standing. See Lujan v. Defs. of 

Wildlife, 504 U.S. 555, 560 (1992). EPIC “must show (1) it has suffered a concrete and 

particularized injury (2) that is fairly traceable to the challenged action of the defendant and (3) 

that is likely” redressable by a favorable decision from the Court. EPIC v. Pres. Advisory 

Comm’n on Election Integrity (EPIC I), 878 F.3d 371, 377 (D.C. Cir. 2017) (cleaned up).

When ruling on a motion to dismiss under Rule 12(b)(1), the Court “assume[s] the truth 

of all material factual allegations in the complaint and construe[s] the complaint liberally, 

granting [the] plaintiff the benefit of all inferences that can be derived from the facts alleged.” 

Am. Nat’l Ins. Co. v. FDIC, 642 F.3d 1137, 1139 (D.C. Cir. 2011) (cleaned up). The Court “may 
4

consider materials outside the pleadings in deciding whether to grant a motion to dismiss for lack 

of jurisdiction.” Cal. Cattlemen’s Ass’n v. U.S. Fish and Wildlife Serv., 315 F. Supp. 3d 282, 

285 (D.D.C. 2018) (cleaned up). And the Court treats any documents attached to the 

Complaint—like the declarations from EPIC’s members—“as if they are part of the complaint.” 

In re Cheney, 406 F.3d 723, 729 (D.C. Cir. 2005).

III.

EPIC argues that it has standing on two bases—organizational standing on its own behalf 

and associational standing on behalf of its members. The Court takes those in turn.

A.

EPIC can assert standing on its own behalf “if the defendant’s actions cause a concrete 

and demonstrable injury to [EPIC’s] activities that is more than simply a setback to the 

organization’s abstract social interests.” ASPCA v. Feld Entm’t, Inc., 659 F.3d 13, 25 (D.C. Cir. 

2011) (cleaned up). EPIC argues that it has suffered an informational injury because USPS’s 

failure to publish a PIA “unlawfully denied [ ] EPIC access to information” otherwise required 

by statute. Compl. ¶ 70, 75. For that informational gap to constitute an injury in fact, EPIC must 

allege that “(1) it has been deprived of information that, on its interpretation, a statute requires 

the government or a third party to disclose to it, and (2) it suffers, by being denied access to that 

information, the type of harm Congress sought to prevent by requiring disclosure.” Friends of 

Animals v. Jewell, 828 F.3d 989, 992 (D.C. Cir. 2016).

As a frequent filer in this circuit, EPIC is blessed and cursed with robust caselaw, some 

of which is directly relevant to its current arguments. The D.C. Circuit has twice rejected EPIC’s 

argument that failure to publish a PIA creates an informational injury sufficient for standing. See 
5

EPIC v. Dep’t of Commerce (EPIC II), 928 F.3d 95, 101 (D.C. Cir. 2019); EPIC I, 878 F.3d at 

378. The third time is not the charm.

Start with the most obvious. In EPIC I, the D.C. Circuit held that § 208 of the 

E-Government Act “is intended to protect individuals.” 878 F.3d at 378 (emphasis in original). 

Because EPIC was not—and still is not—an individual, it is “not the type of plaintiff [ ] 

Congress had in mind.” Id. EPIC thus fails the second prong of the informational standing test. 

More, in EPIC II, the Circuit held that “the lack of information itself is not the harm that 

Congress sought to prevent through § 208.” 928 F.3d at 103. Instead, the statute prevented 

against “harm to individual privacy.” Id. at 104. Thus, an asserted informational injury under 

§ 208 “cannot satisfy the second step” of the test for an informational injury in fact. Id.

For these reasons already propounded to EPIC by the D.C. Circuit, the Court finds that 

EPIC’s alleged informational injury from the lack of a PIA does not confer organizational 

standing.

* * *

There is an old chestnut that insanity is doing the same thing over and over again and 

expecting a different result. And at law, an attorney who repeatedly raises arguments that have 

been squarely rejected in binding precedent risks sanctions. See, e.g., McLaughlin v. Bradlee, 

803 F.2d 1197, 1205 (D.C. Cir. 1986). The Court reminds EPIC’s attorneys to scrupulously 

adhere to their Rule 11 obligations in future cases.

B.

The Court turns next to EPIC’s assertion of associational standing. EPIC has 

associational standing to sue on behalf of its members if, among other things, “at least one of 

[EPIC’s] members has standing to sue in her or his own right[.]” EPIC II, 928 F.3d at 101. 
6

EPIC says that its members have suffered informational and privacy injuries. See Pl.’s Opp’n to 

MTD at 13, 16, ECF No. 15 (Opp’n).1

1.

