And just like that, everything changed. With a snap of its fingers, a flick of its wand, the U.S. Supreme Court magically erased over four decades of jurisprudence under Exemption 4 of the Freedom of Information Act (FOIA), 5 U.S.C. § 552, in its recent decision in Food Marketing Institute v. Argus Leader Media, 139 S. Ct. 2356 (2019).
FOIA Exemption 4
The FOIA generally requires that federal agencies make their records available to the public, but Exemption 4 provides that this disclosure obligation “does not apply to matters that are . . . trade secrets and commercial or financial information obtained from a person and privileged or confidential.” 5 U.S.C. § 552(b)(4). So, Exemption 4 is of great interest to individuals and businesses that provide their own confidential business information to a federal agency—for example, through a license or permit application, contract bid, or other submission.
And for 45 years, FOIA practitioners thought they knew the legal standard that must be met for information to fall within Exemption 4. In 1974, the D.C. Circuit declared that Exemption 4 required a demonstration that the release of the “confidential” information would “cause substantial harm to the competitive position of the person from whom the information was obtained.” Nat’l Parks & Conservation Ass’n v. Morton, 498 F.2d 765, 767 (D.C. Cir. 1974). And for 45 years, much ink was spilled implementing this standard. Many courts, including outside the D.C. Circuit, adopted this standard (although some did not). Agencies across the federal government ensconced the “competitive harm” test into their regulations. Scores and scores of lawyers drafted declarations to substantiate their clients’ claims of harm and prevent the release of their confidential information. And I wrote a book for the ABA containing dozens of pages discussing it! Two editions! With helpful tips for meeting the “competitive harm” test!
The Food Marketing Institute decision
But guess what. It turns out that the statute doesn’t actually say anything about “competitive harm.” That is what Justice Gorsuch concluded in his opinion for the majority in Food Marketing Institute, a case involving a FOIA request to the Department of Agriculture for store-level data from retail stores participating in the national food-stamp program. The majority opinion concluded that the “competitive harm” test is “inconsistent with the terms of statute” and rejected the National Parks court’s “casual disregard of the rules of statutory interpretation.” Food. Mktg. Inst., 139 S. Ct. 2356, 2364 (2019).
Instead, apparently based on the “ordinary meaning and structure of the law itself,” id., the majority announced the new Exemption 4 standard: “At least where commercial or financial information is both customarily and actually treated as private by its owner and provided to the government under an assurance of privacy, the information is ‘confidential’ within the meaning of Exemption 4.” Id. at 2366 (emphases added). The majority found the information at issue to have met this standard because “uncontested testimony established that the Institute’s retailers customarily do not disclose store-level [food stamp] data” and “the government has long promised them that it will keep their information private.” Id. at 2363.
Unresolved question: Assurance of privacy?
But why qualify the new test with “at least”? Where does that leave us? Is there some other—less stringent—standard that could be met to satisfy Exemption 4? Is the statute, perhaps, not entirely clear? At the end of the day, the majority expressly did not address whether both of its conditions must be met in all cases. The first condition—that the information be treated as private by its owner—“has to be” met, the majority found. But whether the second condition—that the government “assure” the submitter of the data’s privacy—has to be met was an issue the majority found “no need to resolve.” Id.
Unfortunately, with 45 years of jurisprudence out the window, there is a burning need to resolve this issue. What will federal agencies require before finding Exemption 4 to be met? What will they write in their new FOIA regulations? In practice, federal agencies very rarely provide submitters of information with an express “assurance of privacy.” Does this mean Exemption 4 is now a matter of agency discretion, to be invoked only when the agency decides to affirmatively provide such an assurance? Should submitters refuse to produce sensitive information to agencies until such an assurance is provided? Stayed tuned. Hopefully, it will not take another 45 years to answer these questions.