RUDOLPH CONTRERAS, United States District Judge.
Ayuda, Inc., Catholic Charities of the Archdiocese of Washington, D.C., Catholic
The FTC is the federal agency with principal responsibility for protecting consumers from deceptive and unfair trade practices. See Stearns II Decl. ¶ 3. The agency's responsibilities include enforcing the FTC Act, the federal antitrust laws, and dozens of other federal statutes. See id. This litigation arose following three FOIA requests from Plaintiffs, a collection of nonprofit entities,
Complaints enter the Consumer Sentinel database in several different ways. Of note for purposes of this case, complaints are either submitted directly by consumers through the FTC's website, entered by an FTC operator in response to calls from consumers on the FTC's telephone complaint line, or transferred from independent online services provided by other governmental and private entities, including the Canadian Anti-Fraud Centre and the Econsumer.gov website. See id. ¶¶ 4, 18-19;
On March 27, 2013, the FTC received a FOIA request, Request No. 2013-00680, from an attorney representing Plaintiffs. See Stearns Decl. ¶ 5 & Ex. A. This request sought "a copy of all complaints that are recorded in the Consumer Sentinel database," with "only the information" contained in seventeen specified free-form and non-free-form data fields:
Table 1
Fields Sought in Request No. 2013-00680 Source : Stearns Decl. ¶ 5 & Ex. A
The FTC's FOIA Unit originally granted the request on May 2, 2013, see Admin. Record, Am. Compl., ECF No. 11, Ex. E ("AR") at 12, but two weeks later the agency reversed its position and denied the request. See id. at 14. The agency explained that it denied the request because (1) the data might reveal patterns of FTC procedures that would divulge the agency's deliberative process; (2) the data would reveal "FTC codes" used in the Consumer Sentinel database; and (3) certain FOIA exemptions may apply to the information in the complaints. See id.
Regarding the third point, the FTC explained that it had determined that a number of the requested free-form data fields contain, or might contain, information that could, standing alone or in combination with other information, identify the consumer who submitted the complaint or another individual mentioned in the complaint, such as the alleged wrongdoer. See Stearns Decl. ¶¶ 11-12. The FTC therefore concluded that these data fields must be reviewed manually to avoid disclosure of personal identifying information, and the agency estimated that this review would take more than 8,000 hours to complete given the size of the Consumer Sentinel database. See id. ¶¶ 11, 22. Separately, the FTC's contractor estimated that it would cost $3,982.40 to export data for the requested fields that the agency had not rejected. See id. ¶ 9 & Ex. C; Rushen Decl. ¶ 6. On June 10, 2013, the FTC denied Request No. 2013-00680 when counsel for Plaintiffs did not pre-pay the estimated processing cost. See Stearns Decl. ¶ 25 & Ex. F.
On May 24, 2013, the FTC received a second request, Request No. 2013-00949, from another attorney representing Plaintiffs. See id. ¶ 26 & Ex. G. In addition to the seventeen data fields in the first
Table 2
Additional Fields Sought in Request No. 2013-00949 Source : Stearns Dec. ¶ 26 & Ex. G
The FOIA Unit determined that processing Request No. 2013-00949 would entail an "even greater burden" than the first request because it sought "comment" fields in addition to the free-form data fields included in the original request. See id. ¶ 28. Accordingly, the FTC denied the request after informing Plaintiffs' counsel that complying would be overly burdensome. See id. ¶¶ 29-31 & Exs. H, I.
On July 10, 2013, counsel for Plaintiffs appealed the denial of Request Nos.2013-00680 and 2013-00949. See Am. Compl., Ex. A. A month later, FTC Acting General Counsel David Shonka granted in part and denied in part the appeal. See Stearns Decl. ¶ 34 & Ex. J. Specifically, Mr. Shonka granted Plaintiffs' request for the data fields "that do not elicit free-form responses, excluding any zip code fields," but he denied the request as to the remaining free-form fields because they actually or potentially contain information exempt from disclosure under FOIA Exemption 6, and a review to segregate the exempt material would place an inordinate burden on the agency's resources. See id.
Mr. Shonka remanded the case to the FOIA Unit to identify and process the requests for the data fields for which the appeal was granted. See id. ¶ 35 & Ex. J. On remand, the FOIA Unit reviewed the requests and identified for processing the data fields that did not elicit free-form responses. See id. ¶¶ 36-38. The FOIA Unit, however, determined that the following free-form data and zip code fields should not be produced under Mr. Shonka's decision:
Table 3
Fraud and Other Consumer Do Not Call Database Identity Theft Database Database Source : Stearns Decl. ¶ 38
On September 9, 2013, the FTC provided Plaintiffs' counsel with the contractor's estimate for processing the remaining portions of Request Nos. 2013-00680 and 2013-00949, and the agency advised counsel that an advanced payment of the full amount was required within ten days or the requests would be closed. See id. ¶ 40 & Ex. L. In response, counsel asked that "[FTC] Staff not commence the search and production of the requested data until a resolution has been reached concerning some, or all, of the Contested Fields," and he stated that Plaintiffs intended to appeal the cost estimate. See id. ¶¶ 41-42 & Ex. M. On September 23, the agency closed both requests because it did not receive timely payment. See id. ¶ 43 & Ex. N.
On August 26, 2013, Plaintiffs' counsel filed a third FOIA request, Request No. 2013-01305, which sought the following eight fields for all complaints in the Consumer Sentinel database:
Table 4
Fields Sought in Request No. 2013-01305 Source : Stearns Decl. ¶ 44 & Ex. O
This request, like the first two requests, did not include the "Company Address, Zip Code Extension" field. See id. Again, the FTC determined that it would produce only the data fields that did not elicit free-form responses. See id. ¶ 45 & Ex. Q. The FTC also requested another estimate from the contractor for processing the remaining fields in Request No. 2013-01305, see id. ¶¶ 46-47 & Ex. R, and the contractor provided a quote of $8,581.95. See id. ¶ 48 & Ex. S; Rushen Decl. ¶ 12. On September 18, 2013, the FOIA Unit provided Plaintiffs' counsel with the estimate for processing the granted portions of the request, see Stearns Decl. ¶ 49 & Ex. T, and on September 30, the agency closed the request when Plaintiffs did not pay on time. See id. ¶ 50 & Ex. U.
On October 23, 2013, Plaintiffs appealed the FTC's resolution of the remanded portions of Request Nos.2013-00680 and 2013-0949, as well as the agency's response to Request No. 2013-01305. See id. ¶ 51. Mr. Shonka denied the appeal a
Table 5
Fraud and Other Consumer Do Not Call Database Identity Theft Database Database Source : Stearns Decl. ¶ 53
On December 2, 2013, Plaintiffs filed an amended complaint challenging the FTC's responses to the three FOIA requests described above. Specifically, Plaintiffs allege through Counts I, II, and III that the FTC wrongfully withheld information in the following fields, which Plaintiffs categorize as the "Company Information Fields" (Count I), the "Complainant Geographic Information Field" (Count II), and the "Comment Fields" (Count III):
Table 63
Complaint Category Requested Fields Company Name Denied Company Address, Line 3 Denied Company Information Company Address, Zip Code Denied Fields Company Address, Zip Code Extension FTC Decision 4 Denied (Count I) Company Email Denied Company Website Denied Complainant Geographic Information Field Consumer Address, Zip Code Denied (Count II) Comment Fields Other Information Comments Denied (Count III) Complaint Info Comments DeniedSource : Am. Compl. ¶ 42
[Editor's Note: The preceding image contains the reference for footnote
Finally, Plaintiffs allege in Count IV that the FTC violated FOIA by refusing to provide information necessary for determining the reasonableness of the contractor's fee estimates for processing the granted portions of the FOIA requests.
