INTRODUCTION

Plaintiff-Appellants (“plaintiffs”) are registered gun owners in California. They appeal from the district court’s dismissal of their action that challenged California legislation aimed at encouraging research on firearm violence. The legislation, Assembly Bill 173 (“AB 173”), enables research using databases maintained by California’s Department of Justice (“DOJ”). See 2021 Cal. Stat., ch. 253. Plaintiffs object to the dissemination of data contained in those databases. The relevant data consists of identifying information about purchasers of firearms and ammunition, as well as of persons who hold permits to carry concealed weapons (“CCWs”). AB 173 requires DOJ to provide this information to a research center at University of California- Davis, and gives DOJ discretion to disseminate this information to other accredited research institutions. Cal. Penal Code §§ 11106(d), 30352(b)(2). Currently, the only approved institution is housed at Stanford University.

DOE V. BONTA 5

Plaintiffs principally challenged AB 173 as violating their Fourteenth Amendment right to informational privacy and their Second Amendment right to keep and bear arms. The district court held that plaintiffs failed to allege a plausible informational privacy claim, mainly because plaintiffs’ privacy interest in the disclosed information is minimal. Doe v. Bonta, 650 F. Supp. 3d 1062, 1073–74 (S.D. Cal. 2023). The information is largely biographical and similar to that which is found in other public registries. The district court further reasoned that the risk of unauthorized disclosure is sufficiently mitigated by the State’s safeguards, which include requirements that researchers follow strict data security protocols and refrain from publicly disclosing personal identifying information. Id. at 1074. With respect to the Second Amendment, the district court ruled that the statute does not restrict conduct covered by the plain text of the Second Amendment under the standard articulated by the Supreme Court in New York Rifle & Pistol Ass’n, Inc. v. Bruen, 597 U.S. 1 (2022). Id. at 1072. We affirm.

FACTUAL AND PROCEDURAL BACKGROUND

California’s DOJ maintains two databases relevant to this case. The first database relates to purchasers of firearms and applicants for CCWs. Cal. Penal Code § 11106(b). It is called the Automated Firearm System (“AFS”). The second relates to purchasers of ammunition and is known as the Ammunition Purchase Records File (“APRF”). Cal. Penal Code § 30352(b)(1). The databases are not new. California has long permitted disclosure of information from these databases to a wide range of public officials, primarily for law enforcement purposes. See Cal. Penal Code §§ 11105(b)–(c), 11106(c)(1), 30352(b)(1). The relevant data contained in the AFS is primarily obtained from the information firearms purchasers must supply to dealers, who then transmit that information, along with particulars about the purchased firearm, to DOJ. See Cal. Penal Code §§ 28100(a), 28160. Local authorities also provide DOJ with specified CCW records. See Cal. Penal Code § 26225(a). DOJ is statutorily required to include in the AFS the following personal information about gun purchasers and CCW holders: name, address, identification, place of birth, telephone number, occupation, sex, description, and legal aliases. Cal. Penal Code § 11106(b)(2)(A). The APRF contains similar information collected from ammunition vendors. Cal. Penal Code § 30352(a)–(b)(1). Plaintiffs do not object to the existence of these databases or to dissemination of the information for law enforcement purposes. The legislation at issue in this case, AB 173, became effective in September 2021. It amended the existing statutes to require DOJ to disclose data from these databases to researchers. See 2021 Cal. Stat., ch. 253; see also Cal. Penal Code §§ 11106(d), 30352(b)(1). The statute itself names as a recipient of the information the California Firearm Violence Research Center at University of California-Davis. Cal. Penal Code §§ 11106(d), 30352(b)(2). The Center is a state institution the legislature created to do research on firearm violence, in order to inform policy and assist the legislature in enacting appropriate legislation. See Cal. Penal Code § 14231. The statute also permits DOJ in its discretion to share information from these databases with other accredited, non-profit research institutions studying firearm violence. Cal. Penal Code §§ 11106(d), 30352(b)(2). Currently, Stanford University houses the only institution so authorized.

