In recent months, the chief election officials for the six states, both Democrats and Republicans, have rejected DOJ’s demands, citing both legal and privacy concerns.

“The Department of Justice did not … identify any legal basis in its June 25 letter that would entitle it to Minnesota’s voter registration list,” Justin Erickson, general counsel for Minnesota Secretary of State Steve Simon (D), wrote. “Nor did it explain how this information would be used, stored, and secured.”

In August, Pennsylvania Secretary of State Al Schmidt (R) wrote, “Because your letters do not provide any legal justification for the Department to disregard this sacred obligation, we are unable to share such confidential information with you.”

“New Hampshire law authorizes the Secretary of State to release the statewide voter registration list in limited circumstances not applicable here,” wrote New Hampshire Secretary of State David Scanlan (R) in his letter rejecting DOJ’s demand. ....

“This isn’t just about a data request,” Arizona Secretary of State Adrian Fontes (D) said in a statement to Democracy Docket. “It’s about protecting your privacy, your security, and your fundamental right to vote free from unnecessary federal overreach. Once that information leaves our custody, there is no guarantee about how it’s handled, where it ends up, or whether it’s properly secured. To date, there has been no clear legal justification or transparent explanation for these demands.”

But the real sticking point for me is the Privacy Act, which I think affirmatively precludes the DOJ from getting the voter files until it answers some basic questions about who would have access to what information for what purpose. (Indeed, the Privacy Act makes it a federal crime to collect the info first and explain later.)

The DOJ has been demanding these files with such confidence that I’ve been wondering whether there’s some not-visible-to-outsiders internal document that relieves those Privacy Act concerns. Both the Oregon complaint and the Maine complaint begin to lay out DOJ’s response to why it’s complying with the Privacy Act. And if what they said is all they got, that’s an awful lot of confidence without the substance to back it up.

In the complaints, most of the DOJ responses on the Privacy Act (including their citation of a website for voluntary reports by individual citizens of civil rights violations) are non sequiturs: they just don’t answer the question. But the DOJ does mention the “systems of records notices” – the disclosure required under the Privacy Act – that it thinks authorize grabbing the voter files. (Here, here, and here.) There’s only one that’s even plausibly relevant: it’s the one that allows the Civil Rights Division (CRT) to keep general info on targets, victims, and witnesses associated with their cases. The notice is pretty straightforward, and its roots go back to 1975 (when the information was stored “on index cards and file jackets”). .....

I suspect that the states resisting DOJ’s demands are going to respond, in part, by saying that they’ve got the right (and responsibility) to decline to abet DOJ’s violation of federal law. That, in turn, means that the DOJ is likely to have to defend its compliance with the Privacy Act in court, with federal judges probing whether they’ve done their homework. And that is a resolution I think Oregon and Maine – and their citizens – are likely to welcome.

That statute is the Privacy Act of 1974. It says that before the federal government collects records on individuals, the government has to facilitate a public conversation – a Federal Register notice and notification to congressional committees — about what information it plans to collect, why it needs the information, who has access, and the like. That’s 5 U.S.C. § 552a(e)(4) and 552a(r). Federal officials who collect info on Americans without this public notice are committing a federal crime. State officials who intend to help the Civil Rights Division blow past this notice requirement may be abetting that crime.

The new letters mention a totally different part of the Privacy Act, and otherwise make some noises about privacy, but those are mostly non sequiturs. I still haven’t seen any indication that the Civil Rights Division has done the homework the Privacy Act requires to collect the voter files. They’ve provided notices on some information the Division maintains in the course of regular enforcement work: enforcing civil rights means you’ll collect some info about victims and targets and witnesses. But none of those notices fairly flag that the Division plans to accumulate a national voter file, with the personal information (and First Amendment activity) of Americans who aren’t any of the above.

The Privacy Act isn’t just a process barrier of its own. It also provides important context for understanding the litigation-hold provisions of the Civil Rights Act of 1960. Given increasing congressional skepticism of federal government acquisition of Americans’ personal data in 1974, it would be deeply weird (not to mention ahistorical) to read the 1960 statute to override the careful constraints in the Privacy Act, giving the Civil Rights Division the authority to vacuum up information on more than 155 million voters, without any individualized “basis” and in service of an invented federal power to double-check every state’s list. Instead, reading the two statutes together helps confirm that the Civil Rights Act authority is as we thought it was: authorizing the AG to get specific information where there’s reason to believe there was a particularized problem in an election within the last 22 months.

I’ve not been shy about my feelings about the merits of the DOJ’s demands under HAVA or the NVRA or the CRA, or about what I still think are grievously unanswered questions about Privacy Act lapses subjecting DOJ officials to criminal liability. (See, for example, here, here, and here.) Now there are eight opportunities for federal judges to decide whether those concerns are right or wrong — and eight reasons for other states to wait for the courts rather than rush to comply with an unwarranted demand — and I think that’s also a good thing. (And even if the states lose, having disclosure driven by court order — including the potential for court-supervised confidentiality protections otherwise unavailable in just responding to a DOJ letter — also seems like a win.)