The Court applies the same two-pronged test to EPIC’s claim that its members have 

suffered an informational injury. See EPIC II, 928 F.3d at 103. And EPIC makes the same 

arguments that it made for itself. So some of the Court’s analysis of organizational standing also 

applies here. True, EPIC’s members are individuals. But they still assert an informational 

injury, which the D.C. Circuit explained is not the “harm Congress sought to prevent through 

§ 208.” Id. Thus, EPIC’s members fail the second step of the test for an informational injury in 

fact.

EPIC’s members also fail the first step. Section 208 does not on its face “require” 

disclosure of a PIA. Jewell, 828 F.3d at 992. Instead, the statute mandates disclosure “if 

practicable.” Act § 208(b)(1)(B)(iii). EPIC creatively responds that because Section 208 

requires an agency to “conduct” a PIA, any PIA becomes an agency record disclosable under 

FOIA, thus meeting the first step of the informational injury test. See Opp’n at 15. 

But EPIC misunderstands FOIA, which “does not require the disclosure of any specific 

information to anyone[.]” Pub. Citizen Health Rsrch. Grp. v. Pizzella, 513 F. Supp. 3d 10, 20 

(D.D.C. 2021). FOIA instead requires “access to records when a request has been made and 

[FOIA] exemptions are inapplicable.” Id. And as this Court has noted, FOIA also “does not 

require the government to create documents.” Jud. Watch, Inc. v. ODNI, No. 1:17-cv-508 

(TNM), 2018 WL 1440186 at *3 (D.D.C. Mar. 22, 2018); accord SafeCard Servs., Inc. v. SEC, 

926 F.2d 1197, 1201 (D.C. Cir. 1991) (noting that FOIA does not require agencies to “recreate or 

1

 All page citations refer to the pagination generated by the Court’s CM/ECF system. 
7

to reacquire a document that it no longer has”). FOIA thus would not mandate disclosure of 

information in PIAs that do not exist. Indeed, if FOIA clears the first step for informational 

standing, a plaintiff would always meet that step. Such a holding “would all but eviscerate the 

requirement.” Pub. Citizen, 513 F. Supp. 3d at 20.

Waterkeeper Alliance v. EPA, 853 F.3d 527 (D.C. Cir. 2017), is not to the contrary. 

There, organizations challenged a final EPA rule that exempted certain entities from a reporting 

requirement in the Comprehensive Environmental Response, Compensation, and Liability Act 

(CERCLA). See id. at 532. CERCLA contains no disclosure requirement. See id. at 533. So 

the EPA argued that the organizations lacked standing because the CERCLA exemption did not 

deprive them of any information. See id. The D.C. Circuit disagreed, however, because another 

statute, the Emergency Planning and Community Right-to-Know Act (EPCRA), required public 

disclosure of events when those events also merited a report to the EPA under CERCLA. See id. 

In other words, EPCRA’s disclosure mandates were “piggybacked on the CERCLA mandates in 

one form or another.” Id. Thus, exemptions from CERCLA reporting requirements “had the 

automatic effect of cutting back on EPCRA reporting and disclosure requirements[,]” a 

mechanism that deprived the organizations of information otherwise required for disclosure. Id.

at 534.

The E-Government Act and FOIA share none of the “complex interplay” present between 

the two statutes in Waterkeeper. Id. at 533. That FOIA and the E-Government Act “seek to 

achieve the same goal of public disclosure” does not matter. Opp’n at 16. Nothing in FOIA is 

“expressly tied” to the E-Government Act, or vice versa. Waterkeeper, 853 F.3d at 533. The 

“closer, direct connection” between CERCLA and EPCRA in Waterkeeper is thus “utterly 

lacking” here. Jud. Watch, 2018 WL 1440186, at *3.
8

The Court holds that EPIC has not asserted on behalf of its members an informational 

injury in fact.2

2.

EPIC next argues that its members have suffered injuries to their privacy. See Opp’n at 

16–18. For support, EPIC relies mainly on two declarations. Both members “maintain social 

media profiles containing their images and personal information[]” and “were active on social 

media in 2020” when iCOP allegedly patrolled those sites. Id. at 17. Based on that activity and 

the “3 billion faces” in the Clearview AI database, EPIC says that its members are “highly 

likely” to appear in that database. Id.; see Hartzog Decl. ¶ 9; Gropper Decl. ¶ 9. USPS thus, 

EPIC says, used technology containing personal information without “first conduct[ing] a 

required analysis of the resulting privacy risks[.]” Opp’n at 17.

