The Volokh Conspiracy
Mostly law professors | Sometimes contrarian | Often libertarian | Always independent
No Second Amendment or Privacy Right Problem with California Laws Disclosing Firearms Purchaser Information to Certain Researchers
From today's decision in Doe v. Bonta, written by Judge Mary Schroeder and joined by Judges Patrick Bumatay and Salvandor Mendoza:
California's DOJ maintains two databases relevant to this case. The first database relates to purchasers of firearms and applicants for CCWs. It is called the Automated Firearm System ["AFS"]. The second relates to purchasers of ammunition and is known as the Ammunition Purchase Records File ["APRF"]…. California has long permitted disclosure of information from these databases to a wide range of public officials, primarily for law enforcement purposes….
DOJ is statutorily required to include in the AFS the following personal information about gun purchasers and CCW holders: name, address, identification, place of birth, telephone number, occupation, sex, description, and legal aliases. The APRF contains similar information collected from ammunition vendors. Plaintiffs do not object to the existence of these databases or to dissemination of the information for law enforcement purposes….
The legislation at issue in this case, AB 173, became effective in September 2021. It amended the existing statutes to require DOJ to disclose data from these databases to researchers. The statute itself names as a recipient of the information the California Firearm Violence Research Center at University of California-Davis. The Center is a state institution the legislature created to do research on firearm violence, in order to inform policy and assist the legislature in enacting appropriate legislation. The statute also permits DOJ in its discretion to share information from these databases with other accredited, non-profit research institutions studying firearm violence. Currently, Stanford University houses the only institution so authorized.
Several gun owners sued, but the court rejected their arguments. First, as to the right of privacy:
Our court has recognized a right to informational privacy under the Fourteenth Amendment stemming from an individual's interest in avoiding disclosure of personal matters. In Doe v. Garland, we described such matters as "highly sensitive" personal information, like medical records relating to abortion. We held that the information at issue there—plaintiff's name, age, and employment history, and the charges against him—was not similarly sensitive and thus did not implicate the right to informational privacy.
The personal information that is contained in DOJ's databases is not highly sensitive either. It consists largely of biographical data, which we have recently observed does not implicate the right to informational privacy. In considering the disclosure of juvenile records, we have distinguished between "innocuous biographical data" and "intimate" information such as "medical diagnoses, reports of abuse, substance-abuse treatment records and the like." Other decisions further illustrate the kinds of intimate information that are protected. See, e.g., Planned Parenthood of S. Ariz. v. Lawall (9th Cir. 2002) (information regarding an abortion decision); Thorne v. City of El Segundo (9th Cir. 1983) (information regarding sexual activity). The AFS and APRF contain only identifying information that is not intimate personal information that would implicate the right to privacy under our decisions….
Second, as to the Second Amendment:
AB 173 does not regulate the conduct of persons. The law is directed at DOJ and requires it to share data from its databases with researchers. Thus, AB 173 does not regulate conduct protected by the plain text of the Second Amendment or impede plaintiffs' ability to purchase, keep, carry, or utilize firearms.
Plaintiffs alternatively contend that even if AB 173 does not actually impede their ability to keep and bear arms, it chills them from exercising their Second Amendment rights. Plaintiffs claim that, as a result of AB 173, they fear increased risk of public exposure and harassment, and that such fears discourage them from purchasing firearms and ammunition and from applying for CCWs. Plaintiffs' fears of public exposure, however, appear to be speculative and lacking in empirical foundation. AB 173 authorizes disclosure of biographical information only to accredited research institutions, and as the district court explained, research institutions are prohibited from publicly disseminating personal information.
The record reflects that DOJ also requires researchers to abide by strict data security precautions to prevent disclosure. There is no allegation that approved research institutions have violated the restrictions imposed on them, that the institutions have been responsible for any public leak of information, or that the institutions have been the victims of hacking. In sum, neither plaintiffs' subjective fears of possible future harm nor their choice to refrain from exercising their Second Amendment rights is a concrete injury. A feared future injury must be "certainly impending"; speculative fears relying upon a "chain of contingencies" and self-inflicted injuries based on "fears of hypothetical future harm" are insufficient to establish a cognizable injury.
Plaintiffs have not plausibly alleged they will suffer any cognizable Second Amendment injury as a result of AB 173. As the district court concluded, "[p]ermitting gun owners' information to be shared under strict privacy protection protocols for legitimate research purposes … [does not] restrict conduct covered by the plain text of the Second Amendment and [is] permissible."
