UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLUMBIA
PUBLIC CITIZEN HEALTH RESEARCH GROUP et al.,
Plaintiffs, Civil Action No. 19-166 (TJK) v.
PATRICK PIZZELLA1 et al.,
Defendants.
STATE OF NEW JERSEY et al.,
Plaintiffs,
v. Civil Action Nos. 19-621 (TJK)
PATRICK PIZZELLA et al.,
MEMORANDUM OPINION
To improve the collection of work-related injury data, the Occupational Safety and
Health Administration, a component of the Department of Labor, requires qualifying employers
to record work-related injuries and illnesses on three standardized forms. At first, OSHA only
occasionally collected these forms from employers, either during on-site inspections or as part of
broader industry surveys. But in May 2016, OSHA issued a new rule requiring employers to
submit them electronically each year.
1 Under Federal Rule of Civil Procedure 25(d), Patrick Pizzella is automatically substituted as a defendant for R. Alexander Acosta. But before the first filing deadline, OSHA announced that employers would be required
only to submit one of the three forms, and it began a rulemaking to formalize this change. And
on January 25, 2019, OSHA issued a final rule titled “Tracking of Workplace Injuries and
Illnesses.” The rule rescinded portions of the 2016 rule, reverting to occasional collection of two
of the forms and continuing the annual, electronic collection of the third.
In response, two sets of plaintiffs, one a group of public health organizations and the
other a series of states, filed related lawsuits, claiming that OSHA’s rulemaking violated the
Administrative Procedure Act because it is arbitrary and capricious. Plaintiffs in both cases
moved for summary judgment. Defendants moved to dismiss the public health organizations’
suit for lack of subject-matter jurisdiction and cross-moved for summary judgment in the suit
brought by the states. For the reasons explained below, the Court will grant Defendants’ motion
to dismiss the public health organizations’ suit for lack of subject-matter jurisdiction because
those plaintiffs have not suffered the required injury to support standing, and grant Defendants’
cross-motion for summary judgment in the states’ suit because the rule is neither arbitrary nor
capricious.
Background
A. Statutory and Regulatory Background
1. The OSH Act
The Occupational Safety and Health Act, 29 U.S.C. § 651 et seq. (the “OSH Act”)
authorizes the Secretary of Labor to promulgate regulations that require employers to “make,
keep and preserve, and make available to the Secretary,” occupational health records. Id.
§ 657(c)(1); see also id. § 657(c)(2) (authorizing the Secretary to issue regulations requiring
employers to “maintain accurate records of, and to make periodic reports on, work-related
deaths, injuries and illnesses”). The Act also provides that, “the Secretary . . . shall develop and
2 maintain an effective program of collection, compilation, and analysis of occupational safety and
health statistics.” Id. § 673(a).
Under this authority, the Occupational Safety and Health Administration (“OSHA”)
requires employers with more than 10 employees to complete three forms documenting
workplace injury and illness. First, Form 300, “Log of Work-Related Injuries and Illnesses,” is
an annual incident log that contains basic information about each incident. Form 301, “Injury
and Illness Incident Report,” provides more narrative details for each incident. Finally, Form
300A, “Summary of Work-Related Injuries and Illnesses,” is an annual summary of all logged
incidents. See 29 C.F.R. § 1904.29. Historically, employers submitted these forms only upon
request, typically during workplace inspections or through industry-specific surveys.
2. The Electronic Filing Rule
In May 2016, OSHA promulgated a rule (“the Electronic Filing Rule”) requiring
employers with 250 or more employees to electronically submit all three forms annually. See
Improve Tracking of Workplace Injuries and Illnesses, 81 Fed. Reg. 29,624 (May 12, 2016).
The rule also required that in certain industries, employers with only 20 or more employees must
annually submit Form 300A. See id. The rule’s preamble specified that collected data would be
published to OSHA’s website. Id. at 29,625. OSHA thus determined that with “the information
obtained through this final rule, employers, employees, employee representatives, the
government, and researchers may be better able to identify and mitigate workplace hazards and
thereby prevent worker injuries and illnesses.” Id. at 29,629. The Electronic Filing Rule noted
that all data from Form 300A could be made available, but to protect worker privacy, certain
personally identifiable information (PII) would need to be redacted before publishing Forms 300
and 301. Id. at 29,632. The rule also noted that software would be used to eliminate PII from
the published forms. Id.