DOE V. BONTA 7

Within a few months of AB 173’s effective date, five registered California gun owners filed this action in the district court pursuant to 42 U.S.C. § 1983. Their complaint asked the district court to enjoin DOJ from enforcing the legislation and to declare it unconstitutional as infringing their Fourteenth Amendment right to informational privacy and Second Amendment right to keep and bear arms. Plaintiffs claimed an additional due process violation in the alleged retroactive expansion of access to their identifying information. They also alleged a preemption claim under the federal Privacy Act relating to the collection of Social Security Numbers (“SSNs”) through CCW applications, although none of the relevant statutes call for collection of SSNs. Plaintiffs moved for a preliminary injunction against enforcement of AB 173, and the State moved to dismiss for failure to state a claim. The district court granted the State’s motion in a thoughtful opinion dealing with all the plaintiffs’ contentions. Bonta, 650 F. Supp. 3d at 1069-78. This appeal followed.

ANALYSIS

I. Plaintiffs Did Not State a Claim for Violation of the

Right to Informational Privacy under the Fourteenth Amendment. Our court has recognized a right to informational privacy under the Fourteenth Amendment stemming from an individual’s interest in avoiding disclosure of personal matters. See Endy v. County of Los Angeles, 975 F.3d 757, 768 (9th Cir. 2020). In Doe v. Garland, we described such matters as “highly sensitive” personal information, like medical records relating to abortion. 17 F. 4th 941, 947 (9th Cir. 2021), cert. denied, 142 S. Ct. 2815 (2022); see also Tucson Woman’s Clinic v. Eden, 379 F.3d 531, 553 (9th Cir. 2004) (holding that a law requiring abortion providers to disclose unredacted medical records and ultrasound pictures violated patients’ right to informational privacy), abrogated on other grounds by Dobbs v. Jackson Women’s Health Org., 597 U.S. 215 (2022). We held that the information at issue there—plaintiff’s name, age, and employment history, and the charges against him—was not similarly sensitive and thus did not implicate the right to informational privacy. Id. at 944, 947. The personal information that is contained in DOJ’s databases is not highly sensitive either. It consists largely of biographical data, which we have recently observed does not implicate the right to informational privacy. See A.C. by & through Park v. Cortez, 34 F.4th 783, 787–88 (9th Cir. 2022). In considering the disclosure of juvenile records, we have distinguished between “innocuous biographical data” and “intimate” information such as “medical diagnoses, reports of abuse, substance-abuse treatment records and the like.” Id. at 787. Other decisions further illustrate the kinds of intimate information that are protected. See, e.g., Planned Parenthood of S. Ariz. v. Lawall, 307 F.3d 783, 790 (9th Cir. 2002) (information regarding an abortion decision); Thorne v. City of El Segundo, 726 F.2d 459, 468 (9th Cir. 1983) (information regarding sexual activity). The AFS and APRF contain only identifying information that is not intimate personal information that would implicate the right to privacy under our decisions. Plaintiffs nevertheless contend they had a reasonable expectation that their information would remain confidential and that such an expectation was protected by the Fourteenth Amendment. Our court has no case holding that a reasonable expectation of privacy in information triggers

