Ayuda, Inc. v. Federal Trade Commission , 70 F. Supp. 3d 247 ( 2014 )

UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLUMBIA
AYUDA, INC., et al., :
:
Plaintiffs, : Civil Action No.: 13-1266 (RC)
:
v. : Re Document No.: 16, 20
:
FEDERAL TRADE COMMISSION, :
:
Defendant. :
MEMORANDUM OPINION
GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION FOR SUMMARY
JUDGMENT; AND DENYING PLAINTIFFS’ MOTION FOR PARTIAL SUMMARY JUDGMENT
I. INTRODUCTION
Ayuda, Inc., Catholic Charities of the Archdiocese of Washington, D.C., Catholic Legal
Immigration Network, Inc., and Legal Aid Justice Center (collectively, “Plaintiffs”) bring this
action under the Freedom of Information Act (“FOIA”), 5 U.S.C. § 552 et seq., against the
Federal Trade Commission (“FTC”) seeking information from the FTC’s Consumer Sentinel
database, which is an online repository containing millions of consumer complaints about
alleged illegal business activity. The FTC moves for summary judgment on all four of Plaintiffs’
FOIA causes of action, as well as for dismissal based on failure to exhaust administrative
remedies as to Plaintiffs’ request for information contained in the “Company Address, Zip Code
Extension” data field. Plaintiffs cross-move for partial summary judgment on the FOIA claims
in Counts I, II, and III as to the release of Consumer Sentinel database complaints that were
received by the FTC through its telephone complaint line. Upon consideration of the parties’
motions, the memoranda in support thereof and opposition thereto, and the evidentiary record
submitted by both parties to supplement their summary judgment filings, the Court will grant in
part and deny in part the FTC’s motion, and deny Plaintiffs’ motion.
II. BACKGROUND
A. The FTC and the Consumer Sentinel Database
The FTC is the federal agency with principal responsibility for protecting consumers
from deceptive and unfair trade practices. See Stearns II Decl. ¶ 3. The agency’s responsibilities
include enforcing the FTC Act, the federal antitrust laws, and dozens of other federal statutes.
See id. This litigation arose following three FOIA requests from Plaintiffs, a collection of non-
profit entities, 1 to the FTC seeking the release of information contained in the agency’s
Consumer Sentinel database, which is a secure online repository containing roughly twenty
million consumer complaints about alleged illegal business activity. See id. ¶ 4. The Consumer
Sentinel database is maintained by a contractor, Lockheed Martin, see Rushen Decl. ¶ 2, and it is
composed of three separate databases: (1) identity theft complaints; (2) complaints regarding the
Do Not Call Registry; and (3) complaints regarding fraud and other consumer issues. See
Stearns Decl. ¶ 4. There are two types of data fields within the Consumer Sentinel database:
“free-form” fields, in which there is no limit on the type of information that can be entered; and
“non-free-form” fields, in which the type of information is limited by pre-set options. See id. ¶
11.
1
Ayuda, Inc. is a non-profit agency that advocates for low-income immigrants
through direct legal, social, and language services. See Am. Compl. ¶ 2. Catholic Charities of
the Archdiocese of Washington, D.C. is a non-profit entity that provides social and legal
services, including legal services for low-income and vulnerable immigrants within D.C. and
Maryland. See id. ¶ 3. Catholic Legal Immigration Network, Inc. is a non-profit agency that
provides administrative support and services to a network of non-profit entities that provide legal
services to low-income and vulnerable immigrants throughout the country. See id. ¶ 4. Legal
Aid Justice Center is a non-profit entity that provides legal representation for low-income
individuals in Virginia. See id. ¶ 5.
2
Complaints enter the Consumer Sentinel database in several different ways. Of note for
purposes of this case, complaints are either submitted directly by consumers through the FTC’s
website, entered by an FTC operator in response to calls from consumers on the FTC’s telephone
complaint line, or transferred from independent online services provided by other governmental
and private entities, including the Canadian Anti-Fraud Centre and the Econsumer.gov website.
See id. ¶¶ 4, 18-19; James II Decl. ¶¶ 2-3. In 2013, approximately 60% of complaints filed
directly with the FTC were submitted by consumers contacting the FTC’s telephone complaint
line and speaking with an operator, who then transcribes the information into the database. See
James II Decl. ¶¶ 2-4. The remaining 40% of complaints submitted directly to the FTC were
entered by consumers through a link on the agency’s website. See id. ¶ 3
B. FOIA Request No. 2013-00680
On March 27, 2013, the FTC received a FOIA request, Request No. 2013-00680, from an
attorney representing Plaintiffs. See Stearns Decl. ¶ 5 & Ex. A. This request sought “a copy of
all complaints that are recorded in the Consumer Sentinel database,” with “only the information”
contained in seventeen specified free-form and non-free-form data fields:
Table 1
Fields Sought in Request No. 2013-00680
• Reference Number • Company Address, Line 1
• Created Date • Company Address, Line 2
• Complaint Source • Company Address, City
• Complaint Date • Company Address, State Code
• Consumer Address, City • Company Address, Country Code
• Consumer Address, State Name • Company Address, ZIP Code
• Consumer Address, Country Name • Complaint Info Product Service Description
• Company Name • Complaint Info Law Violation Description
• Complaint Info Statute Description
Source: Stearns Decl. ¶ 5 & Ex. A
The FTC’s FOIA Unit originally granted the request on May 2, 2013, see Admin. Record, Am.
Compl., ECF No. 11, Ex. E (“AR”) at 12, but two weeks later the agency reversed its position
3
and denied the request. See id. at 14. The agency explained that it denied the request because
(1) the data might reveal patterns of FTC procedures that would divulge the agency’s
deliberative process; (2) the data would reveal “FTC codes” used in the Consumer Sentinel
database; and (3) certain FOIA exemptions may apply to the information in the complaints. See
id.
Regarding the third point, the FTC explained that it had determined that a number of the
requested free-form data fields contain, or might contain, information that could, standing alone
or in combination with other information, identify the consumer who submitted the complaint or
another individual mentioned in the complaint, such as the alleged wrongdoer. See Stearns Decl.
¶¶ 11-12. The FTC therefore concluded that these data fields must be reviewed manually to
avoid disclosure of personal identifying information, and the agency estimated that this review
would take more than 8,000 hours to complete given the size of the Consumer Sentinel database.
See id. ¶¶ 11, 22. Separately, the FTC’s contractor estimated that it would cost $3,982.40 to
export data for the requested fields that the agency had not rejected. See id. ¶ 9 & Ex. C; Rushen
Decl. ¶ 6. On June 10, 2013, the FTC denied Request No. 2013-00680 when counsel for
Plaintiffs did not pre-pay the estimated processing cost. See Stearns Decl. ¶ 25 & Ex. F.
C. FOIA Request No. 2013-00949
On May 24, 2013, the FTC received a second request, Request No. 2013-00949, from
another attorney representing Plaintiffs. See id. ¶ 26 & Ex. G. In addition to the seventeen data
fields in the first request, the second request sought sixteen more fields across the three
Consumer Sentinel subdatabases:
4
Table 2
Additional Fields Sought in Request No. 2013-00949
• Complaint Comments • Other Information Requested Entity to
• Phone in Registry? Stop Calling
• Company State • Other Information Comments
• Company Phone, Area Code • Entered Date
• Company Phone, Number • Theft Activity First Occurred Date
• Other Information Product Service • Theft Incident Theft Type Description
Description • Theft Incident SubType Description
• Other Information Existing Business • Associated Institution Institution Name
Relationship • Suspect Alias, Company Name
• Other Information Pre-Recorded Message
Source: Stearns Dec. ¶ 26 & Ex. G
The FOIA Unit determined that processing Request No. 2013-00949 would entail an “even
greater burden” than the first request because it sought “comment” fields in addition to the free-
form data fields included in the original request. See id. ¶ 28. Accordingly, the FTC denied the
request after informing Plaintiffs’ counsel that complying would be overly burdensome. See id.
¶¶ 29-31 & Exs. H, I.
D. First Appeal: Request Nos. 2013-00680 and 2013-00949
On July 10, 2013, counsel for Plaintiffs appealed the denial of Request Nos. 2013-00680
and 2013-00949. See Am. Compl., Ex. A. A month later, FTC Acting General Counsel David
Shonka granted in part and denied in part the appeal. See Stearns Decl. ¶ 34 & Ex. J.
Specifically, Mr. Shonka granted Plaintiffs’ request for the data fields “that do not elicit free-
form responses, excluding any zip code fields,” but he denied the request as to the remaining
free-form fields because they actually or potentially contain information exempt from disclosure
under FOIA Exemption 6, and a review to segregate the exempt material would place an
inordinate burden on the agency’s resources. See id.
Mr. Shonka remanded the case to the FOIA Unit to identify and process the requests for
the data fields for which the appeal was granted. See id. ¶ 35 & Ex. J. On remand, the FOIA
Unit reviewed the requests and identified for processing the data fields that did not elicit free-
5
form responses. See id. ¶¶ 36-38. The FOIA Unit, however, determined that the following free-
form data and zip code fields should not be produced under Mr. Shonka’s decision:
Table 3
Fraud and Other Consumer
Do Not Call Database Identity Theft Database
Database
• Consumer Address, City • Consumer Address, City • Consumer Address, City
• Company Name • Company Name • Associated Institution
• Company Address, Line 1 • Company Phone, Area Code Institution Name
• Company Address, Line 2 • Company Phone, Number • Suspect Alias, Company
• Company Address, City • Other Information Comments Name
• Company Address, Zip Code
• Complaint Comments
Source: Stearns Decl. ¶ 38
The FTC then sent the fields that could be produced to the contractor for a cost estimate, and the
contractor quoted a fee of $8,581.95 “to develop the custom scripts, extract from reporting
[database], format, validate and complete this FOIA” request. 2 See id. ¶ 39 & Ex. K; Rushen
Decl. ¶ 10. Lockheed Martin arrived at this estimate by predicting sixty-five hours of labor at
$132.03 per hour, which is the “Information Systems Analyst III” labor category rate established
under the FTC’s agreement with the contractor. See Stearns Decl. ¶ 39.
On September 9, 2013, the FTC provided Plaintiffs’ counsel with the contractor’s
estimate for processing the remaining portions of Request Nos. 2013-00680 and 2013-00949,
and the agency advised counsel that an advanced payment of the full amount was required within
ten days or the requests would be closed. See id. ¶ 40 & Ex. L. In response, counsel asked that
“[FTC] Staff not commence the search and production of the requested data until a resolution has
been reached concerning some, or all, of the Contested Fields,” and he stated that Plaintiffs
intended to appeal the cost estimate. See id. ¶¶ 41-42 & Ex. M. On September 23, the agency
closed both requests because it did not receive timely payment. See id. ¶ 43 & Ex. N.
2
Plaintiffs object to the FTC’s evidence regarding this cost estimate, as well as the
quote provided on September 18, 2013, which is discussed below. For the reasons explained in
Part IV.F.1, the Court rejects Plaintiffs’ objection.
