The presidential election integrity commission, established by executive order in May to investigate baseless claims of rampant voter fraud, hasn’t even had its first meeting yet, but it may have already violated federal law.

Kansas Secretary of State Kris Kobach, longtime champion of the voter fraud narrative, is leading the commission, along with Vice President Mike Pence. Last week, Kobach, who’s also in the running for Kansas governor, sent a letter to every state requesting that they hand over voter rolls containing sensitive information: private citizens’ names, addresses, birthdates, Social Security numbers, party affiliations, voting histories, military status, felon status, and so on.

Simply by asking for that information, the commission might have violated the Federal Privacy Act of 1974, signed in the aftermath of the Watergate scandal, and a federal law regulating how much paperwork government entities can demand of states or citizens.

Justin Levitt, a professor at Loyola Law School, explained that the Federal Privacy Act prohibits the federal government from collecting records of individuals’ party affiliation or voting history. The government, according to the law, should “maintain no record describing how any individual exercises rights guaranteed by the First Amendment unless expressly authorized by statute or by the individual about whom the record is maintained or unless pertinent to and within the scope or an authorized law enforcement activity.” First Amendment rights include voting. Kobach also hasn’t revealed how he intends to maintain or use citizens’ personal information — something the Federal Privacy Act established strict parameters for.

“There is no legitimate use for party affiliation information that I can think of,” Levitt said, adding that Kobach’s request baffled him.

So far, 36 states have agreed to partially comply with Kobach’s request by sharing publicly available information, which varies by state. Arkansas, for example, transferred all information in accordance with its privacy laws to the commission Wednesday morning, according to a spokesperson for the secretary of state. Under Arkansas law, that includes name, birthdate, address, party affiliation, and voting history since 2008. (The commission asked for records since 2006.) But at least 16 states — the most recent being South Carolina and New Jersey — have flat-out refused to give any information at all to the commission.

Aside from just asking for the information, the commission may also have violated the Federal Privacy Act by receiving it.

But there’s another law, the distinctly unsexy Paperwork Reduction Act, that Kobach’s letter might have also violated. Signed by President Jimmy Carter in 1980, the federal law seeks to regulate how much paperwork the federal government can demand of state agencies, private companies, or individuals.

“The commission’s failure to adhere to the [Paperwork Reduction Act] … flouted a legal framework whose provisions would have offered a safeguard against a misguided, and potentially quite harmful, national fishing expedition for voter data,” wrote Larry Schwartztol, counsel to Protect Democracy, a nonpartisan watchdog, for the blog Take Care.

Basically, if you’re asking states for a ton of documents, you need explain why. The value of collecting that paperwork must outweigh the burden to whomever you’re asking — and the public must be given at least 90 days, in various forms, to weigh in on the purpose. Once that’s over, a federal agency or entity is meant to get the final go-ahead from the White House’s Budget Office, which monitors compliance to the Paperwork Reduction Act.

But Kobach didn’t do any of that.