DOE V. BONTA 9

Fourteenth Amendment protection. Plaintiffs look to a case from the Tenth Circuit where the government breached a pledge of confidentiality that had been instrumental in obtaining intimate personal information. See Sheets v. Salt Lake County, 45 F.3d 1383, 1387–88 (10th Cir. 1995). In Sheets, the husband of a murder victim, after receiving a promise of confidentiality from police, turned over the victim’s diary to the police, who then disclosed its contents to the author of a book. Id. at 1386. The present case is not remotely similar; there was no promise of confidentiality, the information was not highly personal, and there were significant protections against public disclosure. None of the other cases plaintiffs cite support their position. Rather, the cases suggest that there is no legitimate expectation of privacy in information that is not highly personal, even where the government assures confidentiality. See, e.g., Mangels v. Pena, 789 F.2d 836, 839 (10th Cir. 1986) (no legitimate expectation of privacy in information about plaintiffs’ use of illicit drugs, irrespective of assurances of confidentiality from police); Eagle v. Morgan, 88 F.3d 620, 625 (8th Cir. 1996) (no legitimate expectation of privacy in details of plaintiff’s prior guilty plea). There is no legal authority to support plaintiffs’ contention that there can be a reasonable expectation of confidentiality where, as here, the information is not highly personal. Rather, the reasonableness of the expectation depends on the intimate nature of the information. As the Fourth Circuit said in Walls v. City of Petersburg, “[t]he more intimate or personal the information, the more justified is the expectation that it will not be subject to public scrutiny.” 895 F.2d 188, 192 (4th Cir. 1990). Plaintiffs maintain that they have plausibly alleged that the AFS database includes sensitive information, namely their SSNs. Our court has indicated that SSNs may implicate the right to privacy in some situations where the government has no legitimate reason to require their disclosure. See In re Crawford, 194 F.3d 954, 958 (9th Cir. 1999). In Crawford, we held that the right was not violated because the government had a legitimate reason for requiring disclosure of SSNs to adequately identify tax preparers and guard against fraud. Id. at 959–60. In this case, we do not need to decide whether the State had a legitimate reason for disseminating SSNs because plaintiffs cannot show that AB 173 resulted in any disclosure of their SSNs. Plaintiffs raise the issue because during the period relevant to this case, the State’s CCW application asked for the applicant’s SSN, and the founding director of the California Firearm Violence Research Center declared that researchers have received CCW applications. Even if this suggests that SSNs were transmitted to researchers, that transmission was not made pursuant to any relevant statutory authority. Cal. Penal Code § 26225(b) lists the records that authorities issuing CCWs must provide to DOJ, and CCW applications are not among them: only CCW denials, issuances, revocations, and amendments are listed. Moreover, the statute describing the contents of the AFS database does not mention SSNs. See Cal. Penal Code § 11106(b)(2)(A). None of the challenged statutes require that SSNs be included in the AFS database or disseminated to researchers. In sum, the personal information that DOJ is statutorily required to retain in the databases is not intimate personal information that would implicate the right to privacy. Plaintiffs had no reasonable expectation that such

DOE V. BONTA 11

information would never be disclosed. Plaintiffs failed to state a claim that AB 173 violates a right to informational privacy.

II. Plaintiffs Did Not State a Claim for Violation of the

Second Amendment. The operative text of the Second Amendment states that “the right of the people to keep and bear arms, shall not be infringed.” U.S. Const. amend. II. Plaintiffs claim that AB 173’s required disclosure of plaintiffs’ personal information to nongovernmental researchers violates the Second Amendment. The standard governing our decision was recently laid down by the Supreme Court in New York Rifle and Pistol Ass’n, Inc. v. Bruen, 597 U.S. 1, 24 (2022). The standard looks to the plain text of the Second Amendment to see whether it covers the plaintiffs’ conduct. “When the Second Amendment’s plain text covers an individual’s conduct, the Constitution presumptively protects that conduct.” Id. The Second Amendment covers the right to “keep and bear arms.” U.S. Const. amend. II. The conduct in Bruen was carrying a gun. Bruen struck down New York’s requirement that applicants establish a special need for self protection in order to obtain a permit to carry a handgun outside the home. Bruen, 597 U.S. at 70–71. The plain text of the Second Amendment covered the plaintiffs’ conduct, i.e., carrying a firearm, and the Court determined that the State’s regulation was not consistent with our country’s historical tradition of gun regulation. Id. at 33, 38–39. The initial and critical inquiry in this case is therefore what conduct of the plaintiffs is relevant. Bruen itself suggests that the relevant conduct of the plaintiffs is “the proposed course of conduct,” i.e., the conduct the regulation prevents plaintiffs from engaging in. Id. at 32. In Bruen, the “proposed course of conduct” was “carrying handguns publicly for self-defense.” Id. at 32. That was what the plaintiffs wanted to do and what the challenged law prevented them from doing. Plaintiffs here maintain that the relevant conduct is their ability to purchase firearms and ammunition and obtain CCWs. The Second Amendment appears to cover such conduct, but this is not conduct that AB 173 regulates. AB 173 does not regulate the conduct of persons. The law is directed at DOJ and requires it to share data from its databases with researchers. Thus, AB 173 does not regulate conduct protected by the plain text of the Second Amendment or impede plaintiffs’ ability to purchase, keep, carry, or utilize firearms. Plaintiffs alternatively contend that even if AB 173 does not actually impede their ability to keep and bear arms, it chills them from exercising their Second Amendment rights. Plaintiffs claim that, as a result of AB 173, they fear increased risk of public exposure and harassment, and that such fears discourage them from purchasing firearms and ammunition and from applying for CCWs. Plaintiffs’ fears of public exposure, however, appear to be speculative and lacking in empirical foundation. AB 173 authorizes disclosure of biographical information only to accredited research institutions, and as the district court explained, research institutions are prohibited from publicly disseminating personal information. Bonta, 650 F. Supp. 3d at 1072; see Cal. Penal. Code §§ 11106(d), 14231.5(a), 30352(b)(2). The record reflects that DOJ also requires researchers to abide by strict data security precautions to prevent disclosure. There is no allegation that approved research institutions have violated the restrictions imposed