6
E. FOIA Request No. 2013-01305
On August 26, 2013, Plaintiffs’ counsel filed a third FOIA request, Request No. 2013-
01305, which sought the following eight fields for all complaints in the Consumer Sentinel
database:
Table 4
Fields Sought in Request No. 2013-01305
• Complaint Info Law Violation Code • Company Address, State Name
• Complaint Info Statute Code • Company Address, Country Name
• Consumer Address, Zip Code • Company Email
• Company Address, Line 3 • CompanyWebsite
Source: Stearns Decl. ¶ 44 & Ex. O
This request, like the first two requests, did not include the “Company Address, Zip Code
Extension” field. See id. Again, the FTC determined that it would produce only the data fields
that did not elicit free-form responses. See id. ¶ 45 & Ex. Q. The FTC also requested another
estimate from the contractor for processing the remaining fields in Request No. 2013-01305, see
id. ¶¶ 46-47 & Ex. R, and the contractor provided a quote of $8,581.95. See id. ¶ 48 & Ex. S;
Rushen Decl. ¶ 12. On September 18, 2013, the FOIA Unit provided Plaintiffs’ counsel with the
estimate for processing the granted portions of the request, see Stearns Decl. ¶ 49 & Ex. T, and
on September 30, the agency closed the request when Plaintiffs did not pay on time. See id. ¶ 50
& Ex. U.
F. Second Appeal: Request Nos. 2013-00680; 2013-0949; and 2013-01305
On October 23, 2013, Plaintiffs appealed the FTC’s resolution of the remanded portions
of Request Nos. 2013-00680 and 2013-0949, as well as the agency’s response to Request No.
2013-01305. See id. ¶ 51. Mr. Shonka denied the appeal a month later. See id. ¶ 52 & Ex. V.
Following the appeal, however, the FTC determined that several additional fields should be
produced: the “Company Phone, Area Code” and “Company Address, Zip Code” fields in the
7
fraud database and the Do Not Call database; and the “Associated Institution Phone, Area Code”
and “Associated Institution Address, Zip Code” fields in the identity theft database. See id. ¶ 54.
In the end, after considering Plaintiffs’ three requests and two appeals, the FTC maintained that
the following fields contain exempt information, the manual review for which would be unduly
burdensome:
Table 5
Fraud and Other Consumer
Do Not Call Database Identity Theft Database
Database
• Consumer Address, City • Consumer Address, City • Consumer Address, City
• Company Address, Zip Code • Company Address, Zip Code • Consumer Address, Zip Code
• Company Name • Company Name • Associated Institution Institution
• Company Address, Line 1 • Company Phone, Number Name
• Company Address, Line 2 • Other information Comments • Associated Institution Address,
• Company Address, Line 3 Line 1
• Company Address, City • Associated Institution Address,
• Company Phone, Number Line 2
• Complaint Comments • Associated Institution Address,
• Company Email City
• Company Website • Associated Institution Phone,
Number
• Suspect Alias, Company Name
• Associated Institution Email
• Associated Institution Web URL
Source: Stearns Decl. ¶ 53
* * *
On December 2, 2013, Plaintiffs filed an amended complaint challenging the FTC’s
responses to the three FOIA requests described above. Specifically, Plaintiffs allege through
Counts I, II, and III that the FTC wrongfully withheld information in the following fields, which
Plaintiffs categorize as the “Company Information Fields” (Count I), the “Complainant
Geographic Information Field” (Count II), and the “Comment Fields” (Count III):
Table 6 3
3
As the FTC points out, Plaintiffs’ list of the fields for which the FTC denied
access is incomplete. See Def.’s Mem. Supp. Mot. Summ. J. at 27 n.1 (citing Am. Compl. ¶ 42).
The complete list is available at Table 5, supra. But as Plaintiffs explain, “the legal issues
involved relate to the substantive information contained in the eleven fields/categories listed in
8
Complaint Category Requested Fields FTC Decision
Company Name Denied
Company Address, Line 3 Denied
Company Information Company Address, Zip Code Denied
Fields 4
(Count I) Company Address, Zip Code Extension Denied
Company Email Denied
CompanyWebsite Denied
Complainant Geographic
Information Field Consumer Address, Zip Code Denied
(Count II)
Comment Fields Other Information Comments Denied
(Count III) Complaint Info Comments Denied
Source: Am. Compl. ¶ 42
Finally, Plaintiffs allege in Count IV that the FTC violated FOIA by refusing to provide
information necessary for determining the reasonableness of the contractor’s fee estimates for
processing the granted portions of the FOIA requests.
III. LEGAL FRAMEWORK
A. Legal Standard in FOIA Cases
“FOIA cases typically and appropriately are decided on motions for summary judgment.”
Defenders of Wildlife v. U.S. Border Patrol, 623 F. Supp. 2d 83, 87 (D.D.C. 2009) (citing
Bigwood v. U.S. Agency for Int’l Dev., 484 F. Supp. 2d 68, 73 (D.D.C. 2007)). Under Rule 56 of
the Federal Rules of Civil Procedure, summary judgment must be granted when evidence shows
“that there is no genuine dispute as to any material fact and the movant is entitled to judgment as
a matter of law.” Fed. R. Civ. P. 56; Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 247 (1986).
In the FOIA context, a district court reviewing a motion for summary judgment conducts a de
[Table 6, supra] regardless of how many technical ‘fields’ within the databases contain that
substance.” Pls.’ Mem. Opp’n Def.’s Mot. Summ. J. at 6 n.3. The Court therefore refers to the
fields and categories described by Plaintiffs for purposes of this Memorandum Opinion.
4
The FTC disputes that Plaintiffs properly requested and exhausted their
administrative remedies as to the “Company Address, Zip Code Extension” field. See Answer
Am. Compl. ¶¶ 42, 44.
9
novo review of the record, and the responding federal agency bears the burden of proving that it
has complied with its obligations under FOIA. See 5 U.S.C. § 552(a)(4)(B); see also In Def. of
Animals v. Nat’l Insts. of Health, 543 F. Supp. 2d 83, 92-93 (D.D.C. 2008) (citing Assassination
Archives & Research Ctr. v. CIA, 334 F.3d 55, 57 (D.C. Cir. 2003)). The district court must
analyze all underlying facts and inferences in the light most favorable to the FOIA requester.
See Willis v. DOJ, 581 F. Supp. 2d 57, 65 (D.D.C. 2008) (citing Moore v. Aspin, 916 F. Supp.
32, 35 (D.D.C. 1996)). Accordingly, summary judgment for an agency is appropriate only if the
agency proves that it has “fully discharged its [FOIA] obligations[.]” Moore, 916 F. Supp. at 35
(citing Miller v. U.S. Dep’t of State, 779 F.2d 1378, 1382 (8th Cir. 1985)).
A court may award summary judgment in a FOIA case based solely upon the information
provided in agency affidavits or declarations if they describe “the justifications for nondisclosure
with reasonably specific detail, demonstrate that the information withheld logically falls within
the claimed exemption, and are not controverted by either contrary evidence in the record nor by
evidence of agency bad faith.” Military Audit Project v. Casey, 656 F.2d 724, 738 (D.C. Cir.
1981). Such affidavits or declarations “are accorded a presumption of good faith, which cannot
be rebutted by ‘purely speculative claims about the existence and discoverability of other
documents.’” SafeCard Servs., Inc. v. SEC, 926 F.2d 1197, 1200 (D.C. Cir. 1991) (quoting
Ground Saucer Watch, Inc. v. CIA, 692 F.2d 770, 771 (D.C. Cir. 1981)).
Finally, although FOIA cases typically are decided through summary judgment, courts in
this Circuit analyze failure to exhaust administrative remedies motions under Rule 12(b)(6). See
Hidalgo v. FBI, 344 F.3d 1256, 1260 (D.C. Cir. 2003) (vacating grant of summary judgment and
remanding FOIA case “with instructions to the district court to dismiss the complaint under
[Rule] 12(b)(6) … for failure to exhaust administrative remedies”); accord Acosta v. FBI, 946 F.
10
Supp. 2d 47, 49 (D.D.C. 2013); Tereshchuk v. U.S. Bureau of Prisons, 851 F. Supp. 2d 157, 161-
62 (D.D.C. 2012); Banks v. Lappin, 539 F. Supp. 2d 228, 234-35 (D.D.C. 2008).
B. FOIA’s Purpose and Exemptions
The statute known as FOIA is a revision of the public disclosure section of the
Administrative Procedure Act. See Conservation Force v. Jewell, No. 12-CV-1665, 2014 WL
4327949, at *4 (D.D.C. Sept. 2, 2014). Congress “broadly conceived” FOIA “to permit access to
official information long shielded unnecessarily from public view and [] to create a judicially
enforceable public right to secure such information from possibly unwilling official hands.”
EPA v. Mink, 410 U.S. 73, 80 (1973). To that end, “FOIA requires every federal agency, upon
request, to make ‘promptly available to any person’ any ‘records’ so long as the request
‘reasonably describes such records.’” Assassination Archives, 334 F.3d at 57 (quoting 5 U.S.C.
§ 552(a)(3)). Consistent with this statutory mandate, federal courts have jurisdiction to order the
production of records that an agency improperly withheld in violation of FOIA. See 5 U.S.C. §
552(a)(4)(B); DOJ v. Reporters Comm. for Freedom of the Press, 489 U.S. 749, 755 (1989).
FOIA, however, also “recognizes limitations that compete with the general interest in
disclosure, and that, in appropriate cases, can overcome it.” Nat’l Archives & Records Admin. v.
Favish, 541 U.S. 157, 172 (2004). “Thus, while ‘disclosure, not secrecy, is the dominant
objective of FOIA,’ there are [nine] exemptions from the statute’s broad reach[.]” U.S. Dep’t of
Def. v. FLRA, 510 U.S. 487, 494 (1994) (quoting Dep’t of Air Force v. Rose, 425 U.S. 352, 361
(1976)); see also 5 U.S.C. § 552(b)(1)-(9) (listing nine FOIA exemptions). “These exemptions
stem from Congress’s recognition that the release of certain information may harm legitimate
governmental or private interests.” Summers v. DOJ, 140 F.3d 1077, 1080 (D.C. Cir. 1998).
11
Finally, courts must bear in mind that FOIA mandates a “strong presumption in favor of
disclosure,” U.S. Dep’t of State v. Ray, 502 U.S. 164, 173 (1991), and consistent with that
presumption, the nine statutorily exempt categories of documents must be “narrowly construed.”
Rose, 425 U.S. at 361. As such, the “‘burden is on the agency’ to show that the requested
material” need not be produced because a particular FOIA exemption protects the material from
disclosure. Petroleum Info. Corp. v. U.S. Dep’t of Interior, 976 F.2d 1429, 1433 (D.C. Cir.
1992) (quoting 5 U.S.C. § 552(a)(4)(B)). “Ultimately, an agency’s justification for invoking a
FOIA exemption is sufficient if it appears ‘logical’ or ‘plausible.’” Wolf v. CIA, 473 F.3d 370,
374-75 (D.C. Cir. 2007) (quoting Gardels v. CIA, 689 F.2d 1100, 1105 (D.C. Cir. 1982)).