3 OHSA intended the Electronic Filing Rule to come into effect over several years. And
the first deadline—July 1, 2017—would only require employers to submit Form 300A for
calendar year 2016. 81 Fed. Reg. at 29,640. But on June 28, 2017, shortly before this first filing
deadline, OSHA issued a notice of proposed rulemaking (NPRM) to delay the deadline. See
Improve Tracking of Workplace Injuries and Illnesses: Proposed Delay of Compliance Date, 82
Fed. Reg. 29,261 (proposed June 28, 2017). And in November, OSHA published a final rule
delaying the first deadline until December 15, 2017. See Improve Tracking of Workplace
Injuries and Illnesses: Delay of Compliance Date, 82 Fed. Reg. 55,761 (November 24, 2017).
Then, in May 2018—after the first filing deadline had passed—OSHA posted an announcement
on its website, specifying that again for 2017, employers would be expected only to provide
Form 300A. Civil Action No. 19-166, ECF No. 1 (“Public Health Pls. Compl.”), ¶ 22. The
announcement also informed the public that OSHA was not accepting Forms 300 and 301 and
would issue a NPRM to reconsider, revise, or remove provisions of the Electronic Filing Rule.
Id.
On July 30, 2018, OSHA issued a NPRM for a rule that would rescind the electronic
filing requirements for Forms 300 and 301. See Tracking of Workplace Injuries and Illnesses, 83
Fed. Reg. 36,494 (proposed July 30, 2018). OSHA proposed the continued electronic collection
of Form 300A, the summary form, but a return to only occasional collection of Forms 300 and
301. OSHA cited several justifications for the proposed rule change: risks to worker privacy, the
relative uncertainty of the benefits that the data in Forms 300 and 301 may provide, and the
opportunity cost of diverting limited resources from other enforcement efforts. Id. OSHA also
raised several issues for the public to address during the comment period, including the efficacy
of the software intended to remove PII from these forms. Id. at 36,505.
4 3. The Revised Rule
On January 25, 2019, OSHA issued its Final Rule (“the Revised Rule”) formally
rescinding the requirement for electronic submission of Forms 300 and 301 but leaving in place
the requirement to submit form 300A. See Tracking of Workplace Injuries and Illnesses, 84 Fed.
Reg. 380 (January 25, 2019). As the basis for the Revised Rule, OSHA cited worker privacy and
the resources necessary to avoid accidental disclosure of workers’ PII. OSHA noted that while
none of the forms request PII, such information is sometimes inadvertently included alongside
the requested information. Id. at 384. And OSHA also determined that automated PII-stripping
software could not adequately protect worker privacy. Instead, OSHA concluded, its collection
of Forms 300 and 301 would require a manual review process to eliminate PII and other
contextual information that might allow the re-identification of impacted workers. Id. at 392.
And even if it employed a costly manual screening process to remove PII, OSHA noted that it
was possible that workers still could be reidentified. Id. at 384.
Alongside these costs, OSHA also concluded that third-party entities would not benefit
from continued form collection because the data would not be published. Id. at 391 (noting
OSHA had previously “determined publishing the data would do more harm than good” and did
not intend to release it.). OSHA also contended that the “data from Forms 300 and 301 would be
exempt from disclosure under FOIA exemptions.” Id. at 383. OSHA acknowledged that it may
have to release information due to FOIA requests but suggested that any resulting benefits are
“uncertain.” Id. Beyond the lack of benefits to outside entities, the Revised Rule also
concluded that any benefits to OSHA itself are “uncertain.” It noted that OSHA has “no prior
experience” using the data collected in Forms 300 and 301 and is “unsure how much benefit such
data would have for [enforcement and outreach] purposes.” Id. at 388. And it discussed
OSHA’s experience using the data collected from Form 300A for enforcement purposes. Id. In
5 the end, OSHA “determined that the best use of the agency’s resources at this time is full
utilization of 300A and severe injury data, . . . especially when OSHA itself will continue to
protect workers by accessing Forms 300 and 301 through on-site inspections and for specific
enforcement actions as needed.” Id. at 391. As a result, OSHA decided to cease electronic
collection of Forms 300 and 301 and instead direct resources towards “enforcement efforts and
compliance assistance, rather than collecting data with uncertain benefits.” Id. at 393.