DOE V. BONTA 13

on them, that the institutions have been responsible for any public leak of information, or that the institutions have been the victims of hacking. In sum, neither plaintiffs’ subjective fears of possible future harm nor their choice to refrain from exercising their Second Amendment rights is a concrete injury. See Clapper v. Amnesty Int’l USA, 568 U.S. 398, 410–11, 416 (2013). A feared future injury must be “certainly impending”; speculative fears relying upon a “chain of contingencies” and self-inflicted injuries based on “fears of hypothetical future harm” are insufficient to establish a cognizable injury. Id. Plaintiffs have not plausibly alleged they will suffer any cognizable Second Amendment injury as a result of AB 173. As the district court concluded, “[p]ermitting gun owners’ information to be shared under strict privacy protection protocols for legitimate research purposes . . . [does not] restrict conduct covered by the plain text of the Second Amendment and [is] permissible.” Bonta, 650 F. Supp. 3d at 1072.

III. Plaintiffs Have Not Stated a Claim that AB 173 Is

Unconstitutionally Retroactive. Plaintiffs further contend that AB 173 is unconstitutionally retroactive, in violation of due process, because it requires DOJ to disclose to researchers information plaintiffs provided before the law went into effect. But as the Supreme Court reasoned in Landgraf v. USI Film Products, changes in the law affecting prior events can violate due process only where they attach “new legal consequences” to those events. 511 U.S. 244, 269–270 (1994). Landgraf involved a new damages provision in Title VII of the Civil Rights Act. Id. at 283. Had the provision been applied retroactively, the new legal consequence would have been liability for damages for past conduct. Id. at 283– 84. Retroactive application therefore violated due process. Id. at 266, 283–84. The statute in this case, AB 173, is different. It creates no new cause of action, remedy, or liability for past conduct. It provides only for a limited distribution of information. While the information was provided in connection with past applications and purchases, the statute does not attach any new legal consequences to such earlier conduct. As we have seen, plaintiffs unsuccessfully attempted to allege violations of informational privacy and the Second Amendment, but no constitutional violations occurred.

IV. Plaintiffs Have Not Stated a Claim that the Privacy

Act Preempts California Statutes Concerning CCWs. Plaintiffs’ final contention relates to SSNs. Section 7(b) of the federal Privacy Act requires state agencies to communicate certain information when they request SSNs from individuals. 5 U.S.C. § 552a(e)(3). Plaintiffs claim that two statutes concerning CCW applications are preempted insofar as they compel applicants to disclose their SSNs without providing those applicants with the information required by the Privacy Act. See Cal. Penal Code §§ 26175, 11106(d). A prior version of the State’s CCW application form did request applicants’ SSNs, but the State’s current form no longer does so. The statutes plaintiffs cite do not require SSN disclosure. The first statute is Cal. Penal Code § 26175, which requires that DOJ issue the CCW application form for use throughout the state. Cal. Penal Code § 26175(a). The second is Cal. Penal Code § 11106(d), which instructs DOJ to disclose data from its databases to violence prevention researchers. Neither statute requires that the State request

DOE V. BONTA 15

SSNs, requires that applicants disclose their SSNs, or otherwise mentions SSNs. See Cal. Penal Code §§ 26175, 11106. There is no conflict with the Privacy Act.

CONCLUSION

The judgment of the district court is AFFIRMED.