SAN FRANCISCO (CN) – A conservative political advocacy group funded by the billionaire Koch brothers must reveal the names of its largest donors to the California attorney general, three judges of the Ninth Circuit ruled Tuesday.

The panel overturned U.S. District Judge Manuel Real’s 2016 ruling that allowed donors to Americans for Prosperity to remain anonymous.

In its lawsuit originally filed against former Attorney General Kamala Harris in 2014, the foundation – which qualifies as a tax-exempt charity – claimed the names of its donors are constitutionally protected, and that disclosing them would cause donors to stop contributing out of fear of threats and harassment from the group’s enemies.

“The mere possibility that some contributors may choose to withhold their support does not establish a substantial burden on First Amendment rights,” U.S. Circuit Judge Raymond Fisher wrote in the opinion, joined by Circuit Judges Richard Paez and Jacqueline Nguyen.

California’s Department of Justice ramped up oversight of charitable organizations in 2010, demanding that thousands of charities submit their federal Schedule B tax forms listing the names and addresses of their donors.

Harris’ office made the demand of Americans for Prosperity and the Thomas More Law Center, a legal organization founded to “restore and defend America’s Judeo-Christian heritage” by opposing, among other things, “the imposition of Sharia law within the United States.”

The law center also sued Harris in 2015, claiming that revealing the names would open its donors up to public and media scrutiny and could deter future donations. Like the Kochs’ foundation, it argued it had not been required to submit a Schedule B in the past, and California’s tax laws do not require that kind of disclosure.

But Fisher and the rest of the panel found the attorney general only uses such information to prevent charity fraud, only makes the information public in limited circumstances, and that the risk of inadvertent disclosure is slight.

“Even assuming arguendo that the plaintiffs’ contributors would face substantial harassment if Schedule B information became public, the strength of the state’s interest in collecting Schedule B information reflects the actual burden on First Amendment rights because the information is collected solely for nonpublic use, and the risk of inadvertent public disclosure is slight,” Fisher wrote.

While the judges recognized that “the attorney general’s office has not maintained Schedule B information as securely as it should have,” they are confident the office has enacted stronger protocols to prevent leaks.

“Nothing is perfectly secure on the internet in 2018, and the attorney general’s data are no exception, but this factor alone does not establish a significant risk of public disclosure,” Fisher wrote.

Representatives for Americans for Prosperity, the Thomas More Law Center and current state Attorney General Xavier Becerra did not respond to requests for comment.

But the Washington-based Electronic Privacy Information Center, which filed an amicus brief in the case, said the appeals court seemed to minimize the overall risk to privacy in an era where anyone’s personal information can be made vulnerable to hackers. EPIC is a public interest research center that specializes in privacy and civil liberties issues, according to its website.

“We specifically focused on the issue of the sensitivity of donor records and the risk of the state amassing the donor records following instances where records had been inadvertently released and made public,” Alan Butler, senior counsel for the center, said in a phone interview Tuesday. “We were really highlighting the sensitivity of the records and the substantial risks to the records when collected en masse.”

Butler said he thought the court had underestimated the risk of wholesale collection and storage of personal information.

“In our view there’s a real nationwide epidemic of data breach and the more sensitive information that you amass, the bigger the target you put on your back and the bigger the risk that that information will be breached or improperly disclosed,” he said. “Our view is that given the unique sensitivity of these records and the risks we’ve seen posed to them, the cost is too great from a constitutional perspective. But the court downplayed the risks.”

But he added that he didn’t believe the case went so far as to allow the government to go about collecting any information it wants.

“This case does not make it open season,” he said.