"FOIA cases typically and appropriately are decided on motions for summary judgment." Defenders of Wildlife v. U.S. Border Patrol, 623 F.Supp.2d 83, 87 (D.D.C.2009) (citing Bigwood v. U.S. Agency for Int'l Dev., 484 F.Supp.2d 68, 73 (D.D.C.2007)). Under Rule 56 of the Federal Rules of Civil Procedure, summary judgment must be granted when evidence shows "that there is no genuine dispute as to any material fact and the movant is entitled to judgment as a matter of law." Fed. R. Civ. P. 56; Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 247, 106 S.Ct. 2505, 91 L.Ed.2d 202 (1986). In the FOIA context, a district court reviewing a motion for summary judgment conducts a de novo review of the record, and the responding federal agency bears the burden of proving that it has complied with its obligations under FOIA. See 5 U.S.C. § 552(a)(4)(B); see also In Def. of Animals v. Nat'l Insts. of Health, 543 F.Supp.2d 83, 92-93 (D.D.C. 2008) (citing Assassination Archives & Research Ctr. v. CIA, 334 F.3d 55, 57 (D.C.Cir.2003)). The district court must analyze all underlying facts and inferences in the light most favorable to the FOIA requester. See Willis v. DOJ, 581 F.Supp.2d 57, 65 (D.D.C.2008) (citing Moore v. Aspin, 916 F.Supp. 32, 35 (D.D.C.1996)). Accordingly, summary judgment for an agency is appropriate only if the agency proves that it has "fully discharged its [FOIA] obligations[.]" Moore, 916 F.Supp. at 35 (citing Miller v. U.S. Dep't of State, 779 F.2d 1378, 1382 (8th Cir.1985)).
A court may award summary judgment in a FOIA case based solely upon the information provided in agency
Finally, although FOIA cases typically are decided through summary judgment, courts in this Circuit analyze failure to exhaust administrative remedies motions under Rule 12(b)(6). See Hidalgo v. FBI, 344 F.3d 1256, 1260 (D.C.Cir.2003) (vacating grant of summary judgment and remanding FOIA case "with instructions to the district court to dismiss the complaint under [Rule] 12(b)(6) ... for failure to exhaust administrative remedies"); accord Acosta v. FBI, 946 F.Supp.2d 47, 49 (D.D.C.2013); Tereshchuk v. U.S. Bureau of Prisons, 851 F.Supp.2d 157, 161-62 (D.D.C.2012); Banks v. Lappin, 539 F.Supp.2d 228, 234-35 (D.D.C.2008).
The statute known as FOIA is a revision of the public disclosure section of the Administrative Procedure Act. See Conservation Force v. Jewell, No. 12-CV-1665, 66 F.Supp.3d 46, 55, 2014 WL 4327949, at *4 (D.D.C. Sept. 2, 2014). Congress "broadly conceived" FOIA "to permit access to official information long shielded unnecessarily from public view and [] to create a judicially enforceable public right to secure such information from possibly unwilling official hands." EPA v. Mink, 410 U.S. 73, 80, 93 S.Ct. 827, 35 L.Ed.2d 119 (1973). To that end, "FOIA requires every federal agency, upon request, to make `promptly available to any person' any `records' so long as the request `reasonably describes such records.'" Assassination Archives, 334 F.3d at 57 (quoting 5 U.S.C. § 552(a)(3)). Consistent with this statutory mandate, federal courts have jurisdiction to order the production of records that an agency improperly withheld in violation of FOIA. See 5 U.S.C. § 552(a)(4)(B); DOJ v. Reporters Comm. for Freedom of the Press, 489 U.S. 749, 755, 109 S.Ct. 1468, 103 L.Ed.2d 774 (1989).
FOIA, however, also "recognizes limitations that compete with the general interest in disclosure, and that, in appropriate cases, can overcome it." Nat'l Archives & Records Admin. v. Favish, 541 U.S. 157, 172, 124 S.Ct. 1570, 158 L.Ed.2d 319 (2004). "Thus, while `disclosure, not secrecy, is the dominant objective of FOIA,' there are [nine] exemptions from the statute's broad reach[.]" U.S. Dep't of Def. v. FLRA, 510 U.S. 487, 494, 114 S.Ct. 1006, 127 L.Ed.2d 325 (1994) (quoting Dep't of Air Force v. Rose, 425 U.S. 352, 361, 96 S.Ct. 1592, 48 L.Ed.2d 11 (1976)); see also 5 U.S.C. § 552(b)(1)-(9) (listing nine FOIA exemptions). "These exemptions stem from Congress's recognition that the release of certain information may harm legitimate governmental or private interests." Summers v. DOJ, 140 F.3d 1077, 1080 (D.C.Cir.1998).
Finally, courts must bear in mind that FOIA mandates a "strong presumption in favor of disclosure," U.S. Dep't of State v. Ray, 502 U.S. 164, 173, 112 S.Ct. 541, 116 L.Ed.2d 526 (1991), and consistent with that presumption, the nine statutorily exempt categories of documents
Now before the Court are the FTC's motion for summary judgment and Plaintiffs' cross-motion for partial summary judgment. The FTC argues that it correctly denied Plaintiffs' requests as to the free-form data fields in Counts I, II, and III under FOIA Exemptions 6 and 7(C) because those fields actually or potentially contain personal identifying information protected by the exemptions, and the manual review needed to redact this information would be unduly burdensome given the volume of records in the Consumer Sentinel database.
For the reasons discussed below, the Court grants in part and denies in part the FTC's motion, and denies in full Plaintiffs' motion. Specifically, the Court denies the FTC's motion to dismiss the claim in Count I regarding the "Company Address, Zip Code Extension" field, on the basis of failure to exhaust administrative remedies. Next, the Court grants summary judgment for the FTC as to Counts I and III because those counts seek free-form data fields that potentially contain personal identifying information that must be withheld under FOIA Exemptions 6 and 7(C), and the manual review required to segregate such exempt information would be unduly burdensome. The Court, however, denies the FTC's request for summary judgment on Count II because the agency fails to offer evidence establishing a privacy interest in the five-digit zip code data.
In addition, the Court grants summary judgment for the FTC as to the Canadian AntiFraud Centre and Ecommerce.gov complaints because those complaints must
The FTC moves to dismiss the claim in Count I with respect to the "Company Address, Zip Code Extension" data field on the basis that none of Plaintiffs' three FOIA requests included this field. See Def.'s Mem. Supp. Mot. Summ. J. at 26. "Exhaustion of administrative remedies is generally required before seeking judicial review `so that the agency has an opportunity to exercise its discretion and expertise on the matter and to make a factual record to support its decision.'" Wilbur v. CIA, 355 F.3d 675, 677 (D.C.Cir. 2004) (quoting Oglesby v. U.S. Dep't of the Army, 920 F.2d 57, 61 (D.C.Cir.1990)). As the D.C. Circuit has explained, although exhaustion of a FOIA request "is not jurisdictional because the FOIA does not unequivocally make it so," Hidalgo v. FBI, 344 F.3d 1256, 1258 (D.C.Cir.2003) (citing I.A.M. Nat'l Pension Fund Ben. Plan C. v. Stockton TRI Indus., 727 F.2d 1204, 1208 (D.C.Cir.1984)), failure to exhaust still "precludes judicial review if `the purposes of exhaustion' and the `particular administrative scheme' support such a bar," id. at 1258-59 (quoting Oglesby, 920 F.2d at 61).