IV. ANALYSIS
Now before the Court are the FTC’s motion for summary judgment and Plaintiffs’ cross-
motion for partial summary judgment. The FTC argues that it correctly denied Plaintiffs’
requests as to the free-form data fields in Counts I, II, and III under FOIA Exemptions 6 and
7(C) because those fields actually or potentially contain personal identifying information
protected by the exemptions, and the manual review needed to redact this information would be
unduly burdensome given the volume of records in the Consumer Sentinel database. 5 See Def.’s
Mem. Supp. Mot. Summ. J., ECF No. 16, at 14. In addition, the agency argues that it properly
excluded under Exemption 3 complaints that were provided by the Canadian Anti-Fraud Centre
5
As Plaintiffs note, see, e.g., Pls.’ Mem. Opp’n Def.’s Mot. Summ. J. at 43, the
FTC asserts exemptions in this litigation not raised during the administrative process. Though
this is correct, an “agency is nonetheless entitled to refine its position” by asserting new FOIA
exemptions before the Court. Cuban v. SEC, 744 F. Supp. 2d 60, 90 (D.D.C. 2010); see also
Gula v. Meese, 699 F. Supp. 956, 959 n.2 (D.D.C. 1988) (“[T]he defendant in a FOIA case may
assert new exemptions at the federal district court level stage not previously asserted at the
administrative level, even if the circumstances have not changed in the interim.”) (citing Jordan
v. DOJ, 591 F.2d 753, 779 (D.C. Cir. 1978)).
12
or derived through the Ecommerce.gov website. See id. Next, the FTC seeks summary
judgment on Count IV on the basis that the cost estimates provided by the contractor were
reasonable. See id. And finally, the FTC moves to dismiss Plaintiffs’ request for information
contained in the “Company Address, Zip Code Extension” data field based on failure to exhaust
administrative remedies. See id. Plaintiffs, on the other hand, move for partial summary
judgment as to the release of complaints received by the FTC through its telephone complaint
line, as opposed to those complaints submitted directly by consumers on the FTC’s website. See
Pls.’ Mem. Supp. Part. Mot. Summ. J., ECF No. 20, at 1.
For the reasons discussed below, the Court grants in part and denies in part the FTC’s
motion, and denies in full Plaintiffs’ motion. Specifically, the Court denies the FTC’s motion to
dismiss the claim in Count I regarding the “Company Address, Zip Code Extension” field, on the
basis of failure to exhaust administrative remedies. Next, the Court grants summary judgment
for the FTC as to Counts I and III because those counts seek free-form data fields that potentially
contain personal identifying information that must be withheld under FOIA Exemptions 6 and
7(C), and the manual review required to segregate such exempt information would be unduly
burdensome. The Court, however, denies the FTC’s request for summary judgment on Count II
because the agency fails to offer evidence establishing a privacy interest in the five-digit zip code
data.
In addition, the Court grants summary judgment for the FTC as to the Canadian Anti-
Fraud Centre and Ecommerce.gov complaints because those complaints must be segregated and
withheld under FOIA Exemption 3, and the Court also grants summary judgment for the FTC on
Count IV because there is no genuine dispute of material fact that the agency’s cost estimates
13
were reasonable. Finally, the Court denies Plaintiffs’ motion for summary judgment as to the
complaints received through the FTC’s telephone complaint line.
A. Failure to Exhaust: “Company Address, Zip Code Extension” Field
The FTC moves to dismiss the claim in Count I with respect to the “Company Address,
Zip Code Extension” data field on the basis that none of Plaintiffs’ three FOIA requests included
this field. See Def.’s Mem. Supp. Mot. Summ. J. at 26. “Exhaustion of administrative remedies
is generally required before seeking judicial review ‘so that the agency has an opportunity to
exercise its discretion and expertise on the matter and to make a factual record to support its
decision.’” Wilbur v. CIA, 355 F.3d 675, 677 (D.C. Cir. 2004) (quoting Oglesby v. U.S. Dep’t of
the Army, 920 F.2d 57, 61 (D.C. Cir. 1990)). As the D.C. Circuit has explained, although
exhaustion of a FOIA request “is not jurisdictional because the FOIA does not unequivocally
make it so,” Hidalgo v. FBI, 344 F.3d 1256, 1258 (D.C. Cir. 2003) (citing I.A.M. Nat’l Pension
Fund Ben. Plan C. v. Stockton TRI Indus., 727 F.2d 1204, 1208 (D.C. Cir. 1984)), failure to
exhaust still “precludes judicial review if ‘the purposes of exhaustion’ and the ‘particular
administrative scheme’ support such a bar,” id. at 1258-59 (quoting Oglesby, 920 F.2d at 61).
It is undisputed that Plaintiffs did not include the “Company Address, Zip Code
Extension” data field in the three FOIA requests at issue. See Pls.’ Resp. Def.’s Stmt. of Facts ¶¶
6, 16, 22, 34. Instead, Plaintiffs’ first administrative appeal, which was filed after the FTC
refused to grant Plaintiffs’ first two FOIA requests, specifically listed the “Company Address,
Zip Code Extension” field as one of the fields they were appealing, despite its not being included
in the original requests. See Am. Compl., Ex. A; Pls.’ Mem. Opp’n Def.’s Mot. Summ. J., ECF
No. 19, at 32. Curiously, in response to this appeal, the FTC pointed out that it would not
consider several of the new fields raised by Plaintiffs because those fields were not included
14
within the scope of the FOIA requests, but the FTC’s list did not include the “Company Address,
Zip Code Extension” field that Plaintiffs also had mentioned for the first time on appeal. See
Am. Compl., Ex. B at 2 n.2. The FTC, moreover, concluded at the end of the response letter that
it was “excluding any zip code fields” from processing under Exemption 6. See id. at 5
(emphasis added).
Based on the FTC’s response letter, it appears that when evaluating whether Exemption 6
prevented disclosure, the agency may have considered the “Company Address, Zip Code
Extension” field along with the other consumer and company zip code fields requested by
Plaintiffs. Yet even if the agency did not consider this new field, it certainly was given an
opportunity to do so when Plaintiffs raised the issue in their administrative appeal. Thus, though
Plaintiffs technically failed to make a proper FOIA request and exhaust administrative remedies,
their error “presents no risk of undermining the purposes and policies underlying the exhaustion
requirement, namely, to prevent premature interference with agency processes, to give the parties
and the courts benefit of the agency’s experience and expertise and to compile an adequate
record for review.” Wilbur, 355 F.3d at 677. This is because by raising the question in the
appeal along with the other requested zip code fields, Plaintiffs afforded the FTC sufficient
opportunity to evaluate the “Company Address, Zip Code Extension” field — an opportunity, in
fact, it appears the FTC took given the language of the response letter.
In addition, the Court notes the futility and inefficiency of requiring Plaintiffs to restart
the FOIA process from the beginning as to this one field. First, the Court agrees with Plaintiffs’
prediction that the FTC very likely will deny this request once it is formally made. Indeed, given
the agency’s denial of the five-digit zip code information, which is less specific in identifying a
location than the four-digit zip code extension information, it would be illogical for the agency to
15
conclude otherwise. Second, after the FTC’s inevitable denial, it would be inefficient for the
Court to preside over a separate lawsuit regarding this single field when the parties already are
litigating the instant case that involves the same set of facts. Instead, the more efficient path is
for the Court to resolve all the Consumer Sentinel database disputes between Plaintiffs and the
FTC at once. Cf. Barouch v. DOJ, 962 F. Supp. 2d 30, 51 (D.D.C. 2013) (finding that plaintiff
“constructively exhausted” administrative remedies in part because “[i]t would be anomalous to
review plaintiff’s challenges to [the agency’s] withholdings of documents that were identified …
in the spring of 2012 and that were processed by [the agency], but to decline review on
exhaustion grounds the determinations of other agencies to which [agency] sent some of the
documents it identified at the same time”). Accordingly, because exhaustion is a prudential
consideration rather than a jurisdictional prerequisite, the Court concludes that, under these
circumstances, it will not dismiss the claim regarding the “Company Address, Zip Code
Extension” field for failure to exhaust. 6
6
Having denied the FTC’s failure to exhaust argument as to the “Company
Address, Zip Code Extension” field in Count I, the Court notes that this issue remains
outstanding because neither party addressed the merits of withholding zip code extensions in
their summary judgment briefing. Plaintiffs in particular focus their opposition memorandum
exclusively on the propriety of releasing five-digit zip codes, and they even go so far as to
disavow any interest in receiving the four-digit extensions. See, e.g., Pls.’ Mem. Opp’n Def.’s
Mot. Summ. J. at 35 (“In this case, of course, Plaintiffs are only seeking complainants’ five-digit
zip code[.]”). Part of Plaintiffs’ argument, in fact, rests on distinguishing five-digit zip codes
from the four-digit extensions based on Havemann v. Colvin, 537 F. App’x 142 (4th Cir. 2013),
where the Fourth Circuit approved of the Social Security Administration’s decision to produce
the five-digit zip codes but withhold the full nine-digit zip codes. By focusing their analysis only
on five-digit zip codes, Plaintiffs appear to acknowledge that the FTC could properly withhold
the four-digit extensions under Exemptions 6 and 7(C)) given that the extensions provide far
more specificity about an individual’s location. Nonetheless, given the lack of evidence and
arguments from both sides, the Court cannot resolve the question at this time.
16
B. Counts I, II, and III: Denial of Requests for Free-Form Fields Under Exemption 6
In Counts I, II, and III, Plaintiffs contend that the FTC violated FOIA by denying their
requests for specific free-form data fields, which Plaintiffs categorize as the “Company
Information Fields” (Count I), the “Complainant Geographic Information Field” (Count II), and
the “Comment Fields” (Count III). See Am. Compl. ¶¶ 42, 46-88; see also Tbl. 6, supra. In
response, the FTC argues that it correctly withheld the information in each of these fields under
FOIA Exemption 6, and as such, the agency seeks summary judgment in its favor on these
counts. For the reasons explained below, the Court agrees with the FTC that the data fields
sought in Counts I and III potentially contain information protected under Exemption 6; the
Court finds, however, that the FTC has failed to establish that Exemption 6 covers the zip code
information sought in Count II.
1. Exemption 6 Framework
FOIA Exemption 6 protects from disclosure “personnel and medical files and similar files
the disclosure of which would constitute a clearly unwarranted invasion of personal privacy.” 5
U.S.C. § 552(b)(6). The Supreme Court has interpreted the term “similar files” broadly so as “to
cover detailed Government records on an individual which can be identified as applying to that
individual.” U.S. Dep’t of State v. Wash. Post Co., 456 U.S. 595, 602 (1982) (citation and
quotation marks omitted). “The information in the file ‘need not be intimate’ for the file to
satisfy the standard, and the threshold for determining whether information applies to a particular
individual is minimal.” Milton v. DOJ, 783 F. Supp. 2d 55, 58 (D.D.C. 2011) (quoting N.Y.
Times Co. v. NASA, 920 F.2d 1002, 1006 (D.C. Cir. 1990)).
Once this threshold determination is met, a court next inquires whether disclosure would
compromise a “substantial” privacy interest because FOIA requires the release of information
17
“[i]f no significant privacy interest is implicated.” See Multi Ag Media LLC v. U.S. Dep’t of
Agric., 515 F.3d 1224, 1229 (D.C. Cir. 2008) (citing Nat’l Ass’n of Retired Fed. Emps. v.
Horner, 879 F.2d 873, 874 (D.C. Cir. 1989)). This standard, however, “means less than it might
seem,” as a substantial privacy interest is “anything greater than a de minimis privacy interest.”
Id. at 1229-30. If a substantial privacy interest exists, a court next tests whether release of such
information would constitute a “clearly unwarranted invasion of personal privacy,” Wash. Post
Co. v. U.S. Dep’t of Health & Human Servs., 690 F.2d 252, 260 (D.C. Cir. 1982), by balancing
“the privacy interest that would be compromised by disclosure against any public interest in the
requested information.” Multi Ag Media, 515 F.3d at 1228.
