Center for Digital Democracy v. Federal Trade Commission

UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLUMBIA
_________________________________________
)
Center for Digital Democracy, )
)
Plaintiff, )
)
v. ) Civil No. 14-cv-02084 (APM)
)
Federal Trade Commission, )
)
Defendant. )
_________________________________________ )
MEMORANDUM OPINION
I. INTRODUCTION
Under the Children’s Online Privacy Protection Act of 1998, Congress tasked the Federal
Trade Commission (“FTC”) with issuing and enforcing regulations designed to protect the online
privacy and safety of children. To carry out its statutory mandate, the FTC issued what is known
as the Children’s Online Privacy Protection Rule, or the “COPPA Rule.” The COPPA Rule
imposes upon both online services and individual websites directed at children requirements
concerning the collection, use, and disclosure of personal information regarding children under the
age of 13. Although the FTC crafted the COPPA Rule, under the Privacy Protection Act’s
regulatory scheme, the Rule itself is primarily enforced not by the FTC but by private entities
known as “safe harbor programs.” These safe harbor programs, which the FTC must review and
approve, design their own rules—which must be at least as robust as the COPPA Rule—and then
work to ensure that the program’s subscribers (online services and websites directed at children,
who pay the program a fee) comply with those rules.
In 2014, the FTC began requiring safe harbor programs to submit annual reports to the
agency. The reports, generally speaking, are required to contain information concerning each safe
harbor program’s monitoring and enforcement of their members. However, due to a lack of clarity
in the FTC’s rules regarding what the reports must include, the 2014 reports varied dramatically
in terms of the information and data provided.
Plaintiff Center for Digital Democracy brought this suit against the FTC under the Freedom
of Information Act (“FOIA”) to obtain access to the first round of annual reports. The FTC
disclosed the annual reports to Plaintiff, but in redacted form. According to the FTC, the redactions
were necessary to protect the programs’ trade secrets or non-public commercial or financial
information. The dispute in this case centers on whether the FTC redacted the reports consistent
with FOIA.
Before the court is Defendant’s Motion for Summary Judgment and Plaintiff’s Cross-
Motion for Summary Judgment. Upon consideration of the parties’ submissions and the record,
the court grants Defendant FTC’s Motion for Summary Judgment and denies Plaintiff’s Cross-
Motion for Summary Judgment.
II. BACKGROUND
A. Factual Background
1. COPPA and FTC Enforcement
In 1998, Congress enacted the Children’s Online Privacy Protection Act (“COPPA”),
15 U.S.C. §§ 6501-6506, in order to protect children under 13 years of age who use the Internet.
The statute imposed certain requirements on operators of websites and online services directed at
young children, and instructed the FTC to issue and enforce regulations implementing the statute.
15 U.S.C. § 6502(b); Def.’s Statement of Material Facts, ECF No. 6 [hereinafter Def.’s Facts], ¶
2
1. To carry out Congress’ directive, the FTC issued the COPPA Rule, which applies to “any
operator of a Web site or online service directed to children, or any operator that has actual
knowledge that it is collecting or maintaining personal information from a child.” 16 C.F.R.
§ 312.3. The COPPA Rule requires, among other things, that such websites and online services
provide specific notice about the personal information they collect from children, how they use it,
and their practices for disclosing it; obtain parental consent before collecting, using, or disclosing
personal information from children; and establish procedures to protect the confidentiality and
security of personal information collected from children. 16 C.F.R. §§ 312.3, 312.4-312.8. The
FTC may bring enforcement actions against persons or operators who fail to comply with the
COPPA Rule. See 15 U.S.C. §§ 6502(c), 6505(a) & (d).
2. Safe Harbor Programs
Although Congress left it to the FTC to develop rules to implement COPPA, in a rather
unique regulatory scheme, it largely left the enforcement of those rules to private industry. The
COPPA statute provides that operators of websites and online services directed at young children
can comply with the statute “by following a set of self-regulatory guidelines, issued by
representatives of the marketing or online industries or by other persons.” 15 U.S.C. § 6503(a);
see also 16 C.F.R. § 312.11(g). Issuers of these guidelines are known as “safe harbor programs.”
16 C.F.R. § 312.11.
Congress adopted this “self-regulation” model to “develop[] an industry consensus on the
appropriate level of protection to accord children’s privacy on commercial Internet sites” and to
“encourage development and implementation of meaningful, effective self-regulatory activities
and to provide basis for their wide-spread adoption.” S. 2326, Children’s Online Privacy
Protection Act of 1998: Hearing Before the S. Subcomm. on Communications of the S. Comm. On
3
Commerce, Science, and Transportation, 105th Cong. 11 (1998) (statement of Robert Pitofsky,
Chairman, FTC). By allowing enforcement through safe harbor programs instead of through direct
federal agency oversight, “Congress intended to . . . promot[e] efficiency and flexibility in
complying with COPPA’s substantive provisions.” Children’s Online Privacy Protection Rule,
Final Rule Amendments, 78 Fed. Reg. 3,995-3,996 (Jan. 17, 2013). The FTC similarly has
explained that the safe harbor program was meant to serve as an “incentive for industry self-
regulation; by allowing flexibility in the development of self-regulatory guidelines, it ensures that
the protections afforded children under this Rule are implemented in a manner that takes into
account industry-specific concerns and technological developments.” Children's Online Privacy
Protection Rule, 1999 Statement of Basis and Purpose, 64 Fed. Reg. 59,906 (Nov. 3, 1999).
Safe harbor programs must be approved by the FTC. The FTC will approve a safe harbor
program only after a public notice and comment period and upon a finding that the safe harbor
program’s self-regulatory guidelines “meet the requirements” of the COPPA Rule. 15 U.S.C.
§ 6503(b)(2). Specifically, a safe harbor program must: (1) “provide substantially the same or
greater protections for children” as the COPPA Rule; (2) implement “[a]n effective, mandatory
mechanism for the independent assessment” of operators’ compliance that includes “a
comprehensive review” of each operators’ “information policies, practices, and representations”;
and (3) impose “[d]isciplinary actions for subject operators’ non-compliance with self-regulatory
program guidelines.” 16 C.F.R. § 312.11(b); Def.’s Facts, ECF No. 6, ¶ 2; Plaintiff’s Statement
of Material Facts Not in Dispute and Response to Defendant’s Statement of Facts Not in Dispute,
ECF No. 10-7 [hereinafter Pl.’s Facts], ¶ 1. Once the FTC approves a safe harbor program,
operators of websites and online services covered by COPPA can subscribe to it. By complying
with the program’s guidelines, the operator or website will be in compliance with the COPPA
4
Rule. Def.’s Mot. for Summ. J., ECF No. 6 [hereinafter Def’s Mot.], Ex. J, Decl. of Kandi Parsons,
ECF No. 6-2 [hereinafter Parsons Decl.] ¶ 3.
