It follows that any resources EPIC used to counteract the lack of a privacy impact assessment—an assessment in which it has no cognizable interest—were “a self-inflicted budgetary choice that cannot qualify as an injury in fact.”
Feld, 659 F.3d at 25 (internal quotation omitted). EPIC's evidence of expenditures only reinforces the point. It relies exclusively on the declaration of an EPIC “Law Fellow” who before and during this lawsuit submitted Freedom of Information Act (FOIA) requests to (
inter alia) the Commission and the Department of Justice (DOJ).
JA 236-37. EPIC offers no “specific facts” demonstrating that the lack of an assessment
caused it to submit the requests,
Lujan, 504 U.S. at 561, 112 S.Ct. 2130 (internal quotation omitted);
see Appellant's Reply Br. 5-6, 10, so we can only speculate. Speculation is ordinarily fatal to standing,
DaimlerChrysler Corp. v. Cuno, 547 U.S. 332, 344, 126 S.Ct. 1854, 164 L.Ed.2d 589 (2006) (it cannot establish injury);
West, 845 F.3d at 1237-38 (it cannot establish causation or redressability), and that is the case here. EPIC's wide-ranging FOIA requests sought information about (
inter alia) DOJ's data-collection efforts under the National Voter Registration Act; DOJ's legal views about the Commission's authority; and various potentially privileged government communications. An assessment would not likely disclose such information.
See E-Government Act § 208(b)(1)(C), (b)(2)(B). Presumably, then, EPIC would have made similar FOIA requests even if the defendants had produced an assessment.