2. Count I: Company Information Fields
The FTC argues that the Company Information Fields actually or potentially contain
personal identifying information, the disclosure of which would constitute an unwarranted
invasion of privacy under Exemption 6. See Def.’s Mem. Supp. Mot. Summ. J. at 27.
Specifically, the FTC contends that personal information can be entered in the Count I free-form
data fields through two scenarios: first, a consumer may mistakenly insert information about
himself in fields that are intended for details about the alleged wrongdoer; or second, a consumer
may intentionally provide information about an alleged individual wrongdoer, as opposed to a
corporation or other business wrongdoer, when describing an incident. See Stearns Decl. ¶ 12.
In response, Plaintiffs argue that the FTC fails to demonstrate that personal information is
inserted in these fields with any statistical frequency such that it is more than mere speculation.
See Pls.’ Mem. Opp’n Def.’s Mot. Summ. J. at 18. Plaintiffs also suggest that there is no privacy
interest in “personal information about an alleged wrongdoer” because the FTC released the
names of individuals appearing in the “Company Name” field in response to prior FOIA
18
requests. See id. at 19. The FTC contends that this argument confuses the privacy interests of
individuals accused of wrongdoing in their personal capacity with individuals accused of
wrongdoing while acting in a business capacity, and the FTC only seeks to protect information
regarding individuals in the former category. See Def.’s Reply Supp. Mot. Summ. J., ECF No.
26, at 17-18. As such, the agency attests that it does not redact the names of company
representatives or people otherwise acting through a business, thereby conceding that there is no
need to manually review complaints for personal identifying information about individuals
clearly acting in a business capacity. See Stearns II Decl. ¶¶ 10-14; see also Wash. Post Co. v.
U.S. Dep’t of Agric., 943 F. Supp. 31, 35 (D.D.C. 1996) (explaining that unlike information
about individuals acting in their personal capacity, there is “no expectation of privacy” in the
names of persons engaged in business). The Court therefore focuses its analysis on only those
individuals who are accused of wrongdoing in their personal capacity.
The FTC’s original declaration in support of its motion for summary judgment provided
just one example of a consumer mistakenly inserting her “own name, address, area code, phone
number, and email address in the fields reserved for the subject of the complaint” — that is, the
fields in which information about the wrongdoer should go. See Stearns Decl. ¶ 28. At the same
time, the FTC also offered evidence of three other complaints in which a consumer inserted
personal information about an individual wrongdoer in the Company Information Fields. See id.
Through a second declaration, however, the FTC provides additional evidence regarding a
supplementary review of more complaints in the Consumer Sentinel database, and this review
revealed a very real possibility of personal identifying information appearing in the Company
Information Fields.
19
To cull the millions of complaints in the Consumer Sentinel database down to a
reviewable sample, the FTC first searched the fraud database for complaints containing a
“Gmail” address in the “Company Email Field.” See Stearns II Decl. ¶ 16. The agency selected
“Gmail” addresses because individuals, rather than business entities, typically use these email
addresses, so finding such an address in the Company Email Field logically suggests that an
individual is being accused of wrongful conduct in his or her personal capacity. See id. The
FTC’s search returned more than 350,000 complaints with a “Gmail” address, and the agency
reviewed a sample of 600 of those complaints, which revealed that 82%, or 497 of 600
complaints, contained personal identifying information, such as names and addresses, in one or
more of the free-form data entry fields sought through Count I. See id. ¶¶ 16-18. Furthermore,
89 of the 600 complaints that the FTC reviewed in this sample originated from the FTC’s call
center, and of those 89 complaints, 78 contained personal identifying information in one or more
of the Company Information Fields. See id. ¶ 19.
The agency also ran a similar search in the Consumer Sentinel database’s identity theft
database for complaints in which a “Gmail” address appears in the “Associated Institution
Email” field, which returned 970 complaints. See id. ¶ 21. The agency’s review of a date-
limited subset of 151 complaints revealed that 78% of the complaints contained personal
identifying information about private individuals in one or more of the data fields in Count I.
See id. ¶¶ 21-22. Extrapolating the results from the identity theft database and fraud database
searches to the original set of 350,000 “Gmail” complaints indicates that hundreds of thousands
of records may exist in which personal identifying information was intentionally placed in
Company Information Fields because the alleged wrongdoer was described as acting in his or her
personal capacity.
20
In addition, the FTC provides evidence that consumers are mistakenly entering their own
personal information into various Company Information Fields. For example, 59 of the 151
identity theft database complaints from the sample described above included information in the
“Associated Institution Email” field that matched the complaining consumer’s email address,
which suggests that these consumers entered their personal information in the wrong fields. See
id. ¶ 23. In 33 other complaints, the consumer’s area code and telephone number matched the
“Associated Institution” area code and telephone number, and in 23 complaints, the consumer’s
street address, city, state, and zip code all matched the “Associated Institution” address. See id.
Finally, numerous consumers also listed their personal email address and name in the
“Associated Institution Contact Person” or “Associated Institution Institution Name” fields,
rather than information about the subject of the complaint. See id.
To justify withholding documents under Exemption 6, the FTC must show that the threat
to privacy is “real rather than speculative.” Elec. Privacy Info. Ctr. v. Dep’t of Homeland Sec.,
384 F. Supp. 2d 100, 116 (D.D.C. 2005) (citing U.S. Dep’t of Air Force v. Rose, 425 U.S. 352,
380 n.19 (1976)). An agency can meet its burden by providing affidavits or declarations that
“describe the justifications for nondisclosure with reasonably specific detail, demonstrate that the
information withheld logically falls within the claimed exemption, and are not controverted by
either contrary evidence in the record nor by evidence of agency bad faith.” Larson v. U.S.
Dep’t of State, 565 F.3d 857, 862 (D.C. Cir. 2009) (quoting Miller v. Casey, 730 F.2d 773, 776
(D.C. Cir. 1984)). Here, the Court is satisfied that — based on the evidence provided by the
FTC, the lack of allegations of bad faith, and the lack of contradictory evidence provided by
Plaintiffs — the agency has demonstrated a real, and not merely speculative, possibility of
personal identifying information in the form of names, addresses, telephone numbers, and email
21
addresses existing in the Company Information Fields. The next step, then, involves identifying
whether there exists a privacy interest in withholding this information, and whether, when
balanced against the public benefits of disclosure, release of the personal identifying information
would create a “clearly unwarranted invasion of personal privacy.” See Reed v. NLRB, 927 F.2d
1249, 1251 (D.C. Cir. 1991).
In construing Exemption 6, the D.C. Circuit has explained that “the disclosure of names
and addresses is not inherently and always a significant threat to the privacy of those listed;
whether it is a significant or a de minimis threat depends upon the characteristic(s) revealed by
virtue of being on the particular list, and the consequences likely to ensue.” Nat’l Ass’n of
Retired Fed. Emps. v. Horner, 879 F.2d 873, 877 (D.C. Cir. 1989); see also U.S. Dep’t of State v.
Ray, 502 U.S. 164, 176 n.12 (1991) (noting that disclosure of a list of names and other personal
identifying information is not “inherently and always a significant threat to the privacy of the
individuals on the list”). But at the same time, the D.C Circuit has recognized that “the privacy
interest of an individual in avoiding the unlimited disclosure of his or her name and address is
significant.” Horner, 879 F.2d at 875. In its motion for summary judgment, the FTC argues that
individuals possess a substantial privacy interest in their personal identifying information not
being released because these individuals most likely fall into one of two categories: either they
are victims of a fraudulent scheme or crime, or they are accused of committing or participating in
a fraudulent scheme or crime. See Def.’s Reply Supp. Mot. Summ. J. at 17.
First, the Court agrees that consumers who are victims, and consequently also are
whistleblowers and witnesses, face potential backlash if identified in the form of embarrassment,
becoming a “mark” for similar schemes in the future, and retribution from the alleged wrongdoer
— all of which constitute unwanted privacy intrusions that extend beyond merely having a name
22
and address published. See U.S. Dep’t of State v. Wash. Post Co., 456 U.S. 595, 599 (1982)
(FOIA’s legislative history shows that “Congress’[s] primary purpose in enacting Exemption 6
was to protect individuals from the injury and embarrassment that can result from the
unnecessary disclosure of personal information”); Horner, 879 F.2d at 878 (“Disclosure does
not, literally by itself, constitute a harm; it is the requester’s (or another’s) reaction to the
disclosure that can sting. This is only more obvious where disclosure of the information invades
someone’s privacy not because it is embarrassing but because it invites unwanted intrusions.”);
see also Lahr v. NTSB, 569 F.3d 964, 976 (9th Cir. 2009) (explaining that “protection from …
unwanted contact [by third parties] facilitated by disclosure of a connection to government
operations and investigations is a cognizable privacy interest under Exemptions 6”).
Second, those individuals accused of wrongdoing also have a substantial privacy interest
in their names and addresses not being disclosed. The Consumer Sentinel database contains
allegations of illegal conduct, and there is no filter for weeding out the legitimate complaints
from those completely lacking in a factual or legal basis. Yet, by having one’s personal
information included in a complaint, that person is both accused of an illegal activity and
associated with a federal agency’s crime enforcement effort. Cf. Fund for Constitutional Gov’t
v. Nat’l Archives & Records Serv., 485 F. Supp. 1, 6 (D.D.C. 1978) (“An individual does not lose
his right to privacy simply because he has been investigated and subsequently not charged with
any offense. Indeed, such an individual may require even greater protection, especially where …
the mere connection of an individual’s name with a well-known investigation may be both
embarrassing and damaging.”). If an individual is identified through his or her personal
information, the release of such information may result in economic and physical danger to the
accused, as well as potential embarrassment and harassment. See Island Film, S.A. v. Dep’t of
23
Treasury, 869 F. Supp. 2d 123, 136 (D.D.C. 2012) (noting that “whether individuals have a
privacy interest in their names and addresses under Exemption 6 depends on the context and
anticipated consequences of disclosure”) (citing Morley v. CIA, 508 F.3d 1108, 1128 (D.C. Cir.
2007)).
Though unintentionally, Plaintiffs demonstrate the potential for abusing personal
identifying information because one of their four “public” benefits for releasing information in
the Count I data fields is to convert the Consumer Sentinel database into a consumer review tool
akin to “Yelp.com.” 7 Specifically, Plaintiffs suggest that “[d]isclosure of the Company
Information Fields would permit the public (including the Plaintiffs) to quickly and efficiently
review complaints that have been submitted about entities with which they, or their clients, may
do business in order to form an educated opinion concerning those entities’ business practices.”
Pls.’ Mem. Opp’n Def.’s Mot. Summ. J. at 25 (citing Am. Compl. ¶ 56). This proposed benefit,
however, demonstrates the very privacy interest at stake if personal identifying information
about an accused individual wrongdoer is released — namely that people will use this
information to identify the individual and then make judgments and alter their behavior in regard
to the accused based on unverified complaints held by a federal agency. This benefit, moreover,
7
Yelp.com is a website that enables consumers to rate and review businesses and
services, and potential consumers then can read that information before making a purchasing
decision. Plaintiffs’ suggestion that they lack “any interest in using the data obtained to try to
identify complainants” is irrelevant. See Pls.’ Mem. Opp’n Def.’s Mot. Summ. J. at 36. FOIA
itself states that records, if not exempt, must be made “promptly available to any person,” 5
U.S.C. § 552(a)(3) (emphasis added), and the Supreme Court has repeatedly recognized that
FOIA is “clearly intended … to give any member of the public as much right to disclosure as one
with a special interest” in a particular document. U.S. Dep’t of Def. v. FLRA, 510 U.S. 487, 495-
97 (1994) (citations omitted). Thus, “except in certain cases involving claims of privilege, ‘the
identity of the requesting party has no bearing on the merits of his or her FOIA request.’” Id.