It is undisputed that Plaintiffs did not include the "Company Address, Zip Code Extension" data field in the three FOIA requests at issue. See Pls.' Resp. Def.'s Stmt. of Facts ¶¶ 6, 16, 22, 34. Instead, Plaintiffs' first administrative appeal, which was filed after the FTC refused to grant Plaintiffs' first two FOIA requests, specifically listed the "Company Address, Zip Code Extension" field as one of the fields they were appealing, despite its not being included in the original requests. See Am. Compl., Ex. A; Pls.' Mem. Opp'n Def.'s Mot. Summ. J., ECF No. 19, at 32. Curiously, in response to this appeal, the FTC pointed out that it would not consider several of the new fields raised by Plaintiffs because those fields were not included within the scope of the FOIA requests, but the FTC's list did not include the "Company Address, Zip Code Extension" field that Plaintiffs also had mentioned for the first time on appeal. See Am. Compl., Ex. B at 2 n.2. The FTC, moreover, concluded at the end of the response letter that it was "excluding any zip code fields" from processing under Exemption 6. See id. at 5 (emphasis added).
Based on the FTC's response letter, it appears that when evaluating whether Exemption 6 prevented disclosure, the agency may have considered the "Company Address, Zip Code Extension" field along with the other consumer and company zip code fields requested by Plaintiffs. Yet even if the agency did not consider this new field, it certainly was given an opportunity to do so when Plaintiffs raised the issue in their administrative appeal. Thus, though Plaintiffs technically failed to make a proper FOIA request and exhaust administrative remedies, their error "presents no risk of undermining the purposes and policies underlying the exhaustion requirement, namely, to prevent premature interference with agency processes, to give the parties and the courts benefit of the agency's experience and expertise and to compile an adequate record for review." Wilbur, 355 F.3d at 677. This is because by raising the question in the appeal along
In addition, the Court notes the futility and inefficiency of requiring Plaintiffs to restart the FOIA process from the beginning as to this one field. First, the Court agrees with Plaintiffs' prediction that the FTC very likely will deny this request once it is formally made. Indeed, given the agency's denial of the five-digit zip code information, which is less specific in identifying a location than the four-digit zip code extension information, it would be illogical for the agency to conclude otherwise. Second, after the FTC's inevitable denial, it would be inefficient for the Court to preside over a separate lawsuit regarding this single field when the parties already are litigating the instant case that involves the same set of facts. Instead, the more efficient path is for the Court to resolve all the Consumer Sentinel database disputes between Plaintiffs and the FTC at once. Cf. Barouch v. DOJ, 962 F.Supp.2d 30, 51 (D.D.C.2013) (finding that plaintiff "constructively exhausted" administrative remedies in part because "[i]t would be anomalous to review plaintiff's challenges to [the agency's] withholdings of documents that were identified ... in the spring of 2012 and that were processed by [the agency], but to decline review on exhaustion grounds the determinations of other agencies to which [agency] sent some of the documents it identified at the same time"). Accordingly, because exhaustion is a prudential consideration rather than a jurisdictional prerequisite, the Court concludes that, under these circumstances, it will not dismiss the claim regarding the "Company Address, Zip Code Extension" field for failure to exhaust.
In Counts I, II, and III, Plaintiffs contend that the FTC violated FOIA by denying their requests for specific free-form data fields, which Plaintiffs categorize as the "Company Information Fields" (Count I), the "Complainant Geographic Information Field" (Count II), and the "Comment Fields" (Count III). See Am. Compl. ¶¶ 42, 46-88; see also Tbl. 6, supra. In response, the FTC argues that it correctly withheld the information in each of these fields under FOIA Exemption 6, and as such, the agency seeks summary judgment in its favor on these counts. For the reasons explained below, the Court agrees with the FTC that the data fields sought in
FOIA Exemption 6 protects from disclosure "personnel and medical files and similar files the disclosure of which would constitute a clearly unwarranted invasion of personal privacy." 5 U.S.C. § 552(b)(6). The Supreme Court has interpreted the term "similar files" broadly so as "to cover detailed Government records on an individual which can be identified as applying to that individual." U.S. Dep't of State v. Wash. Post Co., 456 U.S. 595, 602, 102 S.Ct. 1957, 72 L.Ed.2d 358 (1982) (citation and quotation marks omitted). "The information in the file `need not be intimate' for the file to satisfy the standard, and the threshold for determining whether information applies to a particular individual is minimal." Milton v. DOJ, 783 F.Supp.2d 55, 58 (D.D.C.2011) (quoting N.Y. Times Co. v. NASA, 920 F.2d 1002, 1006 (D.C.Cir.1990)).
Once this threshold determination is met, a court next inquires whether disclosure would compromise a "substantial" privacy interest because FOIA requires the release of information "[i]f no significant privacy interest is implicated." See Multi Ag Media LLC v. U.S. Dep't of Agric., 515 F.3d 1224, 1229 (D.C.Cir.2008) (citing Nat'l Ass'n of Retired Fed. Emps. v. Horner, 879 F.2d 873, 874 (D.C.Cir. 1989)). This standard, however, "means less than it might seem," as a substantial privacy interest is "anything greater than a de minimis privacy interest." Id. at 1229-30. If a substantial privacy interest exists, a court next tests whether release of such information would constitute a "clearly unwarranted invasion of personal privacy," Wash. Post Co. v. U.S. Dep't of Health & Human Servs., 690 F.2d 252, 260 (D.C.Cir.1982), by balancing "the privacy interest that would be compromised by disclosure against any public interest in the requested information." Multi Ag Media, 515 F.3d at 1228.
The FTC argues that the Company Information Fields actually or potentially contain personal identifying information, the disclosure of which would constitute an unwarranted invasion of privacy under Exemption 6. See Def.'s Mem. Supp. Mot. Summ. J. at 27. Specifically, the FTC contends that personal information can be entered in the Count I free-form data fields through two scenarios: first, a consumer may mistakenly insert information about himself in fields that are intended for details about the alleged wrongdoer; or second, a consumer may intentionally provide information about an alleged individual wrongdoer, as opposed to a corporation or other business wrongdoer, when describing an incident. See Stearns Decl. ¶ 12.
In response, Plaintiffs argue that the FTC fails to demonstrate that personal information is inserted in these fields with any statistical frequency such that it is more than mere speculation. See Pls.' Mem. Opp'n Def.'s Mot. Summ. J. at 18. Plaintiffs also suggest that there is no privacy interest in "personal information about an alleged wrongdoer" because the FTC released the names of individuals appearing in the "Company Name" field in response to prior FOIA requests. See id. at 19. The FTC contends that this argument confuses the privacy interests of individuals accused of wrongdoing in their personal capacity with individuals accused of wrongdoing while acting in a business capacity,
The FTC's original declaration in support of its motion for summary judgment provided just one example of a consumer mistakenly inserting her "own name, address, area code, phone number, and email address in the fields reserved for the subject of the complaint" — that is, the fields in which information about the wrongdoer should go. See Stearns Decl. ¶ 28. At the same time, the FTC also offered evidence of three other complaints in which a consumer inserted personal information about an individual wrongdoer in the Company Information Fields. See id. Through a second declaration, however, the FTC provides additional evidence regarding a supplementary review of more complaints in the Consumer Sentinel database, and this review revealed a very real possibility of personal identifying information appearing in the Company Information Fields.