B. Plaintiffs’ Lawsuits
In Public Citizen Health Research Group, et al. v. Pizzella, 19-cv-166, plaintiffs are three
public-health advocacy groups: Public Citizen Health Research Group, the American Public
Health Association, and the Council of State and Territorial Epidemiologists (collectively, the
“Public Health Plaintiffs”). The Public Health Plaintiffs assert that they are advocacy groups
engaged in research, education, and advocacy on matters of public health, including issues of
workplace health and safety. They sue the Secretary of Labor, the Department of Labor, and
OSHA, asserting that OSHA’s promulgation of the Revised Rule violates the Administrative
Procedure Act (“APA”), 5 U.S.C. § 500 et seq.2 See Public Health Pls. Compl. ¶¶ 1, 2. More
specifically, they allege that the Revised Rule is arbitrary and capricious because (1) OSHA has
“failed to provide a reasoned explanation for reversing its position”; (2) the Revised Rule is “not
a product of reasoned decision-making”; and (3) OSHA failed to adequately respond to
comments made during rulemaking. Id. at 10. They ask this Court to vacate the Revised Rule.
Id. at 11.
2 The Public Health Plaintiffs also filed an earlier related suit through which they sought a preliminary injunction requiring OSHA to stop delay of the Electronic Filing Rule’s deadlines and to accept all three forms, which this Court denied. See Pub. Citizen Health Research Group v. Acosta, 363 F. Supp. 3d 1 (2018) (“Public Citizen I”). Ultimately, the Court dismissed that suit for lack of subject-matter jurisdiction after OSHA promulgated the Revised Rule.
6 The second group of plaintiffs, the State of New Jersey, the State of Illinois, the State of
Maryland, the Commonwealth of Massachusetts, the State of Minnesota, and the State of New
York (collectively, the “State Plaintiffs”) also challenge OSHA’s rescission of the reporting
requirements for Forms 300 and 301. Civil Case No. 19-621, ECF No. 1 (“State Pls. Compl.”),
¶ 2. They argue that the Revised Rule is arbitrary and capricious because (1) OSHA failed to
consider “important aspects of the issue”; (2) OSHA’s explanation for the rule is “contrary to the
evidence that was before them”; (3) OSHA failed to address the benefits of the Electronic Filing
Rule, as raised by commenters; and (4) OSHA failed to provide an “adequately reasoned
explanation” for departure from the Electronic Reporting Rule. Id. ¶¶ 102, 103. For these
reasons, they urge the Court to vacate the rule and order OSHA to implement all aspects of the
Electronic Filing Rule. Id. ¶ 104.
The State Plaintiffs noticed their case as related to the Public Health Plaintiffs’ case, Civil
Case No. 19-621, ECF No. 2, and at the request of the parties, the Court entered a joint
scheduling order, Civil Case No. 19-621, ECF No. 14. Both sets of Plaintiffs moved for
summary judgment. See Civil Case No. 19-166, ECF No. 16 (“Public Health Pls. MSJ”); Civil
Case No. 19-621, ECF No. 18 (“State Pls. MSJ”). In response, Defendants moved to dismiss the
Public Health Plaintiffs’ complaint, and in the alternative, for summary judgment. See Civil
Case No. 19-166, ECF No. 17 (“Defs. MSJ”). They also moved for summary judgment in the
case brought by the State Plaintiffs. Civil Case No. 19-621, ECF No. 20.
Legal Standard
A motion to dismiss under Federal Rule of Civil Procedure 12(b)(1) “presents a threshold
challenge to the court’s jurisdiction.” Haase v. Sessions, 835 F.2d 902, 906 (D.C. Cir. 1987). As
federal courts are courts of limited jurisdiction, it is “presumed that a cause lies outside this
7 limited jurisdiction.” Kokkonen v. Guardian Life Ins. Co., 511 U.S. 375, 377 (1994). Thus,
when faced with a motion to dismiss under Rule 12(b)(1), “the plaintiff bears the burden of
establishing jurisdiction by a preponderance of the evidence.” Moran v. U.S. Capitol Police Bd.,
820 F. Supp. 2d 48, 53 (D.D.C. 2011) (citing Lujan v. Defenders of Wildlife, 504 U.S. 555, 561
(1992)). In reviewing such a motion, while the Court is not limited to the allegations in the
complaint and may consider materials outside the pleadings, the Court must “accept all of the
factual allegations in [the] complaint as true.” Jerome Stevens Pharm., Inc. v. FDA, 402 F.3d
1249, 1253 (D.C. Cir. 2005) (alteration in original) (quoting United States v. Gaubert, 499 U.S.