(quoting Reporters Comm., 489 U.S. at 771). “Once records are released, nothing in FOIA
prevents the requester from disclosing the information to anyone else. The statute contains no
provisions requiring confidentiality agreements or similar conditions.” Swan v. SEC, 96 F.3d
498, 500 (D.C. Cir. 1996).
24
clearly is not the type recognized under FOIA Exemption 6. Cf. Lurie v. U.S. Dep’t of Army, 970
F. Supp. 19, 35 (D.D.C. 1997) (“As with FOIA generally, the fundamental question in evaluating
the public interest [under Exemption 6] is whether disclosure would provide a view of the
agency’s activities, thereby revealing what our ‘government is up to.’” (quoting DOJ v.
Reporters Comm. for Freedom of the Press, 489 U.S. 749, 773 (1989)).
Similarly, Plaintiffs also propose that “[d]isclosure of the Company Information Fields
would permit members of the public (e.g., corporations) to quickly and efficiently review
complaints that have been submitted about themselves to help identify potential advertising,
marketing, or privacy practices which may be perceived by others as failing to comply with legal
requirements.” Pls.’ Mem. Opp’n Def.’s Mot. Summ. J. at 25-26 (citing Am. Compl. ¶ 57).
Again, the Court must reject this proposed benefit because, like with the first goal of creating a
private consumer review tool, “the only relevant public interest in the FOIA balancing analysis
[under Exemption 6 is] the extent to which disclosure of the information sought would ‘she[d]
light on an agency’s performance of its statutory duties’ or otherwise let citizens know ‘what
their government is up to.’” 8 U.S. Dep’t of Def. v. FLRA, 510 U.S. 487, 497 (1994) (quoting
Reporters Comm., 489 U.S. at 773). Neither of these purposes sheds any light on the FTC’s
performance, but rather they only serve purely private interests disassociated from monitoring
8
The FTC aptly describes the problems and risks associated with Plaintiffs’
misplaced argument that these are recognizable public interests under Exemption 6:
Plaintiffs’ idea that members of the public and businesses could use complaints in
the Consumer Sentinel as a proxy for a company’s reputation [] is even farther
from a cognizable public interest. That idea would shed no light at all on what the
agency is up to, while at the same time it would encourage gaming the database
by entering false complaints — unverified, that could not be challenged or
removed — against competitors or to punish businesses where a consumer had a
bad experience. The Consumer Sentinel cannot be both an effective law-
enforcement database and a consumer review site.
Def.’s Reply Supp. Mot. Summ. J. at 19 n.12.
25
the agency’s functioning. Cf. Nat’l Archives & Records Admin. v. Favish, 541 U.S. 157, 172
(2004) (“[T]he citizen must show that the public interest sought to be advanced is a significant
one, an interest more specific than having the information for its own sake.”).
The Court also rejects Plaintiffs’ argument that consumers who submit complaints
through the FTC’s website have a reduced expectation of privacy in general. See Pls.’ Mem.
Opp’n Def.’s Mot. Summ. J. at 23-24. The FTC’s online privacy policy states that any
information submitted in connection with a consumer complaint may be provided to “businesses
or individuals in response to … [FOIA] Requests.” As the FTC explains, however, consumers
are not required to click on, read, or agree to the privacy policy in order to file a complaint. See
Tribble Decl. ¶ 15. In addition, individuals accused of misconduct in a complaint never see the
privacy policy in the first place. Yet, even if all parties involved actually read and consented to
the policy, the policy itself represents only a warning, not a waiver of FOIA privacy rights. As
this Court has explained in the context of a similarly phrased privacy clause, parties do “not
waive their privacy rights merely by acknowledging that the information they were providing
could be subject to release” under FOIA. 9 Hill v. U.S. Dep’t of Agric., 77 F. Supp. 2d 6, 8
(D.D.C. 1999). Here, the FTC’s privacy policy “does not say that the government will not
attempt to protect privacy rights by asserting them, and indeed the government is expected to do
so.” Id.; see also Lakin Law Firm, PC v. FTC, 352 F.3d 1122, 1125 (7th Cir. 2003) (stating that
“a warning [on the FTC’s website] that FOIA disclosure ‘may be required by law’ cannot be
construed as a waiver by the consumer of the privacy rights protected by the FOIA”).
9
In Hill, the loan application form stated that “[a]ll information supplied to
Farmers Home Administration (FmHA) by you or your agents in connection with your loan
application may be released to interested third parties, including competitors, without your
knowledge or consent under [FOIA].” Hill, 77 F. Supp. 2d at 8 (alteration in original). The
language therefore is similar to that employed by the FTC here.
26
Next, Plaintiffs offer two additional reasons for releasing the data fields sought in the
complaint, but neither alleged public benefit appears to require the release of personal identifying
information about the victim or the alleged individual wrongdoer. First, Plaintiffs propose that
[d]isclosure of the Company Information Fields would permit the public
(including the Plaintiffs) to monitor the effectiveness of the FTC’s consumer
protection efforts by comparing the FTC’s enforcement initiatives to the volume
and nature of consumer complaints involving the specific entities against which
the FTC brought enforcement action and those entities against which the FTC did
not bring enforcement action.
Pls.’ Mem. Opp’n Def.’s Mot. Summ. J. at 25 (citing Am. Compl. ¶ 53). The Supreme Court,
however, has expressed that a “public interest is not furthered ‘by disclosure of information
about private citizens that is accumulated in various governmental files but that reveals little or
nothing about an agency’s own conduct.’” People for the Am. Way v. Nat’l Park Serv., 503 F.
Supp. 2d 284, 304 (D.D.C. 2007) (quoting Reporters Comm., 489 U.S. at 773). As such, the law
mandates that a nexus exists between the records being sought and the legitimate FOIA public
interest allegedly being furthered. See Barnard v. Dep’t of Homeland Sec., 598 F. Supp. 2d 1, 13
(D.D.C. 2009) (explaining that when “the nexus between the information sought and the asserted
public interest is lacking, the asserted public interests will not outweigh legitimate privacy
interests” (citations omitted)); Seized Prop. Recovery, Corp. v. U.S. Customs & Border Prot.,
502 F. Supp. 2d 50, 59 (D.D.C. 2007) (explaining that “[t]here must be a nexus between the
information that is sought under FOIA and the ability of the public to gain an understanding
about the agency’s operations” (internal citation and quotation marks omitted)).
Here, Plaintiffs provide no explanation for why personal identifying information about
the individuals who file complaints or who are the subjects of complaints while acting in their
personal capacity is required to achieve this goal, rather than simply relying on the non-sensitive
information from the other data fields that the FTC has agreed to release. See Voinche v. FBI,
27
940 F. Supp. 323, 330 (D.D.C. 1996) (finding that Exemption 6 protects from disclosure names
of “private citizens who wrote to government officials” because there was “no reason to believe
that the public will obtain a better understanding of the workings of various agencies by learning
the[ir] identities”). In fact, Plaintiffs’ stated benefit focuses exclusively on “the specific entities
against which the FTC brought enforcement action and those entities against which the FTC did
not bring enforcement action.” Pls.’ Mem. Opp’n Def.’s Mot. Summ. J. at 25 (citing Am.
Compl. ¶ 53) (emphasis added). Given that the Court is grappling with the privacy interests of
individuals accused in their personal capacity, the nexus between the personal identifying
information and the offered public benefit is highly dubious.
A similar analysis compels the Court to arrive at the same conclusion when evaluating
Plaintiffs’ final proposed benefit, which is that
[d]isclosure of the Company Information Fields would permit the public
(including the Plaintiffs) to verify the statistical conclusions published by the FTC
concerning the number and type of complaints filed by consumers relating to
businesses that operate in specific industries…. The public has a particular
interest in verifying the FTC’s statistics across the range of complaint categories
because those statistics are used to gauge the appropriateness of the FTC’s
allocation of resources and, over time, the effectiveness of the FTC’s enforcement
actions.
Pls.’ Mem. Opp’n Def.’s Mot. Summ. J. at 25 (citing Am. Compl. ¶ 54). Though it is generally
true that “matters of substantive law enforcement policy … are properly the subject of public
concern,” Reporters Comm., 489 U.S. at 766 n.18, a nexus still must exist between the
information sought and the public interest to be served. See Barnard, 598 F. Supp. 2d at 13;
Seized Prop. Recovery, 502 F. Supp. 2d at 59. It is not apparent how Plaintiffs’ purpose is
furthered through the release of personal identifying information about the victims or subjects of
complaints given the broad set of information the FTC already has agreed to produce. And once
again, Plaintiffs describe the public benefit as needing information about “complaints filed by
28
consumers relating to businesses that operate in specific industries,” not information about
individuals alleged to be acting in their personal capacity. Pls.’ Mem. Opp’n Def.’s Mot. Summ.
J. at 25 (citing Am. Compl. ¶ 54) (emphasis added). As such, the Court “need not linger over the
balance; something, even a modest privacy interest, outweighs nothing every time.” Horner, 879
F.2d at 879.
But even assuming that personal identifying information somehow furthered Plaintiffs’
third and fourth suggested benefits, the Court must conclude that those benefits do not outweigh
the substantial privacy interest of protecting victims and individuals accused of wrongdoing from
abuse, harassment, and embarrassment given the very real risk of their being identified and the
tenuous connection between their personal information and Plaintiffs’ stated policy goals.
Accordingly, the Court concludes that Exemption 6 applies to the personal identifying
information in the Company Information Fields, and that information therefore must be withheld
under FOIA. See, e.g., Lakin Law Firm, PC v. FTC, 352 F.3d 1122, 1125 (7th Cir. 2003)
(finding that names of individuals who complained to the FTC about billing scams were properly
withheld under Exemption 6 because that information revealed little about the agency’s inner
workings); Gov’t Accountability Project v. U.S. Dep’t of State, 699 F. Supp. 2d 97, 106 (D.D.C.
2010) (finding that names and email addresses were properly withheld under Exemption 6 when
there was a “clear privacy interest” in avoiding disclosure, and such disclosure served no public
purpose).
3. Count II: Complainant Geographic Information Field
In Count II, Plaintiffs allege that the FTC violated FOIA by withholding information in
the Complainant Geographic Information Field, which encompasses a consumer’s five-digit zip
code entered in the “Consumer Address, Zip Code” data field. The FTC, on the other hand,
29
argues that the five-digit zip codes constitute personal identifying information that invokes the
same substantial privacy interests under Exemption 6 as the information in the Company
Information Fields. See Def.’s Mem. Supp. Mot. Summ. J. at 33.
An agency cannot withhold information under Exemption 6 based on the “mere
possibilit[y]” that the release of such information will invade an individual’s privacy interest.