To cull the millions of complaints in the Consumer Sentinel database down to a reviewable sample, the FTC first searched the fraud database for complaints containing a "Gmail" address in the "Company Email Field." See Stearns II Decl. ¶ 16. The agency selected "Gmail" addresses because individuals, rather than business entities, typically use these email addresses, so finding such an address in the Company Email Field logically suggests that an individual is being accused of wrongful conduct in his or her personal capacity. See id. The FTC's search returned more than 350,000 complaints with a "Gmail" address, and the agency reviewed a sample of 600 of those complaints, which revealed that 82%, or 497 of 600 complaints, contained personal identifying information, such as names and addresses, in one or more of the free-form data entry fields sought through Count I. See id. ¶¶ 16-18. Furthermore, 89 of the 600 complaints that the FTC reviewed in this sample originated from the FTC's call center, and of those 89 complaints, 78 contained personal identifying information in one or more of the Company Information Fields. See id. ¶ 19.
The agency also ran a similar search in the Consumer Sentinel database's identity theft database for complaints in which a "Gmail" address appears in the "Associated Institution Email" field, which returned 970 complaints. See id. ¶ 21. The agency's review of a date-limited subset of 151 complaints revealed that 78% of the complaints contained personal identifying information about private individuals in one or more of the data fields in Count I. See id. ¶¶ 21-22. Extrapolating the results from the identity theft database and fraud database searches to the original set of 350,000 "Gmail" complaints indicates that hundreds of thousands of records may exist in which personal identifying information was intentionally placed in Company Information Fields because the alleged wrongdoer was described as acting in his or her personal capacity.
To justify withholding documents under Exemption 6, the FTC must show that the threat to privacy is "real rather than speculative." Elec. Privacy Info. Ctr. v. Dep't of Homeland Sec., 384 F.Supp.2d 100, 116 (D.D.C.2005) (citing U.S. Dep't of Air Force v. Rose, 425 U.S. 352, 380 n. 19, 96 S.Ct. 1592, 48 L.Ed.2d 11 (1976)). An agency can meet its burden by providing affidavits or declarations that "describe the justifications for nondisclosure with reasonably specific detail, demonstrate that the information withheld logically falls within the claimed exemption, and are not controverted by either contrary evidence in the record nor by evidence of agency bad faith." Larson v. U.S. Dep't of State, 565 F.3d 857, 862 (D.C.Cir.2009) (quoting Miller v. Casey, 730 F.2d 773, 776 (D.C.Cir.1984)). Here, the Court is satisfied that — based on the evidence provided by the FTC, the lack of allegations of bad faith, and the lack of contradictory evidence provided by Plaintiffs — the agency has demonstrated a real, and not merely speculative, possibility of personal identifying information in the form of names, addresses, telephone numbers, and email addresses existing in the Company Information Fields. The next step, then, involves identifying whether there exists a privacy interest in withholding this information, and whether, when balanced against the public benefits of disclosure, release of the personal identifying information would create a "clearly unwarranted invasion of personal privacy." See Reed v. NLRB, 927 F.2d 1249, 1251 (D.C.Cir.1991).
In construing Exemption 6, the D.C. Circuit has explained that "the disclosure of names and addresses is not inherently and always a significant threat to the privacy of those listed; whether it is a significant or a de minimis threat depends upon the characteristic(s) revealed by virtue of being on the particular list, and the consequences likely to ensue." Nat'l Ass'n of Retired Fed. Emps. v. Horner, 879 F.2d 873, 877 (D.C.Cir.1989); see also U.S. Dep't of State v. Ray, 502 U.S. 164, 176 n. 12, 112 S.Ct. 541, 116 L.Ed.2d 526 (1991) (noting that disclosure of a list of names and other personal identifying information is not "inherently and always a significant threat to the privacy of the individuals on the list"). But at the same time, the D.C Circuit has recognized that "the privacy interest of an individual in avoiding the unlimited disclosure of his or her name and address is significant." Horner, 879 F.2d at 875. In its motion for summary judgment, the FTC argues that individuals possess a substantial privacy interest in their personal identifying information not being released because these individuals most likely fall into one of two
First, the Court agrees that consumers who are victims, and consequently also are whistleblowers and witnesses, face potential backlash if identified in the form of embarrassment, becoming a "mark" for similar schemes in the future, and retribution from the alleged wrongdoer — all of which constitute unwanted privacy intrusions that extend beyond merely having a name and address published. See U.S. Dep't of State v. Wash. Post Co., 456 U.S. 595, 599, 102 S.Ct. 1957, 72 L.Ed.2d 358 (1982) (FOIA's legislative history shows that "Congress' [s] primary purpose in enacting Exemption 6 was to protect individuals from the injury and embarrassment that can result from the unnecessary disclosure of personal information"); Horner, 879 F.2d at 878 ("Disclosure does not, literally by itself, constitute a harm; it is the requester's (or another's) reaction to the disclosure that can sting. This is only more obvious where disclosure of the information invades someone's privacy not because it is embarrassing but because it invites unwanted intrusions."); see also Lahr v. NTSB, 569 F.3d 964, 976 (9th Cir.2009) (explaining that "protection from... unwanted contact [by third parties] facilitated by disclosure of a connection to government operations and investigations is a cognizable privacy interest under Exemptions 6").
Second, those individuals accused of wrongdoing also have a substantial privacy interest in their names and addresses not being disclosed. The Consumer Sentinel database contains allegations of illegal conduct, and there is no filter for weeding out the legitimate complaints from those completely lacking in a factual or legal basis. Yet, by having one's personal information included in a complaint, that person is both accused of an illegal activity and associated with a federal agency's crime enforcement effort. Cf. Fund for Constitutional Gov't v. Nat'l Archives & Records Serv., 485 F.Supp. 1, 6 (D.D.C.1978) ("An individual does not lose his right to privacy simply because he has been investigated and subsequently not charged with any offense. Indeed, such an individual may require even greater protection, especially where... the mere connection of an individual's name with a well-known investigation may be both embarrassing and damaging."). If an individual is identified through his or her personal information, the release of such information may result in economic and physical danger to the accused, as well as potential embarrassment and harassment. See Island Film, S.A. v. Dep't of Treasury, 869 F.Supp.2d 123, 136 (D.D.C. 2012) (noting that "whether individuals have a privacy interest in their names and addresses under Exemption 6 depends on the context and anticipated consequences of disclosure") (citing Morley v. CIA, 508 F.3d 1108, 1128 (D.C.Cir.2007)).
Though unintentionally, Plaintiffs demonstrate the potential for abusing personal identifying information because one of their four "public" benefits for releasing information in the Count I data fields is to convert the Consumer Sentinel database into a consumer review tool akin to "Yelp.com."
Similarly, Plaintiffs also propose that "[d]isclosure of the Company Information Fields would permit members of the public (e.g., corporations) to quickly and efficiently review complaints that have been submitted about themselves to help identify potential advertising, marketing, or privacy practices which may be perceived by others as failing to comply with legal requirements." Pls.' Mem. Opp'n Def.'s Mot. Summ. J. at 25-26 (citing Am. Compl. ¶ 57). Again, the Court must reject this proposed benefit because, like with the first goal of creating a private consumer review tool, "the only relevant public interest in the FOIA balancing analysis [under Exemption 6 is] the extent to which disclosure of the information sought would `she[d] light on an agency's performance of its statutory duties' or otherwise let citizens know `what their government is up to.'"