315, 327 (1991)).
“Summary judgment is appropriately granted when, viewing the evidence in the light
most favorable to the non-movants and drawing all reasonable inferences accordingly, no
reasonable jury could reach a verdict in their favor.” Lopez v. Council on Am.-Islamic Relations
Action Network, Inc., 826 F.3d 492, 496 (D.C. Cir. 2016). “The evidence presented must show
‘that there is no genuine dispute as to any material fact and the movant is entitled to judgment as
a matter of law.’” Id. (quoting Fed. R. Civ. P. 56(a)). In an APA case in which both parties have
moved for summary judgment, “the district judge sits as an appellate tribunal” and “[t]he entire
case on review is a question of law.” Am. Bioscience, Inc. v. Thompson, 269 F.3d 1077, 1083
(D.C. Cir. 2001) (internal quotation marks and footnote omitted). “Summary judgment . . .
serves as the mechanism for deciding, as a matter of law, whether the agency action is supported
by the administrative record and otherwise consistent with the APA standard of review.” Kadi v.
Geithner, 42 F. Supp. 3d 1, 9 (D.D.C. 2012).
Under the APA, courts must “hold unlawful and set aside” agency action that is
“arbitrary, capricious, [or] an abuse of discretion.” 5 U.S.C. § 706(2)(A). An agency action is
8 arbitrary and capricious if the agency has “entirely failed to consider an important aspect of the
problem, [or] offered an explanation for its decision that runs counter to the evidence before the
agency.” Motor Vehicle Mfrs. Ass’n of U.S., Inc. v. State Farm Mut. Auto. Ins. Co., 463 U.S. 29,
43 (1983). The scope of review under the “arbitrary and capricious” standard is narrow and “a
court is not to substitute its judgment for that of the agency.” Id. Even so, the agency must
articulate a satisfactory explanation for its action including a “rational connection between the
facts found and the choice made.” Burlington Truck Lines v. United States, 371 U.S. 156, 168
(1962). As a result, a court’s review is limited to deciding whether the agency’s “decision was
based on a consideration of the relevant factors and whether there has been a clear error in
judgment.” Ctr. For Auto Safety v. Peck, 751 F.2d 1336, 1342 (D.C. Cir. 1985). The reviewing
court should not attempt to make up for such deficiencies itself: “[A court] may not supply a
reasoned basis for the agency’s action that the agency itself has not given.” Motor Vehicle Mfrs.
Ass’n, 463 U.S. at 43. The court will, however, “uphold a decision of less than ideal clarity if the
agency’s path may reasonably be discerned.” Bowman Transp. Inc. v. Arkansas-Best Freight
System, 419 U.S. 281, 286 (1974).
Analysis
A. Defendants’ Motion to Dismiss the Public Health Plaintiffs’ Complaint for Lack of Standing
The jurisdiction of the federal courts extends only to cases and controversies of the
“justiciable sort referred to in Article III”—in other words, claims the plaintiff can show they
have “standing” to bring. Lujan, 504 U.S. at 560. To satisfy the standing requirement, a plaintiff
must establish at a minimum that (1) he has “suffered an injury in fact—an invasion of a legally
protected interest which is (a) concrete and particularized, and (b) actual or imminent, not
conjectural or hypothetical,” (2) “a causal connection” exists between the injury and the
9 challenged conduct, and (3) a favorable decision will likely redress the injury. Id. at 560–61
(citations and internal quotation marks omitted).
Defendants argue that the Public Health Plaintiffs lack injury-in-fact and therefore their
complaint should be dismissed for lack of subject-matter jurisdiction. See Defs. MSJ at 11; Fed.