See U.S. Dep’t of Air Force v. Rose, 425 U.S. 352, 378, 381 n.19 (1976) (“The legislative history
is clear that Exemption 6 was directed at threats to privacy interest more palpable than mere
possibilities.”). As the FTC notes, Plaintiffs are receiving many pieces of information about a
particular complaint, and that information, when combined with a consumer’s zip code and the
accused’s own records, might theoretically enable the accused to identify the consumer. See
Def.’s Reply Supp. Mot. Summ. J. at 16. The agency, however, provides no evidence to support
this argument. See, e.g., Def.’s Mem. Supp. Mot. Summ. J. at 33-34 (citing no record evidence
to support summary judgment as to Count II); Def.’s Reply Supp. Mot. Summ. J. at 16 (same).
As the party seeking summary judgment, the FTC bears the initial burden of identifying evidence
that demonstrates the absence of any genuine issue of material fact. See Celotex Corp. v. Catrett,
477 U.S. 317, 323 (1986). Because the agency provides no evidence suggesting that disclosure
of the five-digit zip code actually or potentially affects the likelihood that the complainant will
be identified, the Court cannot conclude that such information implicates a substantial privacy
interest. The Court therefore denies the FTC’s motion for summary judgment as to Count II.
4. Count III: Comment Fields
In response to the FTC’s motion for summary judgment on Count III, Plaintiffs argue that
the Comment Fields do not contain personal identifying information that implicates Exemption
6. The FTC attests, however, that the fields potentially contain exempt information because
30
“[c]onsumers use these fields to explain their story and often include their own or others’
personal information,” including “complaints … in which consumers have entered in the
comment field their own name, address, telephone number, and email address, similar
information for family members or for individuals who are the subject of their complaint, or
other personal information such as their occupation and place of work.” See Stearns Decl. ¶ 28.
For example, based on a random sample of 500 consumer complaints and a larger non-random
sample of 12,620 complaints, “the FTC identified between 12% and 25% of complaints in which
some form of [personal identifying information] may have been accidentally included within the
Comment Fields.” Am. Compl. ¶ 79.
The agency also reviewed a sample set of 600 complaints in the fraud database that
contain “Gmail” addresses, and this examination resulted in 308 redactions of personal
identifying information in the “Complaint Comments” field. See Stearns II Decl. ¶ 18. Further,
a similar review of 151 complaints in the identity theft database required 57 redactions in that
same field. See id. ¶ 22. Though some of this information, such as social security and credit
card numbers, can be automatically redacted by the FTC, see Tribble Decl. ¶ 13, no automated
process exists for capturing all similar information because consumers may transcribe the
sensitive numbers in varying and unpredictable patterns, and other free-form personal identifying
information, such as names and addresses, simply never lends itself to a predictable format that
might allow automated redacting. See id. ¶ 14; Stearns II Decl. ¶ 32 (explaining that credit card
and social security numbers are automatically redacted in the comment fields only if they appear
in a certain format, and other categories of personal identifying information in the comment
fields always require manual review due to unpredictable formatting); see also 5 U.S.C. §
31
552(a)(4)(B) (“[A] court shall accord substantial weight to an affidavit of an agency concerning
the agency’s determination as to technical feasibility under … subsection (b).”).
Having found that the Comment Fields may contain personal identifying information, the
Court further concludes that this information is effectively similar to that found in the Company
Information Fields such that it implicates the same substantial privacy interest because it
likewise can be used to identify the victim or the accused. Thus, applying the same balancing of
interests performed in the context of the Company Information Fields, the Court again finds that
this information must be withheld under Exemption 6.
C. Counts I, II, and III: Denial of Requests for Free-Form Fields Under Exemption 7(C)
The FTC also seeks to withhold the data fields identified in Counts I, II, and III under
FOIA Exemption 7(C), which protects from disclosure information in law enforcement records
that “could reasonably be expected to constitute an unwarranted invasion of personal privacy.” 10
5 U.S.C. § 552(b)(7)(C). Though Exemptions 6 and 7(C) both require agencies and reviewing
courts to undertake the same weighing of interests, the balance under Exemption 7(C) “tilts more
strongly toward nondisclosure” because its “privacy language is broader than the comparable
language in Exemption 6[.]” DOJ v. Reporters Comm. for the Freedom of Press, 489 U.S. 749,
756 (1989). The Supreme Court has explained that these phrasing differences reflect Congress’s
choice to provide “greater protection” to law enforcement materials than to “personnel, medical,
and other similar files.” See id. Thus, the D.C. Circuit consistently has held that Exemption
7(C) “establishes a lower bar for withholding material [than Exemption 6].” ACLU v. DOJ, 655
F.3d 1, 6 (D.C. Cir. 2011); see also Beck v. DOJ, 997 F.2d 1489, 1491 (D.C. Cir. 1993).
10
Just as with Exemption 6, the FTC provides no evidence suggesting that the
consumer zip codes at issue in Count II qualify for protection under Exemption 7(C). The Court
therefore again must deny the FTC judgment on that issue.
32
1. Law Enforcement Records
“To show that … documents were compiled for law enforcement purposes, the [agency]
need only establish a rational nexus between [an] investigation and one of the agency’s law
enforcement duties and a connection between an individual or incident and a possible security
risk or violation of federal law.” Blackwell v. FBI, 646 F.3d 37, 40 (D.C. Cir. 2011) (internal
citations and quotation marks omitted); see also Petrucelli v. DOJ, No. CV 11-1780, 2014 WL
2919285, at *13 (D.D.C. June 27, 2014) (same). Here, the FTC attests that records in the
Consumer Sentinel database are collected and maintained in furtherance of its responsibility to
“prevent persons, partnerships, or corporations … from using unfair methods of competition in
or affecting commerce and unfair or deceptive acts or practices in or affecting commerce.”
Stearns Decl. ¶ 15 (citing 15 U.S.C. § 45(b)); Stearns II Decl. ¶ 4 (“The FTC solicits consumer
complaints of fraud, identity theft, unfair business practices, and Do-Not-Call List violations to
aid in its law enforcement mission.”).
In particular, the FTC explains that the database is used to assist the agency in identifying
subjects for investigations, as well as for tracking the overall number of complaints and the
percentage of law enforcement actions the agency takes targeting the subjects of those
complaints. See Stearns II Decl. ¶ 7. Indeed, it is uncontested that “[c]onsumer complaints
stored in the Consumer Sentinel database have spawned numerous FTC investigations and
enforcement proceedings.” Id. And as further evidence, the FTC shares information compiled in
the database with domestic and international law enforcement partners to enhance and coordinate
interagency investigations. See id. ¶ 4. For these reasons, the Court finds that a sufficient nexus
exists between the Consumer Sentinel database and the FTC’s law enforcement activities such
that the records qualify for purposes of Exemption 7(C).
33
2. Privacy Interests and Balancing
The D.C. Circuit has explained that “[b]ecause Exemption 7(C) provides protection for a
somewhat broader range of privacy interests than Exemption 6, privacy interests cognizable
under Exemption 6 are cognizable under Exemption 7(C).” See Stern v. FBI, 737 F.2d 84, 91
(D.C. Cir. 1984). Thus, having found that privacy interests exist in Counts I and III under
Exemption 6, the Court quickly can conclude that the same interests arise under Exemption 7(C).
Indeed, Exemption 7(C) “takes particular note of the strong interest of individuals, whether they
be suspects, witnesses, or investigators, in not being associated unwarrantedly with alleged
criminal activity.” Dunkelberger v. DOJ, 906 F.2d 779, 781 (D.C. Cir. 1990) (internal quotation
marks omitted); see also Fischer v. DOJ, 596 F. Supp. 2d 34, 47 (D.D.C. 2009) (“The D.C.
Circuit has consistently held that Exemption 7(C) protects the privacy interests of all persons
mentioned in law enforcement records, including investigators, suspects, witnesses, and
informants.”). Accordingly, the privacy interests implicated under Exemption 7(C) in this case
are substantial.
The fields from which Plaintiffs seek information in Counts I and III may contain
personal identifying information about consumers who are victims of an alleged crime, which
also makes those consumers witnesses and informants. These individuals therefore possess the
exact type of substantial privacy interest that Exemption 7(C) aims to protect. See Piper v. DOJ,
374 F. Supp. 2d 73, 78-79 (D.D.C. 2005) (“[I]ndividuals who provide information to the law
enforcement authorities … have a privacy interest and their identities have traditionally been
protected from disclosure by Exemption 7(C).”); Brown v. EPA, 384 F. Supp. 2d 271, 277
(D.D.C. 2005) (stating that “Exemption 7(C) affords broad privacy rights to witnesses and
informants in criminal investigations” (internal citation and quotation marks omitted)).
34
Those individuals who are identified as alleged wrongdoers likewise possess a substantial
privacy interest in their personal identifying information. As the D.C. Circuit has explained,
“individuals have a strong interest in not being associated unwarrantedly with alleged criminal
activity,” and given that the Consumer Sentinel database contains unsubstantiated and
unscreened allegations, there is no way of knowing whether the wrongdoer is correctly or
incorrectly being attached to such unseemly conduct. See Stern, 737 F.2d at 91-92; see also Bast
v. DOJ, 665 F.2d 1251, 1254 (D.C. Cir. 1981) (explaining that Exemption 7(C) “recognize[s] the
stigma potentially associated with law enforcement investigations and affords broader privacy
rights to suspects, witnesses, and investigators”); Salas v. Office of Inspector Gen., 577 F. Supp.
2d 105, 111 (D.D.C. 2008) (“Exemption 7(C) recognizes that the stigma of being associated with
any law enforcement investigation affords broad privacy rights to those who are connected in
any way with such an investigation unless a significant public interest exists for disclosure.”).
The Court therefore finds that not only are the same privacy interests implicated by the data
fields in Counts I and III as under Exemption 6, those interests actually are even stronger in the
context of Exemption 7(C).
Finally, because it is the interest of the general public, and not that of the private litigant,
that the Court must consider, “the only public interest relevant for purposes of Exemption 7(C) is
one that focuses on ‘the citizens’ right to be informed about what their government is up to.’”
Davis v. DOJ, 968 F.2d 1276, 1282 (D.C. Cir. 1992) (quoting DOJ v. Reporters Comm. for
Freedom of the Press, 489 U.S. 749, 773 (1989)). And given that Exemption 7(C)’s equilibrium
is not “tilted emphatically in favor of disclosure” like under Exemption 6, see Bast, 665 F.2d at
1254, the Court concludes that, for similar considerations as were discussed above in the context
of Exemption 6, the privacy interests at stake easily outweigh the limited public benefits of
35
disclosure offered by Plaintiffs. The Court therefore finds that Exemption 7(C) also requires
withholding the personal identifying information in the data fields sought through Counts I and
III.
D. The FTC Is Not Required to Segregate Exempt Information Given the Burden of
Manual Review and Goal of Protecting Privacy Interests
At this point, the Court has concluded that the data fields sought through Counts I and III
potentially contain personal identifying information that is exempt from disclosure under FOIA
Exemptions 6 and 7(C). Next, FOIA requires that “[a]ny reasonably segregable portion of a
record shall be provided to any person requesting such record after deletion of the portions which
are exempt under this subsection.” 5 U.S.C. § 552(b)(9). An agency, however, need not
segregate exempt information if the non-exempt portion is “inextricably intertwined with exempt
portions.” Mead Data Cent., Inc. v. U.S. Dep’t of Air Force, 566 F.2d 242, 260 (D.C. Cir. 1977).
At the same time, the agency is not required to comply with a request that is “so broad as to
impose an unreasonable burden upon the agency,” such as one that “require[s] the agency to
locate, review, redact, and arrange for inspection a vast quantity of material.” Am. Fed’n of
Gov’t Emps., Local 2782 v. U.S. Dep’t of Commerce, 907 F.2d 203, 209 (D.C. Cir. 1990).