Safe harbor programs operate in a competitive market. Id. ¶ 6. They receive fees from
subscribers and compete against one another to increase their subscriber base. Id. Each program
attempts to distinguish itself from its competitors in a number of ways, including: (1) the strength
of its privacy protections; (2) the compliance guidance it provides; (3) the sophistication and
reliability of its privacy oversight technology; (4) the effectiveness of its approved parental consent
methods; (5) its ability to resolve compliance issues; and (6) the trust its generates among parents
of children who use the member websites or online services. Id.; Def.’s Facts ¶ 4; Pl.’s Facts ¶ 4.
Many of the safe harbor programs offer a seal or certificate that members can display on their
website to show that they belong to the program and are in compliance with COPPA. Parsons
Decl. ¶ 7. A seal also may signify compliance with rules and guarantees specific to a particular
safe harbor program. Safe harbor programs use these distinctive features to attract business. Id. ¶
8.
At the time this action was filed, the FTC had approved seven safe harbor programs.
Pl.’s Mot. for Summ. J., ECF No. 10 [hereinafter Pl.’s Mot.], at 3; Parsons Decl. ¶ 5. They are:
Aristotle, the Children’s Advertising Review Unit (“CARU”), the Entertainment Software Rating
Board (“ESRB”), iKeepSafe, kidSafe Seal Program (“kidSAFE”), Privacy Vaults Online
(“PRIVO”), and True Ultimate Standards Everywhere (“TRUSTe”). Parsons Decl. ¶ 5.
3. Annual Reports
In 2013, the FTC amended the COPPA Rule to require that safe harbor programs submit
annual reports to the agency. Children’s Online Privacy Protection Rule, Final Rule Amendments,
78 Fed. Reg. 3,972, 3,995-3,996 (Jan. 17, 2013). The FTC adopted the annual report filing
5
requirement to “better ensure that all safe harbor programs keep sufficient records and that the
Commission is routinely apprised of key information about the safe harbors’ programs and
membership oversight.” Id. at 4002. The FTC also viewed the annual reports as a useful means
of “inform[ing] the Commission of the emergence of new feasible parental consent mechanisms
for operators.” Id.An annual report, “at a minimum,” must contain: (1) “an aggregated summary of the
results” of the program’s compliance assessments; (2) “a description of any disciplinary action
taken” against a program’s customer; and (3) a description of the program’s approval of any new
methods for online services to obtain verifiable parental consent, even if such method is not
specified in the COPPA Rule. 16 C.F.R. § 312.11(d)(1); Parsons Decl. ¶ 12. The rule does not
specify what information must be provided in the “aggregated summary” component of the report.
Nor does it require the program to identify its members who were the subject of “any disciplinary
action taken.”
In May 2014, Defendant sent a letter to the safe harbor programs, reminding them of their
annual filing obligation. The letter also made additional disclosure requests, not mandated by the
agency’s regulations. Specifically, the FTC asked for: (1) information about any consumer
complaints alleging that a member had violated the program guidelines and the program’s
responses to such complaints; (2) records from any disciplinary action taken against a member;
(3) confirmation that the program made at least one privacy assessment of each its members within
the last year; and (4) the number of members assessed. Def.’s Facts ¶ 6; Parsons Decl. ¶ 12; Def’s
Mot., Ex. J2, ECF No. 6-2.
The lack of guidance offered by the regulations and reminder letter about the annual
report’s expected contents and format led to a predictable result: the first round of annual reports
6
differed substantially from one another. Def.’s Mot., Decl. of Dione Jackson Stearns, ECF No. 6-
1 [hereinafter Stearns Decl.], ¶ 25 (the reports “did not contain uniform reporting mechanisms”
and “varied considerably in the types of data reported[.]”). For example, kidSAFE’s annual report
contained detailed information about its policies and a summary of the results of all assessment
efforts made by the program, see Def.’s Mot., Ex. G, ECF No. 6-1 at 63,1 while CARU submitted
a mere page and a half of information with very little detail, see id. at 58.
4. Plaintiff’s FOIA Request
On July 2, 2014, Plaintiff Center for Digital Democracy submitted a FOIA request to the
FTC seeking “all annual reports submitted by safe harbor programs as required by” the COPPA
Rule. Compl. ¶ 5; Def.’s Mot., Ex. A, ECF No. 6-1. The FTC’s FOIA Unit then located six annual
reports—one from each approved safe harbor program2—along with two supplemental reports
submitted by the safe harbor program TRUSTe. Def.’s Mot., Ex. I, Decl. of Jonathan William
Hill, ECF No. 6-2 [hereinafter Hill Decl.], ¶ 9. The responsive documents totaled eighty-eight
pages. Def.’s Facts ¶ 9; Hill Decl. ¶ 9. The FOIA Unit determined that the reports contained
“varying amounts of confidential commercial information and voluntary disclosures exceeding the
annual reporting requirements,” Def.’s Facts ¶ 10, and accordingly began the redaction process,
id. ¶ 11.
As a part of the redaction process, the FTC informed all six programs in September 2014
that their annual reports were subject to FOIA disclosure, and requested that each program
comment on a preliminary set of proposed redactions to its respective report. Stearns Decl. ¶¶ 8,
1
Some of the exhibits to Defendant’s Motion for Summary Judgment contain multiple documents. As a result, the
court refers to the ECF page number of the specific cited document.
2
Although there are currently seven FTC-approved safe harbor programs, Plaintiff requested annual reports from only
six programs because the seventh, iKeepSafe, did not gain approval until after the 2014 reporting period had closed
and, therefore, it had not filed an annual report responsive to Plaintiff’s FOIA request. Compl. ¶ 5; Def.’s Facts ¶ 7.
7
27; Def.’s Mot., Ex. D, ECF No. 6-1. Four safe harbor programs responded to the FTC’s request.
Stearns Decl. ¶ 9. In addition, the FOIA Unit consulted with FTC economic and legal experts
about potential redactions. Id.; Def.’s Facts ¶ 13. Based upon the comments and consultations,
the FOIA Unit modified its initial redactions and sent advance copies of the annual reports, with
finalized redactions, to each safe harbor program in January 2015. Def.’s Facts ¶¶ 14-15; Def.’s
Mot., Exs. E-F, ECF No. 6-1 (letter to PRIVO and proposed redacted annual report). By February
25, 2015, the FOIA Unit had produced to Plaintiff all six safe harbor programs’ annual reports.
Def.’s Facts ¶¶ 16-19; Def.’s Mot., Ex. G, ECF No. 6-1; Def’s Mot., Ex. H, ECF No. 6-2. All told,
the FTC’s response consisted of 88 pages—two pages in full, 36 pages with redactions, and
50 fully-withheld pages. Pl.’s Mot. at 5; Stearns Decl. ¶ 13.
