The Tenth Circuit reasoned:

• By restricting use of voter data in ways that effectively prohibit online republication and broad redisclosure, the Use Restrictions frustrate the NVRA’s central transparency aim.
• Public “inspection” in the sense Congress intended entails making the data available for public scrutiny and analysis, which in turn presupposes the ability of organizations like VRF to obtain, examine, and disseminate those records broadly.
• A state cannot, consistent with § 20507(i), condition access to voter data on a promise that it will not be further shared, posted, or used to support public debate about voter-list accuracy.

The State argued that the Public Disclosure Provision merely requires it to provide “access”, and does not limit its ability to impose “reasonable” use restrictions. The court rejected that argument for two reasons:

1. Conflict preemption focuses on whether state law “stands as an obstacle” to the federal statute’s purposes, not merely on textual inconsistency. Here, the Use Restrictions materially interfere with transparency and public audit of voter rolls.
2. The State’s notion of “reasonable” restrictions (prohibiting any online posting of names and addresses) cannot be reconciled with Congress’s deliberate choice to compel public access to voter-list maintenance records, despite known privacy tradeoffs.

The court also dismissed the State’s argument that privacy and encouraging registration justify New Mexico’s restrictions:

• Congress did not rank the NVRA’s purposes or authorize states to privilege privacy over transparency within the NVRA’s own domain.
• Congress itself confronted the privacy/transparency balance and chose robust disclosure, with narrow, specific exceptions (declinations and agency identity in § 20507(i)(1)).

The Tenth Circuit emphasized that while New Mexico may redact uniquely or highly sensitive data (e.g., SSNs, full birth dates, certain contact information)—a limitation the NVRA does not forbid—what it cannot do is broadly forbid the use or republication of otherwise required voter data.

5. The Data Sharing Ban and conflict with the NVRA

New Mexico’s Data Sharing Ban, N.M. Stat. Ann. § 1‑4‑5.6(A), codified during this litigation, provides that “unlawful use” of voter data consists of:

• “Knowing and willful selling, loaning, providing access to or otherwise surrendering” voter data “for purposes prohibited by the Election Code”; or
• Causing voter data (or any part that can identify a voter or address) “to be made publicly available on the internet or through other means.”

This statute directly targets the kind of behavior VRF engages in: re-sharing and publishing the state voter file online. The Tenth Circuit held:

• Barring publication of data that “could be used to identify a specific voter” (which is nearly all voter-list data) directly contradicts the NVRA’s directive that such records be made available for public inspection.
• Although states may regulate sale or purely commercial exploitation of data in ways that do not frustrate the NVRA’s purposes, a blanket prohibition on making voter data publicly available on the internet is a “step too far.”

In short, both the Use Restrictions and Data Sharing Ban “stand as obstacles” to Congress’s objectives under the NVRA, and are therefore conflict-preempted.

C. What Counts as a “Record” Under § 20507(i)?

The court next addressed whether the specific categories of data VRF requested are “records” within § 20507(i). The State advanced several narrow interpretations that the court rejected.

1. The ordinary meaning of “record” and inclusion of electronic data

The NVRA does not define “record.” The court therefore applied the ordinary-meaning canon, examining dictionary definitions circa 1993 (when the NVRA was enacted).

• “Record” was defined as “knowledge or information preserved or handed down” by being put into writing.
• “Writing” was understood broadly to include typed or otherwise recorded information, and by the mid‑20th century encompassed data recorded on computer storage media.

From this, the court reasoned:

• “Records” include electronically stored information in the State’s SERVIS database.
• The statute does not confine “records” to paper documents; nor does the reference to “photocopying” suggest that only paper records are covered. Photocopying is simply a method, available where feasible, for reproducing records for inspection.

Thus, the argument that a “dynamic” electronic database is not a “record” because it is constantly changing was rejected as inconsistent with the NVRA’s requirement that records be “maintained” (i.e., kept current) for at least two years.

2. Are database queries “new records” beyond the NVRA’s reach?

The State argued that because the SERVIS system must be queried to generate customized reports matching VRF’s requests, the resulting lists are “new” records that:

• The State is not yet “maintaining” within the meaning of § 20507(i)(1); and
• The NVRA does not obligate it to create.

The Tenth Circuit, following the Eleventh Circuit in Greater Birmingham Ministries and the Ninth Circuit’s FOIA analysis in Center for Investigative Reporting v. U.S. DOJ, 14 F.4th 916 (9th Cir. 2021), rejected this position:

• Running a query to retrieve a subset of existing data is akin to “searching through and locating data” in paper files. It does not “create” a new record; it merely arranges existing information.
• If states could avoid disclosure simply by storing data in a centralized database that must be queried to create an exportable list, the NVRA’s Public Disclosure Provision would be effectively nullified.