As the D.C. Circuit has explained, when an agency claims that complying with a request
is unreasonable, it bears the burden to “provide [a] sufficient explanation as to why such a search
would be unreasonably burdensome.” Nation Magazine v. U.S. Customs Serv., 71 F.3d 885, 892
(D.C. Cir. 1995); Pub. Citizen, Inc. v. U.S. Dep’t of Educ., 292 F. Supp. 2d 1, 6 (D.D.C. 2003).
To make this determination, a court may rely on agency affidavits or declarations that show with
reasonable specificity why documents withheld pursuant to a valid exemption cannot be further
segregated. See Armstrong v. Exec. Office of the President, 97 F.3d 575, 578 (D.C. Cir. 1996);
36
see also Thompson v. Exec. Office for U.S. Attorneys, 587 F. Supp. 2d 202, 207-08 (D.D.C.
2008) (explaining that when considering “whether nonexempt information could have been
segregated from exempt information and released,” courts may rely on an agency affidavit if it
“provides a sufficient description of the documents and a sufficient explanation of the basis for
withholding”). Ultimately, the agency is entitled to the presumption that it complied with the
requirement to segregate non-exempt materials. See Hodge v. FBI, 703 F.3d 575, 582 (D.C. Cir.
2013) (citing Sussman v. U.S. Marshals Serv., 494 F.3d 1106, 1117 (D.C. Cir. 2007)).
Though some personal identifying information can be automatically redacted, such as
certain social security and credit card numbers assuming they are in the proper formats, it is
uncontested that the remaining information requires a manual review to redact the material
protected by Exemptions 6 and 7(C). See id. ¶ 34 & Ex. J; Tribble Decl. ¶¶ 13-14; Stearns II
Decl. ¶ 32. The FTC estimates that completing the manual redaction process for the withheld
data fields across all twenty million Consumer Sentinel database complaints would take more
than 8,000 hours. 11 See Stearns Decl. ¶ 22. Plaintiffs do not object to the FTC’s estimate about
the amount of labor needed to perform this manual review, see Pls.’ Resp. Def.’s Stmt. Facts ¶
12, nor do Plaintiffs provide an argument suggesting that the estimated 8,000 hours of labor does
not constitute an undue burden on the agency. Cf. Vietnam Veterans of Am. Conn. Greater
Hartford Chapter 120 v. U.S. Dep’t of Homeland Sec., No. 3:10CV1972, 2014 WL 1284970, at
*4-5 (D. Conn. Mar. 31, 2014) (finding that plaintiff’s FOIA request posed an unreasonable
burden on the agency to review and redact personal identifying information from approximately
11
The FTC does not provide a separate estimate for reviewing only the data in
Counts I and III, given that the Court has denied the agency’s motion as to the zip code field in
Count II. The Court, however, finds no reason to expect that removing the need to review the
single Count II data field would materially affect the agency’s burden in responding to Plaintiffs’
requests.
37
26,000 records because doing so would take an estimated twenty-seven years); Hainey v. U.S.
Dep’t of Interior, 925 F. Supp. 2d 34, 45 (D.D.C. 2013) (granting summary judgment for the
agency when responding to FOIA request would “require a search of every email sent or
received by 25 different employees throughout a two-year time period,” and the agency also
“would need to individually review each potentially responsive email to confirm its
releasability”).
Accordingly, based on the FTC’s “explanation as to why such a search would be
unreasonably burdensome,” Nation Magazine, 71 F.3d at 892, and absent any contrary argument
on Plaintiffs’ part, the Court must conclude that performing a manual review of the Consumer
Sentinel database complaints for exempt personal identifying information would impose an
unreasonable burden on the FTC well beyond what FOIA requires from an agency. Such a
conclusion, however, only begs the question of whether the Court should find that manual review
is required in the first place.
Resolving this question requires a different burden and segregation analysis than is
ordinarily performed in a FOIA case. Typically, courts discuss the agency’s burden and the
feasibility of segregating exemption information in the context of the agency’s ability to identify
the universe of records relevant to a request, see, e.g., Defenders of Wildlife v. U.S. Border
Patrol, 623 F. Supp. 2d 83, 91 (D.D.C. 2009) (analyzing the adequacy of the agency’s search for
relevant records), the physical difficulty of segregating exempt information within the relevant
records, see, e.g., Int’l Counsel Bureau v. U.S. Dep’t of Def., 864 F. Supp. 2d 101, 106–107
(D.D.C. 2012) (ordering in camera review of videos to determine potential segregability), or the
challenge of determining whether the exempt information is so intertwined with non-exempt
information that removing the exempt information leaves nothing of value left in the record, see,
38
e.g., Mays v. DEA, 234 F.3d 1324, 1327 (D.C. Cir. 2000) (approving of withholding entire grand
jury transcript because “the excision of exempt information would … produce an edited
document with little informational value”).
Here, the FTC does not argue that it cannot search for and retrieve the Consumer Sentinel
database records, that it cannot physically segregate exempt information, or that making
redactions would result in records with no remaining informational value. Instead, the agency’s
argument for non-disclosure focuses only on the burden of manually identifying and redacting
the exempt information across the already retrieved twenty million responsive records within the
Consumer Sentinel database. See Stearns Decl. ¶¶ 20-22. Thus, based on the unique facts of this
case, the question before the Court becomes whether the FTC can withhold the entire universe of
information contained in the data fields when only a small percentage of that information is
exempt but redacting the exempt information requires an unreasonably burdensome manual
review.
If Plaintiffs sought a smaller, more manageable universe of records and not the twenty
million complaints in the Consumer Sentinel database, the solution might be simple: the Court
could order the FTC to expend a reasonable amount of resources to identify and redact the
exempt personal information from each complaint. The facts and equities of this case, however,
compel the Court to conclude that the FTC properly withheld the entire universe of information
given the burden of removing the subset of exempt information. Specifically, the FTC is
attempting to protect the privacy interests of third-party citizens by preventing the disclosure of
their personal identifying information, including some citizens who had no control over the FTC
possessing their information in the first place. This is not a situation in which an agency seeks to
protect its own potentially confidential information — such as agency information covered by
39
the deliberative process privilege — by withholding a substantially broader set of information
that does not contain privileged information. Indeed, if that was the case, the Court might
require the FTC to decide between performing the burdensome manual review or producing its
privileged information unredacted, rather than allowing the blanket withholding of information
that otherwise would serve a legitimate public interest. 12 But here, because the agency aims to
protect the private information of citizens by withholding the data fields at issue, and because the
manual review needed for redacting such information is unreasonably burdensome, the Court
concludes that the FTC properly withheld the data fields under Exemptions 6 and 7(C).
E. Plaintiffs’ Motion for Partial Summary Judgment: Segregating Complaints Submitted
through the FTC’s Telephone Line
Plaintiffs move for partial summary judgment with respect to the Consumer Sentinel
database complaints that were received by the FTC through its telephone complaint line and then
memorialized by the telephone operator. See generally Pls.’ Mem. Supp. Part. Mot. Summ. J. In
doing so, Plaintiffs argue that because the phone operators are trained to enter information in the
correct data fields and to avoid inserting “sensitive” consumer information, there is no plausible
reason to believe that a privacy interest is implicated by the over-the-phone complaints such that
manual review is required. See id. at 3. In response, the FTC argues that even if the operators
never make mistakes, consumers still give personal identifying information about other private
individuals, such as witnesses and the accused, when they complain to the FTC, and the
operators correctly enter this information into the Company Information Fields and Comments
Fields. See Def.’s Reply Supp. Mot. Summ. J. at 3. As such, the agency maintains that like with
12
Of course, if the agency’s own information involved other hypothetical interests,
such as national security interests, the Court would face a different inquiry.
40
complaints filed through the FTC’s website, manual review is required to redact the exempt
information.
The FTC provides evidence that within the sample of 600 complaints with a “Gmail”
address in the “Company Email” field, 89 complaints originated through a telephone call to the
agency, and 78 of those complaints (88%) contained personal identifying information in the
fields Plaintiffs seek through Counts I and III, such as the “Company” fields, fields labeled for
“Associated Institution” or “Suspect Alias,” and the “Comment” fields. See Stearns II Decl. ¶
19; Tribble Decl. ¶ 9. Such information does not occur because the operators make mistakes, but
rather because consumers intentionally report misconduct involving individuals in their personal
capacity, just as consumers do when submitting complaints on the FTC’s website. See Tribble
Decl. ¶ 9. Indeed, the Consumer Sentinel database does not separate complaints about
individuals from complaints about companies, so telephone operators must enter all complaints
into the fields labeled for alleged corporate wrongdoers. See id.
In addition, Plaintiffs’ focus on the lack of “sensitive” information, such as social
security or credit card numbers, in the Comments Fields is misplaced because Exemptions 6 and
7(C) impose no requirement that the information be especially sensitive or private. See Pls.’
Mem. Opp’n Def.’s Mot. Summ. J. at 41-42. Rather, the only question is whether a privacy
interest is at stake, and as the Court explained above, the personal identifying information
contained in certain data fields implicates such privacy interests. Thus, though it is true that FTC
operators are trained not to enter “sensitive” information, see Tribble Decl. ¶ 9, that fact alone is
irrelevant for purposes of this discussion. Instead, the Court finds that complaints received
through the FTC’s telephone line may contain personal identifying information about alleged
individual wrongdoers to the same degree as complaints filed on the FTC’s website. The Court
41
therefore denies Plaintiffs’ motion for summary judgment as to Counts I and III. Finally, the
Court already has held that the FTC failed to demonstrate that the five-digit zip codes in Count II
must be withheld, so it need not address the issue again here.
F. Withholding Complaints from Foreign Sources under Exemption 3
The FTC invokes FOIA Exemption 3, in conjunction with Section 21(f) of the FTC Act,
see 15 U.S.C. § 57b-2(f)(2)(A)(i) & (ii), to categorically withhold entire complaints provided by
the Canadian Anti-Fraud Centre or furnished through the Ecommerce.gov website. See Def.’s
Mem. Supp. Mot. Summ. J. at 37. FOIA Exemption 3 permits agencies to withhold documents
pursuant to nondisclosure provisions contained in other federal statutes. See 5 U.S.C. §
552(b)(3). The federal statute must require that the information be withheld from the public in
such a way as to leave no discretion on the issue, or it must establish particular criteria for
withholding or refer to specific types of matters to be withheld. See id. “In deciding Exemption
3 applicability, ‘the sole issue for decision is the existence of a relevant statute and the inclusion
of withheld material within that statute’s coverage.’” Carter, Fullerton & Hayes, LLC v. FTC,
637 F. Supp. 2d 1, 10 (D.D.C. 2009) (quoting Goland v. CIA, 607 F.2d 339, 350 (D.C. Cir.
1978)). In addition, the FTC attests, and Plaintiffs do not dispute, that the Canadian Anti-Fraud
Centre and Ecommerce.gov complaints can be segregated from other Consumer Sentinel
database complaints without an unreasonable burden by using custom search filters. See Stearns
Decl. ¶ 20.