B. Procedural History
On December 11, 2014, Plaintiff filed suit in this court under FOIA, challenging the FTC’s
decision to withhold and redact certain pages of the annual reports. Plaintiff requested that the
court order Defendant to “process immediately the requested records in their entirety” and
“disclose the requested records in their entirety” to Plaintiff. Compl., ECF No. 1. On March 23,
2015, Defendant filed a Motion for Summary Judgment. See generally Def.’s Mot. In that motion,
Defendant identified eight categories of information it asserted were exempt from disclosure:
(1) nonpublic interpretations and analyses of the COPPA Rule; (2) self-regulatory assessments not
required by the COPPA Rule; (3) business development plans; (4) compliance oversight tools and
logistics; (5) membership statistics and market shares; (6) member correspondence regarding
compliance issues; (7) remediation and disciplinary rates; and (8) the identity of members subject
to discipline. Def’s Mot. at 5-6. These categories of information, the FTC argued, were properly
8
withheld pursuant to Exemptions 3 and 4 of FOIA, 5 U.S.C. § 552(b), and Section 6(f) of the
Federal Trade Commission Act, 15 U.S.C. § 46(f).
Plaintiff filed a Cross-Motion for Summary Judgment on May 20, 2015. See generally
Pl.’s Mot. In it, Plaintiff “narrow[ed] its challenge to [Defendant’s] handling of its FOIA request”
by not contesting the withholdings as to five categories of information. Id. at 6. Still, Plaintiff
maintained its challenge as to three categories of withheld information: (1) interpretations and
analyses of the COPPA Rule; (2) membership statistics and market shares; and (3) remediation
and disciplinary rates. Pl.’s Mot. at 6. Plaintiff argued that the information falling under those
categories was improperly withheld and must be disclosed under FOIA. Pl.’s Mot. at 6, 22.
Defendant’s and Plaintiff’s motions thus focus on whether those three categories of information
are exempt from disclosure under FOIA.
III. LEGAL STANDARDS
A. Standard for Motion for Summary Judgment
A court shall grant summary judgment “if the movant shows that there is no genuine
dispute as to any material fact and the movant is entitled to judgment as a matter of law.” Fed. R.
Civ. P. 56(a). To make this determination, the court must “view the facts and draw reasonable
inferences in the light most favorable to the [non-moving] party.” Scott v. Harris, 550 U.S. 372,
378 (2007) (citations and internal quotation marks omitted). A dispute is “genuine” only if a
reasonable fact-finder could find for the nonmoving party, and a fact is “material” only if it is
capable of affecting the outcome of litigation. Anderson v. Liberty Lobby, 477 U.S. 242, 248
(1986). A non-material factual dispute must not prevent the court from granting summary
judgment. See id. at 248-50.
9
Most FOIA cases are appropriately decided on motions for summary judgment.
See Defenders of Wildlife v. U.S. Border Patrol, 623 F. Supp. 2d 83, 87 (D.D.C. 2009). A court
may award summary judgment in a FOIA case by relying on the information included in the
agency’s affidavits or declarations if they are “relatively detailed and non-conclusory,” SafeCard
Servs., Inc. v. SEC, 926 F.2d 1197, 1200 (D.C. Cir. 1991) (citations and internal quotation marks
omitted), and describe “the documents and the justifications for nondisclosure with reasonably
specific detail, demonstrate that the information withheld logically falls within the claimed
exemption, and are not controverted by either contrary evidence in the record nor by evidence of
agency bad faith,” Military Audit Project v. Casey, 656 F.2d 724, 738 (D.C. Cir. 1981).
It is the government agency’s burden to prove that it has complied with its obligations
under FOIA. DOJ v. Tax Analysts, 492 U.S. 136, 142 n.3 (1989). To prevail on a motion for
summary judgment, the agency must demonstrate that “each document that falls within the class
requested either has been produced, is unidentifiable, or is wholly exempt from the Act’s
inspection requirements.” Goland v. CIA, 607 F.2d 339, 352 (D.C. Cir. 1978); see also Students
Against Genocide v. Dep’t of State, 257 F.3d 828, 833 (D.C. Cir. 2001). “Unlike the review of
other agency action that must be upheld if supported by substantial evidence and not arbitrary or
capricious, the FOIA expressly places the burden ‘on the agency to sustain its action’ and directs
the district courts to ‘determine the matter de novo.’” DOJ v. Reporters Comm. for Freedom of
Press, 489 U.S. 749, 755 (1989) (quoting 5 U.S.C. § 552(a)(4)(B)).
B. Applicable Exemption Legal Standards
Defendant argues that the three disputed categories of information were properly withheld
under (1) the combination of FOIA Exemption 3 and Section 6(f) of the Federal Trade Commission
10
Act (“FTC Act”) and (2) FOIA Exemption 4. Def.’s Mot. at 13-14. The applicable legal standards
as to each is set forth below.
1. FOIA Exemption 3 and the FTC Act
FOIA Exemption 3 permits an agency to withhold information that is
specifically exempted from disclosure by statute . . . [if] that statute (A) (i) requires
that the matters be withheld from the public in such a manner as to leave no
discretion on the issue; or (ii) establishes particular criteria for withholding or refers
to particular types of matters to be withheld.
5 U.S.C. § 552(b)(3). “When analyzing whether the defendant is entitled to invoke Exemption 3,
the court need not examine the detailed factual contents of specific documents withheld; rather,
the sole issue for decision is the existence of a relevant statute and the inclusion of withheld
material within the statute’s coverage.” James Madison Project v. C.I.A., 607 F. Supp. 2d 109,
126 (D.D.C. 2009) (internal quotation marks omitted).
Here, the relevant statute invoked is Section 6(f) of the FTC Act. Section 6(f) prohibits the
FTC from “mak[ing] public any trade secret or any commercial or financial information which is
obtained from any person and which is privileged or confidential.” 15 U.S.C. § 46(f). Because
Section 6(f) of the FTC Act mandates the withholding of certain information, FOIA Exemption 3
also protects against its disclosure. Thus, Section 6(f) and Exemption 3 operate in tandem in this
case.
2. FOIA Exemption 4
The application of Section 6(f) and Exemption 3 depends, in turn, on the standards for
withholding under FOIA Exemption 4. That is because Section 6(f) largely parrots the text of
FOIA Exemption 4. Where Section 6(f) prohibits “mak[ing] public any trade secret or any
commercial or financial information which is obtained from any person and which is privileged or
confidential,” 15 U.S.C. § 46(f), FOIA Exemption 4 requires the withholding of information that
11
qualifies as “trade secrets and commercial or financial information obtained from a person and
privileged or confidential.” 5 U.S.C. § 552(b)(4); Nat’l Parks & Conservation Ass’n v. Morton,
498 F.2d 765, 766 (D.C. Cir. 1974). By adopting such parallel text, Congress intended for
Section 6(f) “to remove any discretionary authority that the Commission has to make public any
information which is exempt from disclosure under the Fourth Exemption of the Freedom of
Information Act.” H.R. Rep. No. 96-917, at 28 (1980) (Conf. Rep.), as reprinted in 1980
U.S.C.C.A.N. 1143, 1144. As a result, FOIA Exemption 3 and Section 6(f) of the FTC Act are
“coextensive” with FOIA Exemption 4. Doherty v. F.T.C., 1981 WL 2094, at *2 (D.D.C. June 24,
1981). Exemption 4’s legal standards, therefore, are controlling in this case.