R. Civ. P. 12(b)(1).3 In response, the Public Health Plaintiffs claim that OSHA’s decision to
refrain from collecting and publishing the data from Forms 300 and 301 injures them in two
ways: (1) it “substantially limits the type and amount of workplace injury or information” that is
available to conduct research analyzing illness and injury threats to workers and (2) it impedes
their organizational activities. Civil Action No. 19-166, ECF No. 16-1 (“Carome Decl.”), ¶ 11.
The threshold showing that plaintiffs must make for each element of standing “depends
on the stage of the litigation.” Food and Water Watch, Inc. v. Vilsack, 808 F.3d 905, 913 (D.C.
Cir. 2015). In evaluating the Public Health Plaintiffs’ standing at the motion to dismiss stage,
the Court must presume that they will succeed in their merits claims. See City of Waukesha v.
E.P.A., 320 F.3d 228, 235 (D.C. Cir. 2003). But the Public Health Plaintiffs must allege facts
satisfying each element of standing to survive a motion to dismiss.
1. Informational Injury
The Public Health Plaintiffs’ first claim is one of informational injury. To establish
informational injury, a plaintiff must show that “1) it has been deprived of information that, on
its interpretation, a statute requires the government or a third party to disclose to it, and 2) it
suffers, by being denied access to that information, the type of harm Congress sought to prevent
by requiring disclosure.” Elec. Priv. Info. Ctr. v. Presidential Advisory Comm’n on Election
3 Defendants do not contest State Plaintiffs’ standing.
10 Integrity, 878 F.3d 371, 378 (D.C. Cir. 2017) (quoting Friends of Animals v. Jewell, 828 F.3d
989, 992 (D.C. Cir. 2016)).
The Public Health Plaintiffs fail to satisfy the first requirement and thus fail to establish
informational injury. First, they must point to a statutory provision that requires disclosure of the
information at issue. See Friends of Animals, 828 F.3d at 992. The Public Health Plaintiffs cite
the Freedom of Information Act (FOIA)—rather than the OSH Act or any similar statute—as the
law that purportedly requires disclosure of the information. Civil Action No. 19-166, ECF No.
19 (“Public Health Pls. Opp.”), at 2. But FOIA does not require the disclosure of any specific
information to anyone; it applies across the entire executive branch to require access to records
when a request has been made and its exemptions are inapplicable. Dep’t of State v. Ray, 502
U.S. 164, 173 (1991). Thus, even if the information at issue is available to the Public Health
Plaintiffs through FOIA, to hold that that FOIA is a statute that satisfies the first requirement for
informational injury would all but eviscerate the requirement. And indeed, the second
requirement—that plaintiffs suffer “the type of harm Congress sought to prevent by requiring
disclosure”—also suggests that the statute at issue must require the disclosure of specific
information. The Public Health Plaintiffs have cited no case in which a court found that FOIA
satisfied the first requirement for informational injury, and in one recent case in this District, the
court specifically rejected that proposition. See Judicial Watch, Inc. v. Office of Dir. of Nat'l
Intelligence, No. 1:17-CV-00508 (TNM), 2018 WL 1440186, at *3 (D.D.C. Mar. 22, 2018)
(finding no informational standing for challenge brought under Intelligence Community
Directive where Plaintiff relied on FOIA for a disclosure requirement).
The Public Health Plaintiffs point to Waterkeeper Alliance v. E.P.A., 853 F.3d 527 (D.C.
Cir. 2017) to suggest that informational injury can be established where the agency’s
11 information-gathering and information-disclosure obligations arise from different statutes. In
Waterkeeper Alliance, the plaintiffs established informational standing to challenge a rule
promulgated under the Comprehensive Environmental Response, Compensation, and Liability
Act (CERCLA). The rule exempted farms from CERCLA’s requirement that covered entities
report to the government air releases from animal waste, information that then would have
otherwise been reportable by the government to the public under the requirements of the
Emergency Planning and Community Right-to-Know Act (EPCRA). Id. at 532. The D.C.