The court also concluded that the relevant statutes didn't call for disclosure of social security numbers, and thus didn't implicate the federal Privacy Act or any informational privacy right focused on SSNs.
Sebastian Brady argued the case for the state.
Editor's Note: We invite comments and request that they be civil and on-topic. We do not moderate or assume any responsibility for comments, which are owned by the readers who post them. Comments do not represent the views of Reason.com or Reason Foundation. We reserve the right to delete any comment for any reason at any time. Comments may only be edited within 5 minutes of posting. Report abuses.
Please
to post comments
Forget it Jake, it’s California
Well, once the independent contractors get access to the database you're screwed. Just like the access given to 'contractors' that did thousands of searches through the Federal database to follow Trump. Both before and after the election. 86 percent were the same search using different days. Audited by the government.
"California Firearm Violence Research Center at University of California-Davis"
What do we expect the political persuasion of the Leaders, staff, and support contractors of this center?
- Pro 2AD?
- Anti 2AD?
- Agnostic on guns, just looking for a paycheck?
How well protected is the data? In theory, the IRS has an audit record of every touch of every tax record, yet the place leaks like a sieve.
When my data is leaked, who do I sue?
UCD Grad
It's headed up by Garen Wintemute. Which if you're familiar with the 2nd amendment fight, says it all. You'd be hard put to find somebody with academic credentials that was more hostile to gun ownership.
As I read it, his center is state funded and intended to produce statistics that support new nation wide gun laws
"Several bills have been turned down in Congress due to a lack of data on the impact of gun violence on public health, and the center's founders hope to provide necessary data to advance legislation."
Interestingly, only to researchers affiliated with the CFVARC at UCD. For other researchers to get their hands on the data, the DOJ has to approve access and only for those accredited by the DoEd or CHEC for "the study of the prevention of violence." So the Second Amendment Foundation? Probably not.
So, the government can claim to have more accurate data than other non-profits because they have hard registration data, but others have to rely upon survey data and manufacturer sales reports.
"California has long permitted disclosure of information from these databases to a wide range of public officials, primarily for law enforcement purposes…."
Well, mainly for doxing purposes at this point, if you want to be honest. I do hope this is rapidly appealed, because the state will want to get that database into leaky hands ASAP, so that any subsequent reversal will be moot.
This was an appeal.
There's always the Supreme Court so appeals are not exhausted.
Although I doubt the Supreme Court would grant cert on this issue at this time. The Supreme Court will soon have their hands full with 2A issues such as reigning in the ATF (perhaps setting broad precedent that many defenders of the ATF's overreach may regret shortly thereafter) and slapping lower courts who seem to think that Heller and Bruen don't apply for some reason (perhaps, for example, the Court will point out that, shockingly, the "Aloha Spirit" doesn't in fact trump the US Constitution unless Hawaii can find a way to secede from the Union).
Yeah, while the Court does recently tend to come down on the right side of this issue if they deign to take a case, they really have not internalized the idea that the rights of gun owners being violated is important.
I think it only offends them on a theoretical level, they're not otherwise actually bothered by it. So there's no urgency to do anything about it.
Justice Kagan "[is] not sympathetic." We can assume so are Sotomayor & Jackson. That still leaves six Republican-appointed justices. The votes of only four justices are required to grant certiorari. Apparently at least three "conservative" justices are not "sympathetic" enough... Any guesses as to who they might be?
Well, I'm pretty sure Roberts would be one of them.
The law's been in effect for two and a half years. Sounds like they're not very good at leaking!
...and what is the penalty if that so called "strict privacy protection protocols" is breached?
One senate hearing, one house hearing, and a sternly worded letter.
Property owners are public information. Liquor licensees are public information. Law licensees are public information. Securities licensees are public information. What is snowflakey about gun permittees?
Registered Sex Offenders Addresses are pubic records also, so we know who to stay from, would YOU want to live next door to Jerry Sandusky?
If the abortion info got out, what would you, or anyone, snowflakily but rightly be worried about in this climate or any other the past 50 years?
First, I expect anti-abortion absolutists (on a "mission from god") to attempt to identify and persecute women in this context.
Second, though, I was not aware abortion involved licensure (for the patient).
That is because no state has enacted such a law.
Which are in the Constitution?
Business licenses are public record so the public can ensure the person they are doing business with is properly licensed. The firearm equivalent would be FFLs, not private permit holders.
Just more reason not to buy from an FFL
All private firearm sales and transfers on California must be done through a state-licensed dealer, who in turn is required to put the sale/transfer in this database.