The Court of Appeals has observed that Exemption 4 contains two threshold requirements:
the information must be (1) “obtained from a person” and (2) “commercial or financial.”
See Wash. Post Co. v. Dep’t of Health and Human Servs., 690 F.2d 252, 266 (D.C. 1982)
[hereinafter Wash. Post. Co. I]. If these threshold requirements are met, the court then must
determine if the information is “privileged or confidential.” Id. Here, there is no dispute that the
information at issue was both (1) obtained from a person and (2) commercial. See generally Pl.’s
Mot. The parties, however, join issue over whether the three contested categories of information
contained in the annual reports were “confidential.”
Our Court of Appeals has developed two tests to determine whether information is
confidential under Exemption 4. Which test applies depends on the manner in which the
government agency obtained the information at issue. When an agency receives the sought-after
information by way of a mandatory disclosure, the information is considered confidential for
purposes of FOIA Exemption 4 if disclosure is likely (1) to impair the agency’s ability to obtain
the information in the future or (2) to cause substantial harm to the competitive position of the
12
source of the information. Nat’l Parks, 498 F.2d at 770. The inquiry is an objective one.
See Wash. Post Co. I., 690 F.2d at 268.
A different test applies when an agency receives information by way of a voluntary
disclosure. In that case, the information is confidential for purposes of Exemption 4 if it is “of a
kind that would customarily not be released to the public by the person from whom it was
obtained.” Critical Mass Energy Project v. Nuclear Regulatory Comm’n, 975 F.2d 871, 879 (D.C.
Cir. 1992).
Here, the parties agree that the National Parks mandatory-disclosure test applies, because
the safe harbor programs submitted the contested information pursuant to the FTC’s annual report
filing rule.3 See Def.’s Mot. at 19-20, 25-26, 28-30; Def.’s Reply in Support of its Mot. for Summ.
J. and Opp’n to Pl.’s Cross-Motion for Partial Summ. J., ECF No. 12 [hereinafter Def.’s Reply],
at 3 n.1 (conceding that “[s]ince the disputed information was part of mandatory disclosures,
National Parks is the governing test”); Pl.’s Mot. at 10. Thus, the information withheld from the
safe harbor programs’ annual reports is confidential for purposes of Exemption 4 if its disclosure
likely would impair the government’s ability to gather information, Wash. Post Co. v. Dep’t of
Health and Human Servs., 865 F.2d 320, 326 (D.C. Cir. 1989) [hereinafter Wash. Post Co. II], or
would cause “substantial harm to the competitive position” of the program from which the
information was obtained, Pub. Citizen Health Research Grp. v. FDA, 704 F.2d 1280, 1290-91
(D.C. Cir. 1983) [hereinafter Pub. Citizen I].
3
Although Defendant notes that for voluntary disclosures, the Court of Appeals has stated that the more relaxed
standard set out in Critical Mass applies, see Def.’s Mot. at 19, Defendant does not argue that the Critical Mass
standard applies to any of the contested categories of information. Nor does either party conduct an analysis under
Critical Mass to determine whether the contested information was properly withheld. Thus, the court assumes that
the mandatory-disclosure test applies and conducts its analysis—as the parties do—using the test set out in National
Parks.
13
Because Defendant invokes both prongs of the National Parks test to justify its
withholdings in this case, the court addresses each in more detail below.
a. The government’s ability to gather information
Whether the disclosure of information is likely to impair the government’s ability to gather
information—the first National Parks prong—involves a “rough balancing of the extent of the
impairment and the importance of the information against the public interest in disclosure.” Wash.
Post Co. I, 690 F.2d at 269. The potential for impairment in gathering information is not limited
to the question whether an agency has power to compel disclosure in the future. Id. at 268 (stating
“whether disclosure is mandatory is certainly a factor in deciding whether the government’s access
to information is likely to be impaired” (emphasis added)). Rather, it encompasses the possibility
that suppliers of information, as a consequence of public disclosure, will narrowly construe the
government’s requests and thereby seriously impair the government’s information-gathering
ability. See id. at 269; Wash. Post Co. II, 865 F.2d at 325 (framing the question as “whether public
disclosure would cause individuals to so narrowly construe the requests for information . . . that
the government’s information-gathering ability would be seriously impaired”). “Thus, when
dealing with a FOIA request for information the provider is required to supply, the governmental
impact inquiry will focus on the possible effect of disclosure on [the] quality [of the information].”
Critical Mass Energy Project, 975 F.2d at 878.
But, as with other FOIA exemptions, Exemption 4 is to be read narrowly in light of FOIA’s
“dominant disclosure motif.” Wash. Post Co. II, 865 F.2d at 324. Consequently, “minor
disadvantages flowing from disclosure cannot overcome the disclosure mandate of FOIA.” Id. at
327 (citation omitted) (internal quotation marks omitted). In the end, information that should be
14
supplied under FOIA “will be withheld only when the affirmative interests in disclosure on the
one side are outweighed by the factors . . . militating against disclosure on the other.” Id.b. Harm to information supplier’s competitive position
With respect to the second prong of the National Parks test—whether disclosure likely
would cause substantial harm to the competitive position of the person who supplied the
information—the court “need not conduct a sophisticated economic analysis of the likely effects
of disclosure” to decide if substantial competitive harm would occur. Pub. Citizen I, 704 F.2d at
1291 (citation omitted). An agency, of course, must offer more than a conclusory and generalized
allegation of substantial harm to support its withholding of information. See id. It need not,
however, “show actual competitive harm.” Id. Rather, “evidence revealing actual competition
and the likelihood of substantial competitive injury is sufficient to bring commercial information
within the realm of confidentiality.” Id. (citation omitted) (internal quotation marks omitted);
see also McDonnell Douglas Corp. v. U.S. Dep’t of the Air Force, 375 F.3d 1182, 1187 (D.C. Cir.
2004) (stating that parties do not have to “prove disclosure certainly would cause it substantial
competitive harm, but only that disclosure would ‘likely’ do so”).
IV. DISCUSSION
The court now turns to the three contested categories of information and analyzes whether
each is confidential, and thus properly withheld by Defendant, under the test set forth in National
Parks.
A. Non-Public Analyses of the COPPA Rule
Annual reports must contain an “aggregated summary” of a safe harbor program’s
independent assessment of its members’ compliance with the program’s guidelines. 16 C.F.R.
§ 312.11(d)(1). Three of the programs—CARU, ESRB, and kidSAFE—supplied that information
15
in a chart, “listing the compliance issues detected by the programs and the number of members
associated with those issues.” Def.’s Mot. at 19 (citing Parsons Decl. ¶ 19). The kidSAFE report
also included a separate chart with its analysis of the different types of consumer complaints it
received. Def.’s Mot., Ex. G, ECF No. 6-1. Although Defendant produced portions of each chart
to the extent “they contained straightforward recitations or discussions of the COPPA Rule,” it
withheld “portions of the charts reflecting the safe harbor programs’ unique, nonpublic analyses
of how the [COPPA] Rule should be implemented in various settings.” Parsons Decl. ¶ 19.