The Court also rejects Plaintiffs' argument that consumers who submit complaints through the FTC's website have a reduced expectation of privacy in general. See Pls.' Mem. Opp'n Def.'s Mot. Summ. J. at 23-24. The FTC's online privacy policy states that any information submitted in connection with a consumer complaint may be provided to "businesses or individuals in response to ... [FOIA] Requests." As the FTC explains, however, consumers are not required to click on, read, or agree to the privacy policy in order to file a complaint. See Tribble Decl. ¶ 15. In addition, individuals accused of misconduct in a complaint never see the privacy policy in the first place. Yet, even if all parties involved actually read and consented to the policy, the policy itself represents only a warning, not a waiver of FOIA privacy rights. As this Court has explained in the context of a similarly phrased privacy clause, parties do "not waive their privacy rights merely by acknowledging that the information they were providing could be subject to release" under FOIA.
Next, Plaintiffs offer two additional reasons for releasing the data fields sought in the complaint, but neither alleged public benefit appears to require the release of personal identifying information about the victim or the alleged individual wrongdoer. First, Plaintiffs propose that
Pls.' Mem. Opp'n Def.'s Mot. Summ. J. at 25 (citing Am. Compl. ¶ 53). The Supreme Court, however, has expressed that a "public interest is not furthered `by disclosure of information about private citizens that is accumulated in various governmental files but that reveals little or nothing about an agency's own conduct.'" People for the Am. Way v. Nat'l Park Serv., 503 F.Supp.2d 284, 304 (D.D.C.2007) (quoting Reporters Comm., 489 U.S. at 773, 109 S.Ct. 1468). As such, the law mandates that a nexus exists between the records being sought and the legitimate FOIA public interest allegedly being furthered.
Here, Plaintiffs provide no explanation for why personal identifying information about the individuals who file complaints or who are the subjects of complaints while acting in their personal capacity is required to achieve this goal, rather than simply relying on the non-sensitive information from the other data fields that the FTC has agreed to release. See Voinche v. FBI, 940 F.Supp. 323, 330 (D.D.C.1996) (finding that Exemption 6 protects from disclosure names of "private citizens who wrote to government officials" because there was "no reason to believe that the public will obtain a better understanding of the workings of various agencies by learning the[ir] identities"). In fact, Plaintiffs' stated benefit focuses exclusively on "the specific entities against which the FTC brought enforcement action and those entities against which the FTC did not bring enforcement action." Pls.' Mem. Opp'n Def.'s Mot. Summ. J. at 25 (citing Am. Compl. ¶ 53) (emphasis added). Given that the Court is grappling with the privacy interests of individuals accused in their personal capacity, the nexus between the personal identifying information and the offered public benefit is highly dubious.
A similar analysis compels the Court to arrive at the same conclusion when evaluating Plaintiffs' final proposed benefit, which is that
Pls.' Mem. Opp'n Def.'s Mot. Summ. J. at 25 (citing Am. Compl. ¶ 54). Though it is generally true that "matters of substantive law enforcement policy ... are properly the subject of public concern," Reporters Comm., 489 U.S. at 766 n. 18, 109 S.Ct. 1468, a nexus still must exist between the information sought and the public interest to be served. See Barnard, 598 F.Supp.2d at 13; Seized Prop. Recovery, 502 F.Supp.2d at 59. It is not apparent how Plaintiffs' purpose is furthered through the release of personal identifying information about the victims or subjects of complaints given the broad set of information the FTC already has agreed to produce. And once again, Plaintiffs describe the public benefit as needing information about "complaints filed by consumers relating to businesses that operate in specific industries," not information about individuals alleged to be acting in their personal capacity. Pls.' Mem. Opp'n Def.'s Mot. Summ. J. at 25 (citing Am. Compl. ¶ 54) (emphasis added). As such, the Court "need not linger over the balance; something, even a modest privacy interest, outweighs nothing every time." Horner, 879 F.2d at 879.
In Count II, Plaintiffs allege that the FTC violated FOIA by withholding information in the Complainant Geographic Information Field, which encompasses a consumer's five-digit zip code entered in the "Consumer Address, Zip Code" data field. The FTC, on the other hand, argues that the five-digit zip codes constitute personal identifying information that invokes the same substantial privacy interests under Exemption 6 as the information in the Company Information Fields. See Def.'s Mem. Supp. Mot. Summ. J. at 33.
An agency cannot withhold information under Exemption 6 based on the "mere possibilit[y]" that the release of such information will invade an individual's privacy interest. See U.S. Dep't of Air Force v. Rose, 425 U.S. 352, 378, 381 n. 19, 96 S.Ct. 1592, 48 L.Ed.2d 11 (1976) ("The legislative history is clear that Exemption 6 was directed at threats to privacy interest more palpable than mere possibilities."). As the FTC notes, Plaintiffs are receiving many pieces of information about a particular complaint, and that information, when combined with a consumer's zip code and the accused's own records, might theoretically enable the accused to identify the consumer. See Def.'s Reply Supp. Mot. Summ. J. at 16. The agency, however, provides no evidence to support this argument. See, e.g., Def.'s Mem. Supp. Mot. Summ. J. at 33-34 (citing no record evidence to support summary judgment as to Count II); Def.'s Reply Supp. Mot. Summ. J. at 16 (same). As the party seeking summary judgment, the FTC bears the initial burden of identifying evidence that demonstrates the absence of any genuine issue of material fact. See Celotex Corp. v. Catrett, 477 U.S. 317, 323, 106 S.Ct. 2548, 91 L.Ed.2d 265 (1986). Because the agency provides no evidence suggesting that disclosure of the five-digit zip code actually or potentially affects the likelihood that the complainant will be identified, the Court cannot conclude that such information implicates a substantial privacy interest. The Court therefore denies the FTC's motion for summary judgment as to Count II.
In response to the FTC's motion for summary judgment on Count III, Plaintiffs argue that the Comment Fields do not contain personal identifying information that implicates Exemption 6. The FTC
The agency also reviewed a sample set of 600 complaints in the fraud database that contain "Gmail" addresses, and this examination resulted in 308 redactions of personal identifying information in the "Complaint Comments" field. See Stearns II Decl. ¶ 18. Further, a similar review of 151 complaints in the identity theft database required 57 redactions in that same field. See id. ¶ 22. Though some of this information, such as social security and credit card numbers, can be automatically redacted by the FTC, see Tribble Decl. ¶ 13, no automated process exists for capturing all similar information because consumers may transcribe the sensitive numbers in varying and unpredictable patterns, and other free-form personal identifying information, such as names and addresses, simply never lends itself to a predictable format that might allow automated redacting. See id. ¶ 14; Stearns II Decl. ¶ 32 (explaining that credit card and social security numbers are automatically redacted in the comment fields only if they appear in a certain format, and other categories of personal identifying information in the comment fields always require manual review due to unpredictable formatting); see also 5 U.S.C. § 552(a)(4)(B) ("[A] court shall accord substantial weight to an affidavit of an agency concerning the agency's determination as to technical feasibility under... subsection (b).").
Having found that the Comment Fields may contain personal identifying information, the Court further concludes that this information is effectively similar to that found in the Company Information Fields such that it implicates the same substantial privacy interest because it likewise can be used to identify the victim or the accused. Thus, applying the same balancing of interests performed in the context of the Company Information Fields, the Court again finds that this information must be withheld under Exemption 6.