Ibid
There is clearly no 2A violation. As well argue that there shouldn't be parking restrictions in front of a gun store.
Sure, and there'd be no problem requiring people to buy all their books from licensed book dealers who keep the government apprised of who owns what books, prohibiting private sales of paper and ink. And then passing the information on to groups organized to promote censorship.
None of the policies discussed here is like anything you just said.
The leaking you claimed was the actual main purpose has not happened yet in any noticeable fashion.
Some might examine their knee-jerk narrative given that fact. But you're still on your paranoid bullshit, finding trouble before it happens by telepathically finding bad faith in liberals.
Yeah, it's not like the leaking that Brett pointed out has made international news.
Oh, wait: https://www.theguardian.com/us-news/2022/jun/30/california-gun-owners-data-breach
First, as Noscitur has pointed out this has been going on for a while with no leak; your 'some other people in California 2 years ago had a data breach' is not relevant.
Second, as said in the OP, that isn't even the kind of data at issue here.
“Not relevant… some other people?!”
The leaker was the California DOJ: the sole state entity charged with collecting and protecting data about every firearm owner in the California. It’s the same state entity that will be distributing this data. And the leak involved exactly the same the data at issue in this litigation.
It simply can’t get more relevant.
Unless you’re a reactionary loser who gets their kicks attacking people in an obscure corner of social media
"you’re a reactionary loser"
Indeed. But I'm sure he thinks of himself as a "liberal" (or maybe "progressive")!
I wonder if you will acknowledge that you are wrong when this information is inevitably leaked.
Not really. I know you won't.
This case is captioned:
JANE DOE, an individual; JOHN DOE, No. 1, No. 2, No. 3, No. 4, individuals, Plaintiffs-Appellants, v. ROB BONTA, in his official capacity as Attorney General of the State of California; DOES, 1-25, inclusive, Defendants-Appellees
And there's not a single mention of pseudonymous litigation or indication that one of Eugene's law school students authored a motion to unseal the parties name. I guess Second Amendment litigation has a special place. Now when it comes to Maine lottery winners ....
Don't forget the right-wing jerk who sprayed chemicals at Columbia . . . Prof. Volokh seems similarly (and unusually) unbothered by that guy's pseudonymity.
Clingers gonna cling. Partisan hacks gonna hack.
It seems certain that someone at some such research outfit will leak the data to a sympathetic publisher, and from there individuals who have bought ammunition, particularly in quantity, will be identified and subject to intense harassment.
And from there on, that will be the status quo.
Speculative as that might be, it seems about as speculative as predicting that a devastating forest fire will occur in California this summer.
It seems certain
The data, as detailed above, does not contain personally identifying information, just non-personalized biographical information.
The OP notes other examples of sensitive information used for science - sexual activity and deciding whether to have an abortion. Neither seems to have had a problem
So do you have any reason for this "seems certain" other than knee-jerk hostility?
"The data, as detailed above, does not contain personally identifying information, just non-personalized biographical information. "
Could you point out the language that says that? I'm not seeing it.
I see that A)the databases include name and address, for example, and B)the data may be provided to researchers. I'm not seeing where the data is being anonymized by e.g. removing names and addresses. Maybe it is; I'm just not seeing that in the decision.
If I tracked down the right language, the law reads:
"(d) All information collected pursuant to this section shall be maintained by the department and shall be available to researchers affiliated with the California Firearm Violence Research Center at UC Davis for academic and policy research purposes upon proper request and following approval by the center’s governing institutional review board when required. At the department’s discretion, and subject to Section 14240, information collected pursuant to this section may be provided to any other nonprofit bona fide research institution accredited by the United States Department of Education or the Council for Higher Education Accreditation for the study of the prevention of violence and following approval by the institution’s governing institutional review board or human subjects committee when required. Material identifying individuals shall only be provided for research or statistical activities and shall not be transferred, revealed, or used for purposes other than research or statistical activities, and reports or publications derived therefrom shall not identify specific individuals."
That last sentence seems in tension with your position.
"The personal information that is contained in DOJ's databases is not highly sensitive either. It consists largely of biographical data, which we have recently observed does not implicate the right to informational privacy. In considering the disclosure of juvenile records, we have distinguished between "innocuous biographical data" and "intimate" information such as "medical diagnoses, reports of abuse, substance-abuse treatment records and the like."
That does not support your contention of "does not contain personally identifying information, just non-personalized biographical information".