EPIC labels that failure a “privacy injury sufficient for Article III standing.” Id. But 

EPIC’s own words undermine that characterization. Nowhere does EPIC challenge USPS’s 

mere use of the technology. Instead, the only alleged injury is that USPS did so without “first 

conduct[ing] a required” PIA under § 208. Id. EPIC therefore “allege[s] a bare procedural 

violation” of the Act. Spokeo, Inc. v. Robins, 578 U.S. 330, 341 (2016). Such a violation does 

not create an injury in fact without an underlying concrete harm. See Summers v. Earth Island 

Inst., 555 U.S. 488, 496 (2009). So to show a plausible privacy injury—which is the injury that 

2

 And even if EPIC has, that injury is not redressable. Section 208 requires disclosure of a PIA 

only when “practicable.” Thus, if the Court granted EPIC’s request and ordered USPS to follow 

§ 208, that provision does not require publication of the PIA. Without guaranteed disclosure of 

the information allegedly withheld, EPIC cannot redress its informational injury. See Lawyers’ 

Comm. for 9/11 Inquiry, Inc. v. Wray, 848 F. App’x 428, 430 (D.C. Cir. 2021) (denying standing 

for informational injury when statute “stop[ped] short of imposing” a public disclosure 

requirement).

 
9

EPIC says its members suffered—“EPIC must allege harm that is distinct from a simple failure 

to comply with the procedural requirements of § 208.” EPIC II, 928 F.3d at 102.

EPIC has not done so. Privacy injuries “ordinarily stem from the disclosure of private 

information.” Id.; see In re SAIC Backup Tape Data Theft Litig., 45 F. Supp. 3d 14, 28 (D.D.C. 

2014) (“For a person’s privacy to be invaded, their personal information must, at a minimum, be 

disclosed to a third party.”). Indeed, the D.C. Circuit has recognized a privacy injury only when 

personal information has been disclosed to third parties or there is a risk of such disclosure. See 

In re U.S. OPM Data Sec. Breach Litig., 928 F.3d 42, 56 (D.C. Cir. 2019); Owner-Operator 

Indep. Drivers Ass’n, Inc. v. DOT (OOIDA), 879 F.3d 339, 345 (D.C. Cir. 2018). In contrast, 

EPIC makes no allegation that USPS has disclosed any personal information of EPIC’s members

or is likely to do so. That deficiency in the Complaint is fatal to EPIC’s assertion of a privacy 

injury. See Stewart v. Kendall, — F. Supp. 3d —, No. 21-cv-1387 (RCL), 2022 WL 35642 at *5 

(D.D.C. Jan. 4, 2022).

True, information gleaned from Clearview is now part of USPS’s internal records. That 

arguably constitutes a disclosure. But D.C. Circuit precedent forecloses that argument, too. In 

OOIDA, the Circuit held that the existence of inaccurate information in government databases, 

“absent dissemination,” did not “amount[ ] to concrete injury.” 879 F.3d at 345; cf. EPIC v. 

Dep’t of Educ., 48 F. Supp. 3d 1, 15 (D.D.C. 2014) (finding no injury in fact when, assuming 

that school records included personal information, plaintiffs “failed to make any showing that it 

is likely the schools will disclose the information to unregulated third parties”). “If the mere 

maintenance of inaccurate information is not sufficient to confer standing, surely an agency’s 

retention of prosaic personal information is not either.” Taylor v. FAA, 351 F. Supp. 3d 97, 104 

(D.D.C. 2018).
10 

In response, EPIC relies on the Supreme Court’s decisions in Americans for Prosperity 

Foundation v. Bonta, 141 S. Ct. 2373 (2021), and Shelton v. Tucker, 364 U.S. 479 (1960). 

According to EPIC, those cases show that “government collection of personal information can” 

create concrete harm even without disclosure to the public. Opp’n at 17. Plaintiffs in those 

cases, however, argued that state laws infringed on the First Amendment right to associate. See 

Bonta, 141 S. Ct. at 2379; Shelton, 364 U.S. at 490. In contrast, EPIC asserts no similar 

constitutional injury from the collection of its members’ information.3

 Those decisions are thus 

inapt. EPIC cannot rely on them to find standing for a different alleged injury. See Lewis v. 

Casey, 518 U.S. 343, 358 n. 6 (1996) (“[S]tanding is not dispensed in gross.”). 

In sum, EPIC alleges a bare statutory violation that is “divorced from any concrete” 

privacy injury. Spokeo, 578 U.S. at 341. EPIC has thus “failed to show that its members have 

suffered, or imminently will suffer, a privacy injury” from USPS’s failure to conduct a PIA. 

EPIC II, 928 F.3d at 103. 

IV.

 For these reasons, the Court holds that EPIC lacks standing for any of its claims. The 

Court will therefore grant USPS’s motion to dismiss. A separate Order will issue.

 

Dated: March 25, 2022 TREVOR N. McFADDEN, U.S.D.J. 

3

 Even if EPIC did, the D.C. Circuit has emphasized its “grave doubts” about “a constitutional 

right of privacy in the nondisclosure of personal information, at least where the information is 

collected by the government but not disseminated publicly.” EPIC II, 928 F.3d at 102 (cleaned 

up).