Because every voter-data request in New Mexico required a SERVIS query and generated a custom report, the State’s “new record” argument would have exempted all such reports from the NVRA, an outcome the court found untenable.

3. Must names and addresses be disclosed?

The State advanced a more technical textual argument: that because § 20507(i)(2) specifically mentions “names and addresses” in connection with one narrow subset of records (notices under § 20507(d)(2)), the general requirement in § 20507(i)(1) should be read to exclude names and addresses in other contexts.

The Tenth Circuit rejected this for several reasons:

• Section 20507(i)(1) requires maintenance and public availability of all records concerning list-maintenance programs and activities, with only two express exceptions:
  • Records relating to declinations to register; and
  • Records revealing the identity of a registration agency for a particular voter.
• Under the principle of expressio unius est exclusio alterius (the expression of one thing implies the exclusion of others), courts may not infer additional implied exceptions (such as an unstated ban on disclosing names and addresses) where Congress expressly enumerated the exceptions it wanted.
• Section 20507(i)(2) uses the term “shall include,” which signals that the listed items (names and addresses of notice recipients) are a minimum, not an exhaustive, subset of what § 20507(i)(1) covers. It does not imply that other names and addresses are excluded.

The court also drew on the First Circuit’s reasoning in Bellows:

• Section 20507(i)(2) does not say “only” or otherwise restrict § 20507(i)(1); it merely confirms that at least that particular subset of personal information must be included in the records available for inspection.
• Reading (i)(2) as a limitation on (i)(1) would contradict the NVRA’s overall text and purpose, and render parts of the statute surplusage.

Accordingly, inclusive of (but not limited to) § 20507(i)(2)’s specific lists, the “records” subject to public inspection must generally include names and addresses when those are part of the list-maintenance records.

D. Relationship to Prior NVRA and Election-Law Precedent

1. Alignment with Fish v. Kobach and Arizona v. Inter Tribal Council

The Tenth Circuit’s approach to preemption closely tracks Fish v. Kobach, which held that the NVRA preempted Kansas’s requirement that motor-voter registrants provide documentary proof of citizenship. There, as here:

• The court rejected a presumption against preemption in the Elections Clause context;
• Read the NVRA’s text straightforwardly, without inferring state “gap-filling” authority absent explicit authorization; and
• Stressed that federal law must prevail where state law substantially undermines Congress’s chosen regulatory scheme.

Likewise, in Arizona v. Inter Tribal Council, the Supreme Court held that the NVRA’s requirement that states “accept and use” a uniform federal registration form preempted Arizona’s additional proof-of-citizenship requirements for that form. There, too, the Court treated congressional regulation of voter registration under the Elections Clause as having strong preemptive force against divergent state rules.

2. Convergence with First, Fourth, and Eleventh Circuits on disclosure

The Tenth Circuit’s reading of the Public Disclosure Provision is very much in line with:

• Fourth Circuit: Project Vote/Voting for America, Inc. v. Long, 682 F.3d 331 (4th Cir. 2012) – held that completed voter registration applications are subject to disclosure under the NVRA, recognizing that transparency is “germane to the integrity of federal elections” and that privacy concerns must yield where Congress has spoken.
• First Circuit: Public Interest Legal Foundation, Inc. v. Bellows, 92 F.4th 36 (1st Cir. 2024) – held that Maine must disclose its statewide voter file (with appropriate redactions for uniquely sensitive information) to a private group under § 20507(i), emphasizing the crucial role of analysis and dissemination in NVRA enforcement.
• Eleventh Circuit: Greater Birmingham Ministries v. Secretary of State for Alabama, 105 F.4th 1324 (11th Cir. 2024) – rejected the “new record” argument and held Alabama must disclose specific voter-list maintenance records generated by querying its database.

These decisions collectively form a robust, multi-circuit consensus that:

• The NVRA’s disclosure obligation is broad and functional;
• Electronic data and database-generated lists are covered “records”; and
• States may not use privacy or format arguments to significantly constrict access to voter-list maintenance data.

3. Distinction from Third and Sixth Circuit standing cases

By contrast, the Tenth Circuit was careful to distinguish the Third and Sixth Circuit’s recent standing opinions—PILF v. Pennsylvania and PILF v. Benson—without rejecting their reasoning outright.

• Those cases involved organizations claiming informational injury from refusal to provide requested NVRA data, with no credible threat of prosecution or other downstream consequence tied to the denial.
• The Third and Sixth Circuits held that bare denial of information—without concrete impact on the plaintiff’s activities—does not suffice for injury in fact.
• Here, by contrast, VRF’s injury flowed from threatened criminal enforcement and chilling of speech, which is a distinct and well-accepted harm supporting standing.