Section 21(f), Subsection (i) of the FTC Act provides that the agency is not required to
disclose under FOIA “any material obtained from a foreign law enforcement agency or other
foreign government agency, if the foreign law enforcement agency or other foreign government
agency has requested confidential treatment, or has precluded such disclosure under other use
42
limitations, as a condition of providing the material.” 15 U.S.C. § 57b-2(f)(2)(A)(i). Here, the
FTC seeks to categorically withhold complaints that were provided by the Canadian Anti-Fraud
Centre, which is a Canadian law enforcement agency. See Stearns Decl. ¶ 18. The FTC permits
the Canadian Anti-Fraud Centre to access existing complaints and to submit new complaints into
the database pursuant to the “Consumer Sentinel Network Confidentiality and Data Security
Agreement.” See id.
This confidentiality agreement provides that “[a]ll parties participating in the information
exchange system do so with the understanding that all Consumer Sentinel [database]
information, including all information available on the Consumer Sentinel [database]’s restricted
website, will be kept confidential.” Stearns II Decl., Ex. B. ¶ 5. In addition, under the agreement
the FTC agrees that
[e]xcept as authorized by law, … the information contained in the Consumer
Sentinel [database] will not be released to anyone other than participating
agencies and other entities as delineated in this agreement, and to employees of
and consultants and contractors of such entities and of the FTC with a need to
know such information.
Id. ¶ 7. Plaintiffs, relying on the “except as authorized by law” language, argue that the
agreement does not require the FTC to keep information confidential in all circumstances.
Though perhaps true, Plaintiffs’ argument fails because Subsection (i) does not require
mandatory confidentiality in all circumstances; instead, the statute permits withholding records
whenever the foreign agency “has requested confidential treatment.” 15 U.S.C. § 57b-
2(f)(2)(A)(i). Thus, given the unambiguous language of the agreement, the Court finds that the
Canadian Anti-Fraud Centre indeed has requested such treatment. Accordingly, the Court grants
summary judgment for the FTC on the basis that consumer complaints provided by the Canadian
Anti-Fraud Centre must be withheld under Exemption 3.
43
The FTC also argues that complaints in the Consumer Sentinel database which were
derived through the Ecommerce.gov website are protected from disclosure under Exemption 3
and Section 21(f) of the FTC Act. See Def.’s Mem. Supp. Mot. Summ. J. at 38. Specifically,
Section 21(f), Subsection (iii) provides that in response to a FOIA request, the FTC is not
required to disclose “any material reflecting a consumer complaint submitted to a Commission
reporting mechanism sponsored in part by foreign law enforcement agencies or other foreign
government agencies.” 15 U.S.C. § 57b-2(f)(2)(A)(iii). In response, Plaintiffs concede that
Ecommerce.gov is a joint international effort for gathering consumer complaints, and as such,
those complaints must be withheld under Exemption 3. See Pls.’ Mem. Opp’n Def.’s Mot.
Summ. J. at 42. Accordingly, the Court grants summary judgment for the FTC on this issue.
G. Count IV: Reasonableness of Cost Estimates for Processing FOIA Requests
During the course of Plaintiffs’ three FOIA requests, the FTC provided four cost
estimates for processing information contained in the granted data fields across the twenty
million complaints in the Consumer Sentinel database:
Table 7
Number of Fields Estimated Estimated
Date of Estimate Source
Requested Time Cost
Rushen Decl. ¶ 6; Stearns Decl.
April 25, 2013 17 data fields 32 hours $3,982.40
¶ 9 & Ex. C
May 6, 2013 33 data fields Unknown $4,978 AR at 12-14
Rushen Decl. ¶ 10; Stearns
September 9, 2013 20 data fields 65 hours $8,581.95
Decl., Ex. K; AR at 195
Rushen Decl. ¶¶ 11-12; Stearns
September 18, 2013 11 data fields 65 hours $8,581.95
Decl., Exs. R, S; AR at 211
In Count IV, Plaintiffs contend that the agency’s estimates appear disproportionate to the effort
necessary to locate and process the data, see Am. Compl. ¶ 95, and they suggest that the
estimates are facially unreasonable because there is no correlation between the price quote and
the quantity of information being processed. See Pls.’ Mem. Opp’n Def.’s Mot. Summ. J. at 46-
44
47. The FTC moves for summary judgment on the basis that its cost estimates were reasonable
given the scope of Plaintiffs’ requests. See Def.’s Mem. Supp. Mot. Summ. J. at 39-41.
1. Plaintiffs’ Evidentiary Objection
Before reaching the merits of the FTC’s motion, the Court must address Plaintiffs’
evidentiary objection to the declarations provided by the FTC in defense of its cost estimates.
See Pls.’ Mem. Opp’n Def.’s Mot. Summ. J. at 48. Rule 56 allows a party opposing summary
judgment to “object that the material cited to support or dispute a fact cannot be presented in a
form that would be admissible in evidence.” Fed. R. Civ. P. 56(c)(2); Ali v. D.C. Gov’t, 810 F.
Supp. 2d 78, 83 (D.D.C. 2011). At the summary judgment stage, a party is not required to
produce evidence in a form that is admissible, but rather the evidence must be capable of being
converted into admissible evidence at trial. See Gleklen v. Democratic Cong. Campaign Comm.,
Inc., 199 F.3d 1365, 1369 (D.C. Cir. 2000); see also Richards v. Option One Mortg., No. 08 Civ.
0007, 2009 WL 2751831, at *1 n.3 (D.D.C. 2009) (explaining that hearsay statements may be
converted into admissible evidence if a witness with personal knowledge can testify to them at
trial). Thus, hearsay “counts for nothing” when used to support or oppose a motion for summary
judgment, unless it satisfies the evidentiary standard of Rule 56. See Gleklen, 199 F.3d at 1369.
Here, Plaintiffs object to the FTC’s use of the Stearns and Rushen declarations as
evidence to demonstrate the reasonableness of the September 9 and September 18, 2013, cost
estimates from Lockheed Martin. See Pls.’ Mem. Opp’n Def.’s Mot. Summ. J. at 48.
Specifically, Plaintiffs argue that the FTC only attached to the declarations emails in which a
different FTC employee reports to the declarant about his communication with the contractor, as
opposed attaching an email showing the employee’s direct communication with the contractor
45
itself. See Rushen Decl. ¶¶ 10-12 (citing Stearns Decl., Exs. K, R, S). Plaintiffs therefore assert
that the declarations rely on hearsay as the basis of their information.
In Barnard v. U.S. Department of Homeland Security, the plaintiff made a similar
argument for excluding certain statements as inadmissible hearsay because the declarants were
told information, rather than obtaining the information from their own review of relevant
documents. See 598 F. Supp. 2d 1, 19 (D.D.C. 2009). The Court rejected this argument because
“FOIA declarants may include statements in their declarations based on information they have
obtained in the course of their official duties.” Id. (citations omitted); see also, e.g., Thompson v.
Exec. Office for U.S. Attorneys, 587 F. Supp. 2d 202, 208 n.4 (D.D.C. 2008) (finding declaration
admissible when it was based on an individual’s “review of [the defendant-agency’s] official
files and records, [her] own personal knowledge, and the information [she] acquired in
performing her official duties”); Hornes v. Exec. Office for U.S. Attorneys, No. 04-2190, 2007
WL 1322088 at *4 (D.D.C. May 4, 2007) (“[The declarant’s] statements are based on his
personal knowledge, his review of [the agency’s] official files and records and information that
he acquired in performing [his] official duties…. Declarations provided by similarly situated
officials have long been recognized as acceptable in FOIA cases.” (internal citation and
quotation marks omitted)).
Stearns and Rushen clearly attest that the statements in the declarations are based on
personal knowledge acquired through the performance of their official duties with the FTC. See
Stearns Decl. ¶ 2; Rushen Decl. ¶ 1. Indeed, the internal FTC correspondences regarding the
contractor’s cost estimates, which are attached to the Stearns declaration, demonstrate as much.
See Stearns Decl., Exs. K, R, S. Accordingly, the Court denies Plaintiffs’ hearsay objection
because the declarations satisfy the requirements of FOIA and Rule 56.
46
2. Reasonableness of the Cost Estimate
Generally, a FOIA requester must pay reasonable costs for the search, review, and
duplication of the records it seeks. See 5 U.S.C. § 552(4)(A)(ii)(I); Judicial Watch, Inc. v. U.S.
Dep’t of Transp., No. CIV. 02-566, 2005 WL 1606915, at *3 (D.D.C. July 7, 2005). “A
plaintiff’s bare allegation that a fee assessment is unreasonable, however, is insufficient to avoid
summary judgment.” Hall & Assocs. v. EPA, No. CV 13-830, 2014 WL 400677, at *4 (D.D.C.
Feb. 4, 2014) (citing Nat’l Treas. Empl. Union v. Griffin, 811 F.2d 644, 650 (D.C. Cir. 1987)).
Instead, a plaintiff must offer “specific analysis” to demonstrate that the requested fees are
unreasonable. Rosenberg v. U.S. Dep’t of Immigration & Customs Enforcement, 954 F. Supp. 2d
1, 12 (D.D.C. 2013).
Plaintiffs attempt to demonstrate the unreasonableness of the cost estimates through the
lack of correlation between the number of fields to be processed in response to a specific request
and the estimated cost of producing the data. See Pls.’ Mem. Opp’n Def.’s Mot. Summ. J. at 47.
As Table 7, supra, illustrates, it is true that a decrease in the number of fields requested did not
always result in a corresponding decrease in the estimated processing cost. For example, the
contractor provided the same estimate for the September 9 request that involved twenty data
fields as it did for the September 18 request that included eleven data fields. See Tbl. 7, supra.
Plaintiffs, however, provide no explanation suggesting why the processing cost must
directly correlate with the quantity of data fields to be produced. Though such a relationship
may appear plausible, it is just as likely that other factors remain in play which prevent a direct
correlation between the number of data fields and the processing cost. But even more fatally,
Plaintiffs offer no evidence to support their theory, and it is well established that a lawyer’s
argument does not substitute for admissible evidence in opposition to a summary judgment
47
motion. See Tom Sawyer Prods., Inc. v. Progressive Partners Achieving Solutions, Inc., 550 F.
Supp. 2d 23, 29 (D.D.C. 2008). Thus, not only do Plaintiffs fail to offer “specific analysis … to
demonstrate [that] the requested fees are unreasonable,” Rosenberg, 954 F. Supp. 2d at 12, they
provide no admissible evidence rebutting the FTC’s motion for summary judgment. See Johnson
v. Digital Equip. Corp., 836 F. Supp. 14, 15 (D.D.C. 1993) (explaining that speculation or bald
allegations in the absence of actual evidence is insufficient to defeat a summary judgment
motion); see also Int’l Distrb. Corp. v. Am. Dist. Tel. Co., 569 F.2d 136, 139 (D.C. Cir. 1977)
(“[A] party may not avoid summary judgment by mere allegations unsupported by affidavit.”).
Accordingly, the Court grants summary judgment for the FTC on Count IV. 13
V. CONCLUSION
For the foregoing reasons, the FTC’s motion is GRANTED IN PART AND DENIED
IN PART, and Plaintiffs’ motion is DENIED. An order consistent with this Memorandum
Opinion is separately and contemporaneously issued.
Dated: September 30, 2014 RUDOLPH CONTRERAS
United States District Judge
13
The FTC notes that Plaintiffs challenge cost estimates that were not subject to the
administrative appeals process. See Def.’s Reply Supp. Mot. Summ. J. at 22 n.16. But because
the Court finds that Plaintiffs have not demonstrated the unreasonableness of any quote, the
FTC’s argument is moot.
48