The FTC also seeks to withhold the data fields identified in Counts I, II, and III under FOIA Exemption 7(C), which protects from disclosure information in law enforcement records that "could reasonably be expected to constitute an unwarranted invasion of personal privacy."
"To show that ... documents were compiled for law enforcement purposes, the [agency] need only establish a rational nexus between [an] investigation and one of the agency's law enforcement duties and a connection between an individual or incident and a possible security risk or violation of federal law." Blackwell v. FBI, 646 F.3d 37, 40 (D.C.Cir.2011) (internal citations and quotation marks omitted); see also Petrucelli v. DOJ, No. CV 11-1780, 51 F.Supp.3d 142, 163, 2014 WL 2919285, at *12 (D.D.C. June 27, 2014) (same). Here, the FTC attests that records in the Consumer Sentinel database are collected and maintained in furtherance of its responsibility to "prevent persons, partnerships, or corporations ... from using unfair methods of competition in or affecting commerce and unfair or deceptive acts or practices in or affecting commerce." Stearns Decl. ¶ 15 (citing 15 U.S.C. § 45(b)); Stearns II Decl. ¶ 4 ("The FTC solicits consumer complaints of fraud, identity theft, unfair business practices, and Do-Not-Call List violations to aid in its law enforcement mission.").
In particular, the FTC explains that the database is used to assist the agency in identifying subjects for investigations, as well as for tracking the overall number of complaints and the percentage of law enforcement actions the agency takes targeting the subjects of those complaints. See Stearns II Decl. ¶ 7. Indeed, it is uncontested that "[c]onsumer complaints stored in the Consumer Sentinel database have spawned numerous FTC investigations and enforcement proceedings." Id. And as further evidence, the FTC shares information compiled in the database with domestic and international law enforcement partners to enhance and coordinate interagency investigations. See id. ¶ 4. For these reasons, the Court finds that a sufficient nexus exists between the Consumer Sentinel database and the FTC's law enforcement activities such that the records qualify for purposes of Exemption 7(C).
The D.C. Circuit has explained that "[b]ecause Exemption 7(C) provides protection for a somewhat broader range of privacy interests than Exemption 6, privacy interests cognizable under Exemption 6 are cognizable under Exemption 7(C)." See Stern v. FBI, 737 F.2d 84, 91 (D.C.Cir. 1984). Thus, having found that privacy interests exist in Counts I and III under Exemption 6, the Court quickly can conclude that the same interests arise under Exemption 7(C). Indeed, Exemption 7(C) "takes particular note of the strong interest of individuals, whether they be suspects, witnesses, or investigators, in not being associated unwarrantedly with alleged criminal activity." Dunkelberger v. DOJ, 906 F.2d 779, 781 (D.C.Cir.1990) (internal quotation marks omitted); see also Fischer v. DOJ, 596 F.Supp.2d 34, 47 (D.D.C.2009) ("The D.C. Circuit has consistently held that Exemption 7(C) protects the privacy interests of all persons
The fields from which Plaintiffs seek information in Counts I and III may contain personal identifying information about consumers who are victims of an alleged crime, which also makes those consumers witnesses and informants. These individuals therefore possess the exact type of substantial privacy interest that Exemption 7(C) aims to protect. See Piper v. DOJ, 374 F.Supp.2d 73, 78-79 (D.D.C. 2005) ("[I]ndividuals who provide information to the law enforcement authorities ... have a privacy interest and their identities have traditionally been protected from disclosure by Exemption 7(C)."); Brown v. EPA, 384 F.Supp.2d 271, 277 (D.D.C.2005) (stating that "Exemption 7(C) affords broad privacy rights to witnesses and informants in criminal investigations" (internal citation and quotation marks omitted)).
Those individuals who are identified as alleged wrongdoers likewise possess a substantial privacy interest in their personal identifying information. As the D.C. Circuit has explained, "individuals have a strong interest in not being associated unwarrantedly with alleged criminal activity," and given that the Consumer Sentinel database contains unsubstantiated and unscreened allegations, there is no way of knowing whether the wrongdoer is correctly or incorrectly being attached to such unseemly conduct. See Stern, 737 F.2d at 91-92; see also Bast v. DOJ, 665 F.2d 1251, 1254 (D.C.Cir.1981) (explaining that Exemption 7(C) "recognize[s] the stigma potentially associated with law enforcement investigations and affords broader privacy rights to suspects, witnesses, and investigators"); Salas v. Office of Inspector Gen., 577 F.Supp.2d 105, 111 (D.D.C. 2008) ("Exemption 7(C) recognizes that the stigma of being associated with any law enforcement investigation affords broad privacy rights to those who are connected in any way with such an investigation unless a significant public interest exists for disclosure."). The Court therefore finds that not only are the same privacy interests implicated by the data fields in Counts I and III as under Exemption 6, those interests actually are even stronger in the context of Exemption 7(C).
Finally, because it is the interest of the general public, and not that of the private litigant, that the Court must consider, "the only public interest relevant for purposes of Exemption 7(C) is one that focuses on `the citizens' right to be informed about what their government is up to.'" Davis v. DOJ, 968 F.2d 1276, 1282 (D.C.Cir.1992) (quoting DOJ v. Reporters Comm. for Freedom of the Press, 489 U.S. 749, 773, 109 S.Ct. 1468, 103 L.Ed.2d 774 (1989)). And given that Exemption 7(C)'s equilibrium is not "tilted emphatically in favor of disclosure" like under Exemption 6, see Bast, 665 F.2d at 1254, the Court concludes that, for similar considerations as were discussed above in the context of Exemption 6, the privacy interests at stake easily outweigh the limited public benefits of disclosure offered by Plaintiffs. The Court therefore finds that Exemption 7(C) also requires withholding the personal identifying information in the data fields sought through Counts I and III.
At this point, the Court has concluded that the data fields sought through Counts I and III potentially contain personal identifying information that is exempt from disclosure under FOIA Exemptions 6 and 7(C). Next, FOIA requires
As the D.C. Circuit has explained, when an agency claims that complying with a request is unreasonable, it bears the burden to "provide [a] sufficient explanation as to why such a search would be unreasonably burdensome." Nation Magazine v. U.S. Customs Serv., 71 F.3d 885, 892 (D.C.Cir.1995); Pub. Citizen, Inc. v. U.S. Dep't of Educ., 292 F.Supp.2d 1, 6 (D.D.C.2003). To make this determination, a court may rely on agency affidavits or declarations that show with reasonable specificity why documents withheld pursuant to a valid exemption cannot be further segregated. See Armstrong v. Exec. Office of the President, 97 F.3d 575, 578 (D.C.Cir.1996); see also Thompson v. Exec. Office for U.S. Attorneys, 587 F.Supp.2d 202, 207-08 (D.D.C.2008) (explaining that when considering "whether nonexempt information could have been segregated from exempt information and released," courts may rely on an agency affidavit if it "provides a sufficient description of the documents and a sufficient explanation of the basis for withholding"). Ultimately, the agency is entitled to the presumption that it complied with the requirement to segregate non-exempt materials. See Hodge v. FBI, 703 F.3d 575, 582 (D.C.Cir.2013) (citing Sussman v. U.S. Marshals Serv., 494 F.3d 1106, 1117 (D.C.Cir.2007)).
