Homeland Security Secretary Kristi Noem addressing the Department of Homeland Security headquarters in January 2025.
Pool/Getty Images
hide caption
toggle caption
Pool/Getty Images
The Trump administration’s unprecedented initiative to consolidate personal information of millions of Americans is now under legal scrutiny.
A federal class action lawsuit filed this Tuesday contends that the administration’s aggregation of personal data from multiple federal agencies infringes upon federal privacy statutes and constitutional protections. The suit highlights concerns over potential data breaches and the risk of disenfranchising qualified voters.
The complaint asserts that the Department of Homeland Security (DHS), in collaboration with the Department of Government Efficiency (DOGE), is hastily constructing what amounts to “national data repositories” – a concept that both the American public and Congress have historically opposed, and which the Privacy Act was designed to prevent.
Filed in a federal court in Washington, D.C., the lawsuit represents the League of Women Voters, the Electronic Privacy Information Center (EPIC), and five anonymous U.S. residents.
John Davisson, EPIC’s litigation director, emphasized, “Our nation was established on the principle that government should not intrude arbitrarily into private lives. Yet, this administration is violating privacy on an unprecedented scale, unlawfully hoarding sensitive personal data and endangering fundamental rights.”
Davisson, alongside attorneys from Citizens for Responsibility and Ethics in Washington (CREW), Democracy Forward Foundation, and Fair Elections Center, is representing the plaintiffs.
The lawsuit particularly targets the Department of Homeland Security’s SAVE system, which the Trump administration recently repurposed. Originally designed to verify immigration status for foreign-born individuals, SAVE now cross-references Social Security Administration data, enabling state and federal agencies to query it using Social Security numbers. This modification allows the system to access information on U.S.-born citizens, a significant departure from its initial scope.
NPR was the first to expose this transformation in June.
The plaintiffs argue that these alterations to SAVE were implemented covertly, without the legally mandated public notice, congressional oversight, or privacy impact assessments, thereby violating federal privacy laws.
Earlier this month, NPR revealed that several Republican-led states had begun screening their entire voter registries through SAVE to identify noncitizens, with over 33 million voters checked to date.
The lawsuit warns that this expanded use of SAVE risks misclassifying lawful U.S. citizens as noncitizens, potentially stripping them of their voting rights or subjecting them to unjust criminal probes related to voting.
Additionally, the complaint highlights the federal government’s unauthorized consolidation of sensitive personal records into a centralized “data lake” managed by U.S. Citizenship and Immigration Services (USCIS). This repository reportedly includes Social Security numbers, biometric identifiers, tax filings, employment data, medical and disability records, among other private information.
The suit describes this aggregation as a prime target for cyberattacks.
Recent months have seen multiple reports of data security lapses as DOGE advances its data integration efforts. In August, the Social Security Administration’s former chief data officer disclosed that a DOGE employee had copied the Social Security records of over 300 million Americans into the agency’s private cloud, where it was accessible to other staff and vulnerable to identity theft.
The plaintiffs are seeking a judicial order to halt the use of these newly developed data tools.
The lawsuit names DHS, the Social Security Administration, the Department of Justice, and their respective leaders as defendants. The Justice Department has declined to provide a comment.