Plaintiff challenges the idea that the programs’ interpretations and analyses of the COPPA Rule
are confidential and subject to Exemption 4. Pl.’s Mot. at 11-13.
In support of these redactions, Defendant primarily argues that the safe harbor programs’
analyses “are confidential because their release would subject the safe harbor programs that
developed them to substantial competitive injury.” Def.’s Mot. at 20. It also argues that disclosure
of these analyses “would likely impair the agency’s ability to obtain necessary information in the
future.” Id. The court considers each of these justifications in turn.
1. Disclosure Likely Would Cause Substantial Competitive Injury
Defendant offers three declarations to support its claim that disclosure of the programs’
non-public analyses of the COPPA Rule likely would cause substantial competitive injury. The
primary declaration comes from Kandi Parsons, an FTC lawyer responsible for implementing
COPPA and who has knowledge of the industry and the approved programs. Parsons Decl. ¶ 2.
Parsons attested that “COPPA safe harbor programs make nuanced determinations of how the Rule
should apply to diverse business models in a rapidly evolving technological marketplace. . . . If
rivals could obtain these analyses [of COPPA], they could use them to improve their own oversight
functions and compliance advice, thereby diverting business from the programs that developed the
16
analyses.” Id. ¶ 19. According to Parsons, she consulted with the FTC’s Bureau of Economists
“to verify our understanding of what information should be considered confidential in this
competitive, evolving marketplace.” Id. ¶ 16.
Defendant also relies on declarations filed by executives from two safe harbor programs—
ESRB and kidSAFE. Dona Fraser, Vice President of ESRB Privacy Certified, attested that her
company offers a safe harbor program “that provides a workable and user-friendly compliance
solution for its member companies.” Def.’s Mot., Ex. L, Declaration of Dona J. Fraser (ESRB),
ECF No. 6-2 [hereinafter Fraser Decl.], ¶ 4. Furthermore, according to Fraser, her company’s
program has “defined and developed ‘Compliance Issues’ that differ substantially from the more
complex formulation available in the COPPA Rule and, in many instances, has exceeded the
COPPA Rule requirements.” Id. Fraser attested that this is the kind of information that ESRB
“would not customarily disclose to the public.” Id. ¶ 6. kidSAFE’s founder and President, Shai
Samet, similarly stated that “any information pertaining to [kidSAFE’s] compliance enforcement
activities, including any legal analysis” is deemed confidential by kidSAFE. Def.’s Mot., Ex. O,
Declaration of Shai Samet (kidSAFE), ECF No. 6-2 [hereinafter Samet Decl.], ¶ 6(f).
Plaintiff, for its part, does not dispute any of the evidence offered by Defendant or offer
any contrary evidence of its own. As a result, Defendant’s evidence of competitive harm, such as
it is, stands unrebutted; therefore, this record presents no genuine dispute about an issue of material
fact. The sole remaining question then is whether Defendant has carried its burden of proving that
the withheld information is exempt from disclosure. See Pub. Citizen Health Research Grp. v.
FDA, 185 F.3d 898, 904 (D.C. Cir. 1999) [hereinafter Public Citizen II].
Plaintiff, at least initially, does not argue that Defendant has failed to meet its evidentiary
burden. Instead, Plaintiff argues that “the FTC’s theory of competitive harm directly contradicts
17
the agency’s goals of ensuring COPPA compliance.” Pl.’s Mot. at 11. Plaintiff contends that
“public access to this information would actually improve” the quality of the safe harbor programs
because it would lead to more robust enforcement. Id. at 11-12. Essentially, Plaintiff contends
that if one safe harbor program’s interpretation of the COPPA Rule leads to better compliance or
more effective enforcement, other programs could emulate that success if the interpretation of the
Rule were public. Id. Plaintiff also argues that maintaining confidentiality over safe harbor
programs’ analyses of the COPPA Rule amounts to encouraging the development of “secret law.”
Id. at 12. Lastly, Plaintiff suggests that Congress “intended that safe harbor providers enforce the
law in public and that the process be open” and that “COPPA enforcement should be transparent.”
Id.
None of those arguments is well taken. In a nutshell, Plaintiff’s central argument is that it
would be good policy to release these withheld legal analyses because, if they were public, safe
harbor programs could use their competitors’ analysis of the COPPA Rule to improve their own
enforcement of COPPA, thereby promoting overall effectiveness and transparency in enforcement.
Yet, as Defendant rightly contends,4 the law does not allow this sort of “consequentialist”
argument to defeat the otherwise proper withholding of information under Exemption 4. Pub.
Citizen II, 185 F.3d at 904.
In Public Citizen II, the plaintiff argued for disclosure of certain information because
“disclosure would prevent other drug companies” from making the same mistakes one drug
company had which would “thereby avoid[] risk to human health.” Id. at 903. The court rejected
4
Plaintiff asserts that Defendant “mischaracterizes” its argument “as asking the court to balance the public benefits of
disclosing the information against the competitive harm that might result.” Pl.’s Mot., at 3. The court disagrees. Even
if Plaintiff did not expressly ask the court to “balance” the public benefit, it certainly rooted its argument in the
purported collateral public benefits that disclosure would bring to enforcement of the COPPA Rule.
18
that argument, holding that it was not “open to [the plaintiff] . . . to bolster the case for disclosure
by claiming an additional public benefit in that, if the information is disclosed, then other drug
companies will not conduct risk clinical trials.” Id. at 904. The public interest under FOIA, the
Court of Appeals observed, is rooted in discovering what “the government is up to,” not “any
collateral benefits of disclosure.” Id. So it is here. Plaintiff’s argument that the COPPA Rule
would function better if safe harbor programs’ interpretation of the Rule were made public does
not bolster the case for disclosure. Indeed, the impact that public disclosure would have on the
efficacy of the COPPA Rule is irrelevant.
In its reply brief, Plaintiff takes a different tack. Invoking the language of evidentiary
burdens, Plaintiff contends that Defendant’s justification for the withholdings is “insufficient”
because the safe harbor programs’ “publicly disclosed guidelines already contain [their] unique
legal analyses of the COPPA Rule that competitors can incorporate into their own safe harbor
programs.” Pl.’s Reply in Support of its Cross-Motion for Partial Summ. J., ECF No. 13
[hereinafter Pl.’s Reply], at 4. Plaintiff cites 16 C.F.R. § 312.11(c), which sets forth what a
proposed safe harbor program must include in its application for approval. For instance, a
proposed program must include a “copy of the full text of the guidelines for which approval is
sought and any accompanying commentary.” Id. § 312.11(c)(2). From this, Plaintiff seems to
argue that the disclosure of the withheld COPPA Rule analyses cannot cause “substantial harm”
to the safe harbor programs because much of what they consider unique about their approaches to
COPPA interpretation and enforcement is already public. Pl.’s Reply at 5 (arguing “the public
availability of the self-regulatory guidelines undercuts the FTC’s contention that a few safe harbor
providers’ legal analyses are secret and must be withheld to avoid competitive harm”).