Thus, the Tenth Circuit avoided a direct circuit conflict on informational-injury doctrine, while clarifying that NVRA plaintiffs facing credible enforcement threats may rely on pre-enforcement standing principles instead.

E. The Court’s Treatment of First Amendment Issues

Notably, the panel expressly declined to address any of VRF’s First Amendment claims:

• The district court had:
  • Rejected VRF’s overbreadth, vagueness, and retaliation claims at summary judgment; but
  • Found viewpoint discrimination in the State’s refusal to provide VRF with voter data, after trial.
• On appeal, counsel for both sides agreed that if the Tenth Circuit affirmed the NVRA preemption ruling, there would be no practical need to decide the constitutional issues.

Following the general principle of constitutional avoidance, the court:

• Affirmed the preemption and NVRA-violation holdings; and
• Left the district court’s First Amendment rulings undisturbed but unreviewed.

In effect, the Tenth Circuit resolved the dispute on statutory grounds alone, leaving broader First Amendment questions—about the level of protection for posting voter files online, and the validity of election-related use restrictions—as issues for another day.

F. Remedies and Scope of Relief

Practically, the opinion establishes that:

• New Mexico may not:
  • Criminally enforce its Use Restrictions or Data Sharing Ban against VRF for posting or sharing voter data in ways permitted by the NVRA; or
  • Refuse to provide covered NVRA records based solely on VRF’s intent to publish them online.
• The NVRA requires New Mexico to:
  • Maintain for two years, and make available for public inspection (and, where available, photocopying), all relevant records of list-maintenance activities, including names and addresses;
  • Provide such records upon proper request after notice under § 20510(b), subject only to the statute’s explicit exemptions and permissible redaction of uniquely sensitive personal information.

Although the State ultimately produced the requested data during litigation, the Tenth Circuit held that the controversy was not moot, especially given VRF’s claims for attorney’s fees, costs, and declaratory relief. That leaves room for the district court to award VRF its litigation expenses as a prevailing party under the NVRA.

IV. Practical Implications and Future Impact

A. Implications for States

For states, the decision sends a clear message:

• Use restrictions on NVRA-covered records are severely constrained. States cannot:
  • Condition access to voter data on promises not to share, publish, or otherwise broadly disseminate the information, where that would frustrate public inspection and scrutiny; or
  • Criminalize making such data available online, so long as the data falls within the NVRA’s disclosure mandate.
• Format and procedure cannot be used to undercut disclosure. Storing voter data in electronic databases and requiring custom queries does not relieve states of their obligation to disclose database subsets as “records.”
• Permissible privacy protections remain limited. States may redact particularly sensitive identifiers (e.g., SSNs, full dates of birth, protected addresses such as for Safe at Home participants) where such redaction does not materially undermine the NVRA’s transparency objectives. But broad withholdings of names, addresses, or voting histories are suspect where those elements are integral to list-maintenance records.

States with statutes or administrative practices that:

• Ban online posting of voter-registration lists;
• Restrict uses of such data to narrow “official” or “non-public” purposes; or
• Condition access on promises not to republish identifiers,

should reevaluate those regimes in light of Voter Reference Foundation v. Torrez. Under the Tenth Circuit’s reasoning—consistent with First, Fourth, and Eleventh Circuit precedent—such regimes risk being conflict-preempted by the NVRA.

B. Implications for Transparency and Election-Integrity Organizations

For entities like VRF, the opinion:

• Strengthens the legal foundation for acquiring and republishing statewide voter files and list-maintenance records under the NVRA, particularly when they:
  • Serve noncommercial, civic, or research objectives; and
  • Provide contextual analysis aimed at detecting errors, double registrations, or out-of-date entries.
• Clarifies standing avenues. Organizations facing:
  • Threatened or actual enforcement under state criminal or civil laws, or
  • Formal refusals of data premised on prospective online publication,
  can rely on pre-enforcement and chilling-effect doctrines, rather than informational injury alone, to establish standing.

That said, organizations should still exercise care:

• States remain free to enforce generally applicable laws (e.g., prohibitions on doxxing, harassment, or commercial misuse) as long as they are not in conflict with the NVRA’s disclosure obligations.
• Entities that handle voter data should consider reasonable measures to avoid facilitating individualized targeting or threats, even though the NVRA itself mandates certain disclosures.