Name and address are "personalized" even if characterized as "innocuous biographical data”. They may well be less sensitive than medical diagnoses, but they aren't "non-personalized".
The law says "All information collected pursuant to this section ... shall be available to researchers", and name and address are part of the information collected.
If there is an anonymization or redaction requirement somewhere, please point it out.
Preemptively attack. Lie about incontrovertible facts. Declare bad faith.
Then disappear when you’re shown to be categorically wrong. Rinse & repeat daily.
What a pathetic way to get your kicks.
He can't, because there isn't.
So S_0 is just making stuff up? I'm shocked....SHOCKED, I tell you!!!
Sarcastr0, try for a second, I know you're resistant to this, imagining that it was a database on some other topic. Recipients of late term abortions. Owners of dildos. owners of books written by Marx.
Anything where you actually CARE if the people on the list get doxed.
Of course the damned list has highly sensitive data on it: It's a list of gun owners. If it were JUST a phone book, no big deal. But if Alabama generated a copy of the phone book with every gay underlined, and handed it to their sex offender unit, you'd freak.
Well, that's what California did here. The possibly 2nd most hostile to gun ownership state in the country compiled a database of gun owners, to give to the "California Firearm Violence Research Center at University of California-Davis".
An organization the state created specifically for the purpose to research ways to violate the rights of gun owners!
“Sarcastr0, try for a second, I know you’re resistant to this, imagining that it was a database on some other topic. … Anything where you actually CARE if the people on the list get doxed.”
A true mark of a liberal — refusing equal rights to people you dislike.
Whoever called him a reactionary upthread nailed it.
>DOJ is statutorily required to include in the AFS the following personal information about gun purchasers and CCW holders: name, address, identification, place of birth, telephone number, occupation, sex, description, and legal aliases.
That's the exact opposite of "non-personalized".
>The OP notes other examples of sensitive information used for science – sexual activity and deciding whether to have an abortion. Neither seems to have had a problem
The OP does not have any cases where such information was used for science. That sensitive information was being used in other contexts.
Not exactly following the principle of least privilege
So, I suppose the researchers get phone numbers in order to conduct surveys of persons involved in transactions?
Are they really handing out datasets like this? This does and does not amaze me at the same time.
Would not some non-identifying demographic information be enough for research purposes? Why would a researcher require aliases of these individuals? Are they doing analysis on number of aliases, commonalities, or other metrics?
"Would not some non-identifying demographic information be enough for research purposes?"
IIUC, that's the norm for e.g. medical research. The researcher might get some kind of random unique identifier number and a zip code or whatever.
Others (Don Nico?) probably have better info.
That is what I am thinking.
Zip code, year of birth, sex. Those should be sufficient. You don’t even need a surrogate key supplied unless they are looking for transactions per individual.
I agree with what someone else questioned what would it be like if the government tracked any other legal purchases like this. What if your grocery and dining information were subject to scrutiny and analysis? Let’s say Wal-Mart were to provide information to government and government were to broker that information to insurance companies.
The data is out there to be able to perform some scary sorts of analyses on people’s lives and then develop and implement policy based on those analyses. Some entity, somewhere knows if you are eating your Wheaties.
Edited because autocorrect did not believe in the plural of analysis.
Lots of places sell your data. CarFax knows when you get your oil changed, if you get it changed at certain places.
But at least that's not mandated, and you *can* still find some places that don't sell data.
"what would it be like if the government tracked any other legal purchases like this. "
What it would be like if the government tracked any other exercise of an explicit civil liberty, you mean?
The objection to gun registration, (To which California added ammo registration!) has always been that its purpose is to facilitate violating a constitutional right: If the government doesn't know who owns what guns, it has a very hard time trying to confiscate them, or punish ownership of them in some way. Once it knows, it has all sorts of things it can do, formally and informally.
One of them is to pass the information on to private parties, so that the punishment can nominally not be government action... This is a step in doing that: Distribute the information more widely, so that when it turns up in hands it shouldn't, you can't be sure who leaked it.
Ironic thing is that a list of owners of Legal “Class 3" Weapons (Machine Guns, Suppressors/Silencers Short Barreled Rifles/Shotguns) can’t be released as the registration forms are Tax Forms (no ” needed, they’re actually Tax Forms)
Frank
Another in an ever growing list of reasons to leave Kalifornia behind.
And the highly skilled, economically viable, properly educated intellectuals from West Virginia, Arkansas, Idaho, Mississippi, and Wyoming shall lead us!