19
This argument suffers from two fatal flaws. First, it comes too late. “[I]t is a well-settled
prudential doctrine that courts generally will not entertain new arguments first raised in a reply
brief.” Benton v. Laborers’ Joint Training Fund, 121 F. Supp. 3d 41, 51 (D.D.C. 2015) (citation
and internal quotation marks omitted); see also McBride v. Merrell Dow & Pharm., 800 F.2d 1208,
1211 (D.C. Cir. 1986) (“Considering an argument advanced for the first time in a reply brief . . .
is not only unfair . . . , but also entails the risk of an improvident or ill-advised opinion on the legal
issues tendered.” (citation omitted)). Second, Plaintiff’s belated argument does not defeat
Defendant’s contention that the programs would suffer a competitive disadvantage from the
disclosure of “unique, nonpublic analyses of how the [COPPA] Rule should be implemented in
various settings . . . in a rapidly evolving technological marketplace.” Parsons Decl. ¶ 19
(emphasis added). The fact that the safe harbor programs’ guidelines and commentary are public
does not divest a company’s specific application of those guidelines of commercial value. In a
marketplace where companies compete—as even Plaintiff concedes—on the basis of, among other
things, “compliance advice” and “fairness and diligence when resolving compliance issues,”
Def.’s Facts ¶ 4; Pl.’s Facts ¶ 1, how a company interprets the COPPA Rule in a specific setting
may well give it a competitive advantage.
The court returns then to the ultimate question on summary judgment: Has Defendant
carried its burden of proving that the disclosure of the safe harbor programs’ nonpublic analyses
of the COPPA rule is likely to cause substantial harm to their competitive positions? The court
finds that it has. Defendant has shown both “actual competition” among the safe harbor programs,
Pub. Citizen I, 704 F.2d at 1291 (citation omitted), and a likelihood of substantial competitive
injury if the programs’ analyses were to be disclosed, see id. Although Defendant’s evidence of
likely competitive harm does not rely on econometric modeling or similar analysis, such
20
sophisticated economic analysis is not required in this context. See id. (observing that “the court
need not conduct a sophisticated economic analysis of the likely effects of disclosure”).
Defendant’s in-house expert on the COPPA Rule and the safe harbor program marketplace, in
consultation with agency economists, has predicted, without contradiction, that if the rivals of
CARU, ESRB, and kidSAFE could obtain those three programs’ nonpublic analyses of the COPPA
Rule, the rivals could improve their oversight functions and compliance advice, thereby causing
CARU, ESRB, and kidSAFE to become competitively disadvantaged. See Pub. Citizen II, 185
F.3d at 905. Two safe harbor program representatives have said, under oath, that they have the
same competitive concerns. Such evidence, taken together, is sufficient to meet the agency’s
burden under Exemption 4.
2. Disclosure Likely Would Impair the Agency’s Ability to Gather Information
The court also agrees with Defendant that the programs’ non-public analyses are
confidential for purposes of Exemption 4 because disclosure of that information likely would
impair the FTC’s ability to obtain such information in the future.
It is important to put the annual report filing requirement in some context. Although
Congress directed the FTC to adopt regulations to implement COPPA, 15 U.S.C. § 6501(b), it
vested primary responsibility for monitoring and enforcing operators’ compliance with the COPPA
Rule with the safe harbor programs, not the FTC,5 id. § 6503(a) (“[A]n operator may satisfy the
requirements of regulations . . . by following a set of self-regulatory guidelines, issued by
[approved] representatives of marketing or online industries, or by other [approved] persons[.]”).
Congress did not require website and online services operators to submit reports to the FTC about
5
Although primary responsibility for enforcement lies with the safe harbor programs, COPPA does grant the FTC and
the States the authority to bring civil actions to enforce the FTC’s regulations. See 15 U.S.C. §§ 6504(a), (d).
21
their compliance efforts; nor did it mandate any regular reporting from the safe harbor programs.
It was the FTC who created a public reporting mechanism by developing and adopting the annual
filing requirement. See Children’s Online Privacy Protection Rule, Final Rule Amendments,
78 Fed. Reg. 3,972, 3,995-3,996 (Jan. 17, 2013). Furthermore, the primary purpose of the annual
reporting rule was to enable the FTC to gather information. The FTC viewed the annual report as
a way to stay “apprised of key information about the safe harbors’ programs and membership
oversight” and “the emergence of new feasible parental consent mechanisms for operators.” Id. at
4002.
Although the annual reporting rule’s primary function is information-gathering, the FTC
has largely left it up to the safe harbor programs to decide how much information to actually
disclose. The programs have such autonomy for three main reasons. First, the scope of
information sought by the annual reporting rule is quite modest. Annual reports must contain only
three categories of information: (1) “an aggregated summary of the results” of the program’s
compliance assessments; (2) “a description of any disciplinary action taken” against a program’s
customer; and (3) a description of the program’s approval of any new methods for online services
to obtain verifiable parental consent, even if such method is not specified in the COPPA Rule.
16 C.F.R. § 312.11(d)(1); Parsons Decl. ¶ 12. Given the rule’s limited mandatory disclosures, the
FTC has relied on voluntary disclosures to acquire more information. So, for instance, when the
FTC sent reminders about the reporting requirement to the safe harbor programs, it also asked the
companies to voluntarily disclose additional information about consumer complaints and response
to such complaints, as well as other information. See Parsons Decl. ¶ 12 & Ex. J2.
Second, the text of the annual filing rule leaves plenty of room for interpretation. For
example, the key term “aggregated summary” is nowhere defined, thus allowing safe harbor
22
programs ample opportunity to narrowly construe that reporting requirement. See Wash. Post Co.
I, 690 F.2d at 268-69 (observing that where a disclosure requirement “leaves room for
interpretation” the reporter may construe the “requirement narrowly” and exclude responsive
information). That the programs, in fact, did so here is amply demonstrated on this record.
See Parsons Decl. ¶ 15 (“[T]he 2014 safe harbor reports varied widely in their depth and breadth
and in the types of information they provided beyond the bare legal requirements.”). Some of
them—such as kidSAFE—submitted multi-page, detailed reports containing the requested
information. Def.’s Mot., Ex. G at 63. Others—such as CARU—submitted only short letters
containing terse entries corresponding to the requested information. Id. at 58.
Finally, it is reasonable to conclude that the prospect of public disclosure provides a
disincentive to safe harbor programs to provide information to the FTC. The FTC’s counsel, Kandi
Parsons, attested that two safe harbor representatives have said that they “would like to give the
FTC additional information in their annual reports [but] they are concerned that this will reveal
their confidential information to the public and subject them to a competitive disadvantage.”