C. Litigation Strategy Under the NVRA

Voter Reference Foundation highlights a strategic pattern emerging in election-related litigation:

• Prioritize statutory arguments over constitutional ones when the NVRA (or similar federal statutes) squarely addresses the issue; courts are often more comfortable granting relief on statutory preemption grounds than resolving novel First Amendment questions.
• Use pre-enforcement suits when facing threats, rather than waiting to be prosecuted. Proper NVRA notice and a credible threat of enforcement can support an early, proactive challenge.
• Build the record on how the requested data relates to list-maintenance “programs and activities” and why public analysis and dissemination are essential to your organizational mission.

D. Interaction With Emerging Privacy Regimes

The opinion also intersects with broader debates over privacy and public records:

• As states consider more robust data-privacy regimes—akin to California’s CCPA or European-style protections—they must account for federal preemption in domains Congress has specifically addressed, like voter-registration records for federal elections.
• Voter Reference Foundation demonstrates that generalized privacy concerns do not permit states to override Congress’s deliberate policy choice to favor transparency and public oversight of voter rolls.
• The likely path forward is targeted redaction and program-specific confidentiality (e.g., for victims in address-protection programs), not wholesale restrictions on public access or online dissemination.

V. Clarifying Key Legal Concepts

1. Elections Clause

The Elections Clause (U.S. Const. art. I, § 4, cl. 1) divides authority:

• States must initially set rules for the “Times, Places and Manner” of congressional elections; but
• Congress may “make or alter” those rules at any time.

When Congress legislates, as with the NVRA, its enactments can displace conflicting state laws governing federal elections.

2. Conflict Preemption

Conflict preemption occurs when:

• It is impossible to comply with both federal and state requirements; or
• The state law stands as an obstacle to accomplishing Congress’s full purposes and objectives.

In this case, New Mexico’s Use Restrictions and Data Sharing Ban obstructed Congress’s chosen means of promoting transparency and accuracy in voter rolls by inhibiting broad public access and dissemination of list-maintenance records.

3. Informational Injury vs. Chilling Injury

• Informational injury – arises when a statute creates a right to information, and the plaintiff alleges harm from not receiving it. Not always sufficient for standing without concrete downstream effects.
• Chilling injury – occurs when realistic threats of enforcement cause a plaintiff to refrain from engaging in speech or conduct protected by the Constitution (e.g., First Amendment speech). Courts treat this as a concrete injury supporting pre-enforcement challenges.

4. “Records” and Database Queries

• Records under the NVRA include any written or recorded information—paper or electronic—about list-maintenance programs and activities.
• Pulling a subset of data from an existing database via a query does not “create” a new record; it merely generates a view of existing information and is covered by § 20507(i).

5. Canons of Statutory Construction Used

• Ordinary Meaning Canon – interpret words as they were commonly understood when enacted, unless context demands a technical meaning.
• Whole-Text Canon – read statutory provisions in context of the entire statute, not in isolation.
• Expressio unius est exclusio alterius – the expression of some things (here, explicit exceptions) implies the exclusion of others not mentioned.
• Anti-surplusage Canon – avoid interpretations that render statutory language superfluous or meaningless.

6. “Shall” vs. “May”

The NVRA’s use of “shall” in § 20507(i) (“shall maintain … and shall make available”) is interpreted as mandatory, not discretionary. States are obligated—not merely permitted—to provide the specified public access.

VI. Conclusion

Voter Reference Foundation v. Torrez is a significant addition to the NVRA and election-law canon. The Tenth Circuit:

• Affirmed that private organizations threatened with enforcement for publishing voter data have standing to mount pre-enforcement challenges; and
• Held that New Mexico’s Use Restrictions and Data Sharing Ban are conflict-preempted by the NVRA, because they impermissibly limit how NVRA-covered voter-list records may be used and disseminated.

In doing so, the court:

• Aligned with the First, Fourth, and Eleventh Circuits’ robust reading of § 20507(i)’s Public Disclosure Provision;
• Clarified that “records” include electronic and database-generated lists, and that names and addresses within list-maintenance records generally fall within the NVRA’s disclosure mandate; and
• Reinforced the principle that when Congress regulates federal election procedures under the Elections Clause, state efforts to impose conflicting or constricting rules must yield.

Beyond New Mexico, this decision signals that states cannot rely on privacy-based use restrictions or anti-sharing statutes to prevent publication or broad dissemination of voter rolls and related list-maintenance data that the NVRA requires to be available for public inspection. At the same time, it leaves room for targeted redaction of particularly sensitive identifiers and for future litigation over the constitutional dimensions of publishing such data, which the Tenth Circuit prudently left unresolved.

Taken together, Voter Reference Foundation v. Torrez cements a strong, NVRA-based transparency regime for voter-registration records, and will likely shape both state legislative drafting and election-related litigation strategy for years to come.