Though some personal identifying information can be automatically redacted, such as certain social security and credit card numbers assuming they are in the proper formats, it is uncontested that the remaining information requires a manual review to redact the material protected by Exemptions 6 and 7(C). See id. ¶ 34 & Ex. J; Tribble Decl. ¶¶ 13-14; Stearns II Decl. ¶ 32. The FTC estimates that completing the manual redaction process for the withheld data fields across all twenty million Consumer Sentinel database complaints would take more than 8,000 hours.
Accordingly, based on the FTC's "explanation as to why such a search would be unreasonably burdensome," Nation Magazine, 71 F.3d at 892, and absent any contrary argument on Plaintiffs' part, the Court must conclude that performing a manual review of the Consumer Sentinel database complaints for exempt personal identifying information would impose an unreasonable burden on the FTC well beyond what FOIA requires from an agency. Such a conclusion, however, only begs the question of whether the Court should find that manual review is required in the first place.
Resolving this question requires a different burden and segregation analysis than is ordinarily performed in a FOIA case. Typically, courts discuss the agency's burden and the feasibility of segregating exemption information in the context of the agency's ability to identify the universe of records relevant to a request, see, e.g., Defenders of Wildlife v. U.S. Border Patrol, 623 F.Supp.2d 83, 91 (D.D.C.2009) (analyzing the adequacy of the agency's search for relevant records), the physical difficulty of segregating exempt information within the relevant records, see, e.g., Int'l Counsel Bureau v. U.S. Dep't of Def., 864 F.Supp.2d 101, 106-107 (D.D.C.2012) (ordering in camera review of videos to determine potential segregability), or the challenge of determining whether the exempt information is so intertwined with non-exempt information that removing the exempt information leaves nothing of value left in the record, see, e.g., Mays v. DEA, 234 F.3d 1324, 1327 (D.C.Cir.2000) (approving of withholding entire grand jury transcript because "the excision of exempt information would ... produce an edited document with little informational value").
Here, the FTC does not argue that it cannot search for and retrieve the Consumer Sentinel database records, that it cannot physically segregate exempt information, or that making redactions would result in records with no remaining informational value. Instead, the agency's argument for non-disclosure focuses only on the burden of manually identifying and redacting the exempt information across the already retrieved twenty million responsive records within the Consumer Sentinel database. See Stearns Decl. ¶¶ 20-22. Thus, based on the unique facts of this case, the question before the Court becomes whether the FTC can withhold the entire universe of information contained in the data fields when only a small percentage of that information is exempt but redacting the exempt information requires an unreasonably burdensome manual review.
If Plaintiffs sought a smaller, more manageable universe of records and not the twenty million complaints in the Consumer Sentinel database, the solution might be simple: the Court could order the FTC to expend a reasonable amount of resources to identify and redact the exempt personal information from each complaint. The facts and equities of this case, however, compel the Court to conclude that the FTC properly withheld the entire universe of information given the burden of removing the subset of exempt information. Specifically, the FTC is attempting to protect
Plaintiffs move for partial summary judgment with respect to the Consumer Sentinel database complaints that were received by the FTC through its telephone complaint line and then memorialized by the telephone operator. See generally Pls.' Mem. Supp. Part. Mot. Summ. J. In doing so, Plaintiffs argue that because the phone operators are trained to enter information in the correct data fields and to avoid inserting "sensitive" consumer information, there is no plausible reason to believe that a privacy interest is implicated by the over-the-phone complaints such that manual review is required. See id. at 3. In response, the FTC argues that even if the operators never make mistakes, consumers still give personal identifying information about other private individuals, such as witnesses and the accused, when they complain to the FTC, and the operators correctly enter this information into the Company Information Fields and Comments Fields. See Def.'s Reply Supp. Mot. Summ. J. at 3. As such, the agency maintains that like with complaints filed through the FTC's website, manual review is required to redact the exempt information.
The FTC provides evidence that within the sample of 600 complaints with a "Gmail" address in the "Company Email" field, 89 complaints originated through a telephone call to the agency, and 78 of those complaints (88%) contained personal identifying information in the fields Plaintiffs seek through Counts I and III, such as the "Company" fields, fields labeled for "Associated Institution" or "Suspect Alias," and the "Comment" fields. See Stearns II Decl. ¶ 19; Tribble Decl. ¶ 9. Such information does not occur because the operators make mistakes, but rather because consumers intentionally report misconduct involving individuals in their personal capacity, just as consumers do when submitting complaints on the FTC's website. See Tribble Decl. ¶ 9. Indeed, the Consumer Sentinel database does not separate complaints about individuals from complaints about companies, so telephone operators must enter all complaints into the fields labeled for alleged corporate wrongdoers. See id.
In addition, Plaintiffs' focus on the lack of "sensitive" information, such as social
The FTC invokes FOIA Exemption 3, in conjunction with Section 21(f) of the FTC Act, see 15 U.S.C. § 57b-2(f)(2)(A)(i) & (ii), to categorically withhold entire complaints provided by the Canadian Anti-Fraud Centre or furnished through the Ecommerce.gov website. See Def.'s Mem. Supp. Mot. Summ. J. at 37. FOIA Exemption 3 permits agencies to withhold documents pursuant to nondisclosure provisions contained in other federal statutes. See 5 U.S.C. § 552(b)(3). The federal statute must require that the information be withheld from the public in such a way as to leave no discretion on the issue, or it must establish particular criteria for withholding or refer to specific types of matters to be withheld. See id. "In deciding Exemption 3 applicability, `the sole issue for decision is the existence of a relevant statute and the inclusion of withheld material within that statute's coverage.'" Carter, Fullerton & Hayes, LLC v. FTC, 637 F.Supp.2d 1, 10 (D.D.C.2009) (quoting Goland v. CIA, 607 F.2d 339, 350 (D.C.Cir.1978)). In addition, the FTC attests, and Plaintiffs do not dispute, that the Canadian Anti-Fraud Centre and Ecommerce.gov complaints can be segregated from other Consumer Sentinel database complaints without an unreasonable burden by using custom search filters. See Stearns Decl. ¶ 20.
Section 21(f), Subsection (i) of the FTC Act provides that the agency is not required to disclose under FOIA "any material obtained from a foreign law enforcement agency or other foreign government agency, if the foreign law enforcement agency or other foreign government agency has requested confidential treatment, or has precluded such disclosure under other use limitations, as a condition of providing the material." 15 U.S.C. § 57b-2(f)(2)(A)(i). Here, the FTC seeks to categorically withhold complaints that were provided by the Canadian Anti-Fraud Centre, which is a Canadian law enforcement agency. See Stearns Decl. ¶ 18. The FTC permits the Canadian Anti-Fraud Centre to access existing complaints and to submit new complaints into the database pursuant to the "Consumer Sentinel Network Confidentiality and Data Security Agreement." See id.
This confidentiality agreement provides that "[a]ll parties participating in the information exchange system do so with the understanding that all Consumer Sentinel [database] information, including all information available on the Consumer Sentinel [database]'s restricted website, will be
Id. ¶ 7. Plaintiffs, relying on the "except as authorized by law" language, argue that the agreement does not require the FTC to keep information confidential in all circumstances. Though perhaps true, Plaintiffs' argument fails because Subsection (i) does not require mandatory confidentiality in all circumstances; instead, the statute permits withholding records whenever the foreign agency "has requested confidential treatment." 15 U.S.C. § 57b2(f)(2)(A)(i). Thus, given the unambiguous language of the agreement, the Court finds that the Canadian Anti-Fraud Centre indeed has requested such treatment. Accordingly, the Court grants summary judgment for the FTC on the basis that consumer complaints provided by the Canadian Anti-Fraud Centre must be withheld under Exemption 3.