Parsons Decl. ¶ 15. Additionally, a number of the safe harbor program affiants attested that some
of the information included in the annual report was not the kind of information they ordinarily
would make public. See, e.g., Fraser Decl. ¶ 6; Samet Decl. ¶ 8. Thus, it is not difficult to fathom
that, in the future, in order to avoid public disclosure of information that they consider proprietary
or confidential, safe harbor programs would reduce the amount and kind of information that they
provide to the FTC.
Against this backdrop, the court has little trouble finding that the disclosure of the safe
harbor programs’ nonpublic analyses and interpretation of the COPPA Rule would make it more
difficult for the FTC to obtain such information in the future. The three safe harbor programs
23
disclosed their nonpublic analyses as part of their respective “aggregated summary” of their
compliance assessments. If such analyses from the 2014 annual reports were publicly disclosed,
it is easy to envision that no safe harbor program would supply such information in future filings,
thereby depriving the FTC of important and useful information. The agency’s significant interest
in encouraging safe harbor programs to supply such analyses, and like information, in future filings
thus weighs against public disclosure.
Plaintiff argues that Defendant’s impairment argument is “illogical” because the agency
simply could modify its rules to compel disclosure. Pl.’s Reply at 5 (“Because the agency has
ample authority to compel the disclosure of the withheld records, releasing those records would
not impair its ability to obtain similar information in the future.”). But that argument proves too
much. True, the FTC theoretically could amend its regulations, after notice and comment, to
demand specific disclosures. But the construct envisioned by Plaintiff would create a game of “cat
and mouse” in which the agency is regularly modifying the disclosure requirements to capture the
information private parties are reluctant to disclose. The inefficiencies inherent in such a process
would impair the FTC’s information-gathering ability.
Finally, the required “rough balancing” of the countervailing public interest in disclosure
does not tip the balance in Plaintiff’s favor. As discussed above, Congress set up a largely self-
regulating marketplace, driven by industry standard-setting, to promote compliance with COPPA.
No doubt Congress knew that information from private enterprises would be more difficult for the
public to obtain under FOIA. But that is the balance it struck. Moreover, the public interest in the
information Plaintiff seeks is less weighty here because it will not achieve the central purpose of
FOIA, which is to inform citizens about “what the[] government is up to.” DOJ v. Reporters
Comm. for Freedom of Press, 489 U.S. 749, 773 (1989). The nonpublic analyses, if revealed, at
24
most would disclose the inner workings of private safe harbor programs. It would tell the public
little, if anything, about how the FTC itself operates. Accordingly, the court concludes that the
safe harbor programs’ non-public analyses of the COPPA Rule was properly withheld under FOIA
Exemption 4.
B. Membership Statistics and Market Shares of the Safe Harbor Programs
Next, Plaintiff seeks disclosure of the number of members, annual changes in membership,
and market shares of each safe harbor program. Defendant asserts that this information was
properly withheld under Exemption 4—specifically, under the second prong of the National Parks
test. Defendant argues that disclosure of this information could cause competitive injury because
“[l]arge firms could use this membership data when trying to recruit members of smaller
competitors, by asserting that those competitors have a lesser market share or are losing business,
and ostensibly have less credibility as a result.” Parsons Decl. ¶ 18. Record evidence shows that
the safe harbor programs themselves consider this information to be confidential. See, e.g., Fraser
Decl. ¶ 6 (“The number of members is kept confidential due to the high level of competition
amongst the Safe Harbors; membership retention is essential to EPC’s sustainability.”); Samet
Decl. ¶ 6(c) (explaining that kidSAFE considers confidential “any information or statistics
regarding the number of members seeking COPPA certification under KSP’s Safe Harbor
program, including the number of participants whose data is included in the 2014 KSP Report[.]”);
Def.’s Mot., Ex. Q, Declaration of Denise G. Tayloe (PRIVO), ECF No. 6-2 [hereinafter Tayloe
Decl.] ¶ 4(a)-(b) (explaining that, in order to protect against “competitive damage,” PRIVO keeps
confidential “the total number of entities and online properties that are members of the PRIVO
self-regulatory program” and “any information indicating a change in the number of members in
the program over any period of time”). Defendant also argues that combining safe harbor
25
programs’ membership data with disclosed data about compliance incidents would allow
competitors to determine the percentage of members that were subjected to discipline or
remediation. Parsons Decl. ¶¶ 18, 24.
Plaintiff counters that the safe harbor programs’ membership statistics cannot be
confidential as they are either publicly available or easily discoverable. Pl.’s Mot. at 14. Plaintiff
points out that some programs state the number of members on their website. And because
individual members display a safe harbor program’s seal on their own websites, competing
programs can conduct an online search to “learn whether a particular website is affiliated with a
different program and solicit them accordingly.” Id. at 14-15. Furthermore, Plaintiff argues that
any suggestion that competitors can combine membership statistics with other data to deduce
remediation rates is “speculative and unsupported,” largely because much of the information at
issue is already public. Id. at 15.
The court finds that market shares and membership information constitute “sensitive” and
“non-public” information that is “precisely the kind of information that other courts have found to
be protected under Exemption 4’s commercial-information privilege.” STS Energy Partners LP
v. Fed. Energy Regulatory Comm’n, 82 F. Supp. 3d 323, 330 (D.D.C. 2015). Again, Defendant
need only show “actual competition” and “the likelihood of substantial competitive injury”—
rather than actual competitive harm—to bring commercial information under the cover of
confidentiality. Pub. Citizen I, 704 F.2d at 1291. The court finds persuasive Defendant’s concern
that, if each safe harbor program’s share of the market became public, competitors could (1) use
that information to poach customers from smaller programs; and (2) combine it with mandatorily-
disclosed disciplinary information to tabulate safe harbor programs’ rates of discipline, a fact that
could easily be used to sway customers wary of facing remediation. See e.g., Parsons Decl. ¶ 18;
26
Samet Decl. ¶ 6(c). The lack of any evidence from Plaintiff rebutting these concerns only bolsters
the court’s finding.
Plaintiff’s argument that the information at issue here is already public because certain safe
harbor programs make representations about how many customers they have, and because certain
customers display seals of the safe harbor program they use on their websites, is unavailing. While
it is true that the government cannot withhold information under FOIA that already is in the public
domain, Afshar v. Dep’t of State, 702 F.2d 1125, 1130-34 (D.C. Cir. 1983), it is not enough that
“the same general type” of information is public, Customs & Int'l Trade Newsletter v. U.S. Customs
& Border Prot., 588 F. Supp. 2d 51, 58 (D.D.C. 2008). Rather, the information sought through
FOIA must be “identical” to the information already public. Id.Here, Defendant has shown persuasively that the information withheld from the annual
reports is different than that found in the public sphere. Def.’s Reply at 9-11. And if a competitor
is able to easily acquire valuable information about a competitor through FOIA, “rather than the
considerable costs of private reproduction, they may be getting quite a bargain,” which could have
“competitive consequences not contemplated as part of FOIA’s principal aim of promoting
openness in government.” Worthington Compressors, Inc. v. Costle, 662 F.2d 45, 51 (D.C. Cir.
1981). That concern exists in this case: Plaintiff is of course free to count every website that uses
a certain safe harbor program’s seal, but disclosing specific membership and market share
information through FOIA could lead to competitive harm for the safe harbor programs.
Plaintiff also contends that Defendant’s argument that membership rates and market shares
are confidential because they could be combined with the number of disciplinary actions taken to
compute rates of discipline is “speculative.” Pl.’s Mot. at 15. This is, by definition, at least partly
true, as at issue in this lawsuit is the first round of annual reports required by the FTC, meaning
27
that the results of disclosure have not yet been tested. Yet the test to show substantial economic
harm does not require absolute certainty, as Defendant must only show that such harm is “likely.”
McDonnell Douglas Corp., 375 F.3d at 1187. Through persuasive affidavits from both FTC
employees and representatives of the safe harbor programs, Defendant has met its burden.
In sum, Defendant has shown that information about safe harbor programs’ membership
statistics and market shares is protected from disclosure under FOIA Exemption 4.
C. Remediation and Disciplinary Rates
The last contested category of withheld information is the rate of safe harbor programs’
members that were subject to remediation or discipline. One program, PRIVO, included data
revealing the percentage of its program members that required remedial action. Parsons Decl.
¶ 24. Defendant contends that if a safe harbor program’s rate of discipline were made public,
competitors could recruit members by asserting that a particular program is either too strict or too
lax with enforcement. Def.’s Mot. at 29. Additionally, Defendant argues that the disclosure of
rates of discipline would discourage safe harbor programs from including this type of information
in future annual reports. Id. at 28.6
Plaintiff sees things differently. It argues that no competitive harm would be caused by the
disclosure of discipline rates because the safe harbor programs already have released the actual
number of members they have disciplined, including two safe harbor programs which disclosed
6
Defendant additionally argues that discipline rates are confidential because “their disclosure could cripple the
effectiveness of the COPPA safe harbor program.” Id. Defendant suggests that information can be protected from
disclosure under FOIA not only based on the two National Parks factors, but also because of “other interests,” Wash.
Post Co. II, 865 F.2d at 327, including the possible “impairment of an agency’s ability to carry out its statutory
purpose,” Judicial Watch, Inc. v. Export-Import Bank, 108 F. Supp. 2d 19, 30 (D.D.C. 2000). The court, however,
does not reach this claimed “other interest” favoring non-disclosure, as the two main considerations weighing against
disclosure identified in National Parks—serious competitive harm and impairment of government information-
gathering—suffice in this case.
28
that they took no disciplinary actions against their members. Pl.’s Mot. at 18-19. Thus, Plaintiff
argues, competitors can already compute the discipline rates of certain safe harbor programs. Id.Plaintiff also contends that, because safe harbor programs are required to disclose in their annual
reports any discipline or remediation they undertook against a member in the past year, 16 C.F.R.
§ 312.11(d)(1), there is no risk that the FTC will have trouble obtaining this information in the
future. Id. at 20.
The court agrees with Defendant’s determination that the disclosure of discipline rates is
likely to cause substantial competitive harm because competitors could use that information to
convince potential customers that a rival is either too strict or too lenient. Parsons Decl. ¶ 24.
That concern is supported by the declaration from PRIVO’s CEO, Denise Tayloe, who states that
PRIVO does not disclose such information publicly because of “the competitive damage the public
availability of such information would have for PRIVO vis a vis other self-regulatory programs.”
Tayloe Decl. ¶ 4. Again, the relevant question is not whether such harm will occur; rather, it is
whether the harm is “likely” to occur. McDonnel Douglas Corp., 375 F.3d at 1187. Here, Plaintiff
has offered no evidence to contradict Defendant’s competitive concern. Based on the Parsons and
Tayloe declarations, the court finds that Defendant has carried its burden of showing the potential
for competitive harm.
The court also concurs with Defendant’s assertion that disclosure of PRIVO’s remediation
rate would discourage other safe harbor programs, and PRIVO itself, from disclosing it in the
future. As already discussed, the annual filing rule provides safe harbor programs with wide
latitude in determining what information to supply as part of its “aggregated summary” of
compliance assessments. The disclosure of remediation rates, which the safe harbor programs
consider sensitive business information, likely would discourage them from supplying it in the
29
future. The loss of such information would impair the FTC’s efforts to monitor how the safe harbor
programs are working. Parsons Decl. ¶¶ 9-10. Although the public may have an interest in
remediation rates, such information ultimately does not reveal what the “government is up to,” as
Congress made a policy decision to vest private enterprises with primary enforcement authority
over those subject to the COPPA Rule. The agency’s interest in avoiding impairment to its
information-gathering function thus outweighs the public’s interest in disclosure.
D. Segregability
FOIA requires a government agency to disclose any “reasonably segregable” non-exempt
information. 5 U.S.C. § 552(b). It is the agency’s burden to show that it has done so. STS Energy
Partners LP, 82 F. Supp. 3d at 336. The agency must provide a “detailed justification” for the
non-segregability of all information that is not released, but does not need “to provide so much
detail that the exempt material would be effectively disclosed.” Johnson v. Exec. Office for U.S.
Attorneys, 310 F.3d 771, 776 (D.C. Cir. 2002) (citations omitted). Information that is “inextricably
intertwined” with exempt material need not be disclosed. 5 U.S.C. § 552(b).
The court is satisfied that Defendant has shown that it produced all non-exempt information
to Plaintiff and only segregated and redacted that which it (rightly) believed to be exempt from
disclosure. Defendant prepared a comprehensive Vaughn index, describing each document or
portion withheld, the exemption under which it was withheld, and the justification for doing so.
See Def.’s Mot., Ex. J, Summary of Records Withheld in FOIA 2014-01098, ECF No. 6-2. In
addition, FTC attorney Stearns stated that she reviewed every document of the production “line
by-line” and determined that “all reasonably segregable portions of the relevant records” have been
produced to Plaintiff. Stearns Decl. ¶ 51. It also appears from the record that the FTC conducted
multiple reviews of the reports, which resulted in the production of previously-redacted
30
information. Id. ¶¶ 36, 47. The combination of the Vaughn index, the detailed review and
redaction process employed by the FTC, and the sworn statements of an FTC attorney is sufficient
to fulfill the agency’s obligation to show with “reasonable specificity” why the documents in
question cannot be further segregated. See Exec. Office for U.S. Attorneys, 310 F.3d at 776.
V. CONCLUSION
For the reasons set forth above, Defendant’s Motion for Summary Judgment is granted and
Plaintiff’s Cross-Motion for Summary Judgment is denied. A separate order accompanies this
Memorandum Opinion.
Dated: June 1, 2016 Amit P. Mehta
United States District Judge
31