The FTC also argues that complaints in the Consumer Sentinel database which were derived through the Ecommerce.gov website are protected from disclosure under Exemption 3 and Section 21(f) of the FTC Act. See Def.'s Mem. Supp. Mot. Summ. J. at 38. Specifically, Section 21(f), Subsection (iii) provides that in response to a FOIA request, the FTC is not required to disclose "any material reflecting a consumer complaint submitted to a Commission reporting mechanism sponsored in part by foreign law enforcement agencies or other foreign government agencies." 15 U.S.C. § 57b-2(f)(2)(A)(iii). In response, Plaintiffs concede that Ecommerce.gov is a joint international effort for gathering consumer complaints, and as such, those complaints must be withheld under Exemption 3. See Pls.' Mem. Opp'n Def.'s Mot. Summ. J. at 42. Accordingly, the Court grants summary judgment for the FTC on this issue.
During the course of Plaintiffs' three FOIA requests, the FTC provided four cost estimates for processing information contained in the granted data fields across the twenty million complaints in the Consumer Sentinel database:
Table 7
Date of Estimate Number of Fields Estimated Estimated Source Requested Time Cost
In Count IV, Plaintiffs contend that the agency's estimates appear disproportionate to the effort necessary to locate and process the data, see Am. Compl. ¶ 95, and they suggest that the estimates are facially unreasonable because there is no correlation between the price quote and the quantity
Before reaching the merits of the FTC's motion, the Court must address Plaintiffs' evidentiary objection to the declarations provided by the FTC in defense of its cost estimates. See Pls.' Mem. Opp'n Def.'s Mot. Summ. J. at 48. Rule 56 allows a party opposing summary judgment to "object that the material cited to support or dispute a fact cannot be presented in a form that would be admissible in evidence." Fed. R. Civ. P. 56(c)(2); Ali v. D.C. Gov't, 810 F.Supp.2d 78, 83 (D.D.C. 2011). At the summary judgment stage, a party is not required to produce evidence in a form that is admissible, but rather the evidence must be capable of being converted into admissible evidence at trial. See Gleklen v. Democratic Cong. Campaign Comm., Inc., 199 F.3d 1365, 1369 (D.C.Cir. 2000); see also Richards v. Option One Mortg., No. 08 Civ. 0007, 2009 WL 2751831, at *1 n. 3 (D.D.C.2009) (explaining that hearsay statements may be converted into admissible evidence if a witness with personal knowledge can testify to them at trial). Thus, hearsay "counts for nothing" when used to support or oppose a motion for summary judgment, unless it satisfies the evidentiary standard of Rule 56. See Gleklen, 199 F.3d at 1369.
Here, Plaintiffs object to the FTC's use of the Stearns and Rushen declarations as evidence to demonstrate the reasonableness of the September 9 and September 18, 2013, cost estimates from Lockheed Martin. See Pls.' Mem. Opp'n Def.'s Mot. Summ. J. at 48. Specifically, Plaintiffs argue that the FTC only attached to the declarations emails in which a different FTC employee reports to the declarant about his communication with the contractor, as opposed attaching an email showing the employee's direct communication with the contractor itself. See Rushen Decl. ¶¶ 10-12 (citing Stearns Decl., Exs. K, R, S). Plaintiffs therefore assert that the declarations rely on hearsay as the basis of their information.
In Barnard v. U.S. Department of Homeland Security, the plaintiff made a similar argument for excluding certain statements as inadmissible hearsay because the declarants were told information, rather than obtaining the information from their own review of relevant documents. See 598 F.Supp.2d 1, 19 (D.D.C. 2009). The Court rejected this argument because "FOIA declarants may include statements in their declarations based on information they have obtained in the course of their official duties." Id. (citations omitted); see also, e.g., Thompson v. Exec. Office for U.S. Attorneys, 587 F.Supp.2d 202, 208 n. 4 (D.D.C.2008) (finding declaration admissible when it was based on an individual's "review of [the defendant-agency's] official files and records, [her] own personal knowledge, and the information [she] acquired in performing her official duties"); Hornes v. Exec. Office for U.S. Attorneys, No. 04-2190, 2007 WL 1322088 at *4 (D.D.C. May 4, 2007) ("[The declarant's] statements are based on his personal knowledge, his review of [the agency's] official files and records and information that he acquired in performing [his] official duties.... Declarations provided by similarly situated officials have long been recognized as acceptable in FOIA cases." (internal citation and quotation marks omitted)).
Stearns and Rushen clearly attest that the statements in the declarations are
Generally, a FOIA requester must pay reasonable costs for the search, review, and duplication of the records it seeks. See 5 U.S.C. § 552(4)(A)(ii)(I); Judicial Watch, Inc. v. U.S. Dep't of Transp., No. CIV. 02-566, 2005 WL 1606915, at *3 (D.D.C. July 7, 2005). "A plaintiff's bare allegation that a fee assessment is unreasonable, however, is insufficient to avoid summary judgment." Hall & Assocs. v. EPA, 14 F.Supp.3d 1, 8, 2014 WL 400677, at *4 (D.D.C. Feb. 4, 2014) (citing Nat'l Treas. Empl. Union v. Griffin, 811 F.2d 644, 650 (D.C.Cir.1987)). Instead, a plaintiff must offer "specific analysis" to demonstrate that the requested fees are unreasonable. Rosenberg v. U.S. Dep't of Immigration & Customs Enforcement, 954 F.Supp.2d 1, 12 (D.D.C.2013).
Plaintiffs attempt to demonstrate the unreasonableness of the cost estimates through the lack of correlation between the number of fields to be processed in response to a specific request and the estimated cost of producing the data. See Pls.' Mem. Opp'n Def.'s Mot. Summ. J. at 47. As Table 7, supra, illustrates, it is true that a decrease in the number of fields requested did not always result in a corresponding decrease in the estimated processing cost. For example, the contractor provided the same estimate for the September 9 request that involved twenty data fields as it did for the September 18 request that included eleven data fields. See Tbl. 7, supra.
Plaintiffs, however, provide no explanation suggesting why the processing cost must directly correlate with the quantity of data fields to be produced. Though such a relationship may appear plausible, it is just as likely that other factors remain in play which prevent a direct correlation between the number of data fields and the processing cost. But even more fatally, Plaintiffs offer no evidence to support their theory, and it is well established that a lawyer's argument does not substitute for admissible evidence in opposition to a summary judgment motion. See Tom Sawyer Prods., Inc. v. Progressive Partners Achieving Solutions, Inc., 550 F.Supp.2d 23, 29 (D.D.C. 2008). Thus, not only do Plaintiffs fail to offer "specific analysis ... to demonstrate [that] the requested fees are unreasonable," Rosenberg, 954 F.Supp.2d at 12, they provide no admissible evidence rebutting the FTC's motion for summary judgment. See Johnson v. Digital Equip. Corp., 836 F.Supp. 14, 15 (D.D.C.1993) (explaining that speculation or bald allegations in the absence of actual evidence is insufficient to defeat a summary judgment motion); see also Int'l Distrb. Corp. v. Am. Dist. Tel. Co., 569 F.2d 136, 139 (D.C.Cir. 1977) ("[A] party may not avoid summary judgment by mere allegations unsupported by affidavit."). Accordingly, the Court grants summary judgment for the FTC on Count IV.
For the foregoing reasons, the FTC's motion is
Def.'s Reply Supp. Mot. Summ. J. at 19 n.12.