Circuit found that the plaintiffs had suffered an informational injury, even though CERCLA
itself contained no public disclosure requirements. Id. at 533. The Court found that EPCRA’s
disclosure requirements were “expressly tied” to CERCLA, explicitly piggybacking on
CERCLA’s government notification mandates. Id. That is not the situation here. The OSH Act
and FOIA do not present the same “complex interplay” as the two statutes at issue in
Waterkeepers. Id. Here, the only potential link between OSH and FOIA is the Electronic Filing
Rule’s preamble, which references FOIA and notes that OSHA would make the data from Forms
300 and 301 available through FOIA requests. 81 Fed. Reg. at 29,658–62. But this non-binding
provision of an agency regulation is far too attenuated a link between these two statutes to
conclude that they are “expressly tied” to each other, or suggest the kind of “complex interplay”
between them that would provide the basis for informational standing. 4 See Friends of Animals,
828 F.3d at 993 (finding no informational injury despite statute’s disclosure provision where
4 Plaintiff’s invocation of Envtl. Integrity Project v. McCarthy, 139 F. Supp. 3d 25, 38 (D.D.C. 2015) fails for similar reasons. There, the challenged regulation was promulgated under a statute that “contained a public disclosure provision that expressly require[d] that any records, reports, or information obtained under the statute . . . shall be available to the public.” Id. at 36.
12 plaintiffs were suing to enforce a separate provision that did not mandate the disclosure of
information).
The Public Health Plaintiffs also argue that this Court’s decision in Public Citizen I
suggested that their entitlement to the information at issue under FOIA could satisfy the first
informational injury requirement. Not so. The Court merely held, in addressing the
redressability element of standing, that the likelihood that the Public Health Plaintiffs could
obtain the information at issue through FOIA could be part of a casual chain, beginning with a
favorable court decision, that would redress any injury-in-fact they had suffered. See Public
Citizen I, 363 F. Supp. 3d at 14.
2. Organizational Injury
The Public Health Plaintiffs offer a second injury to support standing: impact on their
organizational activities. Assessing this kind of injury involves a two-part inquiry (1) “whether
the agency’s action or omission to act ‘injured the [organization’s] interest’” and (2) whether
“the organization ‘used its resources to counteract that harm.’” People for the Ethical Treatment
of Animals v. Dep’t. of Agric., 797 F.3d 1087, 1094 (D.C. Cir. 2015) (“PETA”) (quoting Equal
Rights Ctr. v. Post Props, Inc., 633 F.3d 1136, 1140 (D.C. Cir. 2011)); see also Havens Realty
Corp. v. Coleman, 455 U.S. 363, 379 (1982) (finding organizational injury where there is an
“injury to the organization’s activities” and “[a] consequent drain on the organization’s
resources.”). The Public Health Plaintiffs fail to satisfy this first prong, and thus fail to prove
organizational, and well as informational, standing.
To satisfy the first prong, the organization “must plausibly allege that the challenged
conduct ‘perceptibly impaired [its] ability to provide services’ by causing an ‘inhibition of [the
organization’s] daily operations.’” Texas Low-Income Hous. Information Service v. Carson, 427
F. Supp. 3d 43, 52 (D.D.C. 2019) (quoting Food & Water Watch, Inc., 808 F.3d 905 at 919).
13 “[T]he Court’s task is to differentiate between ‘organizations that allege that their activities have
been impeded’—which suffices for standing purposes—‘from those that merely allege that their
mission has been compromised’—which does not.” Citizens for Responsibility & Ethics in
Washington v. U.S. Office of Special Counsel, No. 19-cv-3757 (JEB), 2020 WL 4530647, at *5
(D.D.C. Aug. 6, 2020) (quoting Abigail All. for Better Access to Developmental Drugs v.
Eschenbach, 469 F.3d 129, 133 (D.C. Cir. 2006)).
The Public Health Plaintiffs fail to show that the organizations’ daily operations are
“inhibit[ed] . . . in a concrete way” by Defendants’ actions. See Citizens for Responsibility and
Ethics in Washington, 2020 WL 4530647 at *5 (D.D.C. August 6, 2020) (citing PETA, 797 F.3d
at 1094). They allege that they “have lost access to an important source of timely, establishment-
specific information” that is otherwise unavailable, see Public Health Pls. Compl. ¶ 7, but they
have failed to show this deprivation has directly inhibited their daily operations. Nor could they.
The Public Health Plaintiffs essentially argue that they are being deprived of an anticipated
benefit—the data from Forms 300 and 301. And in so doing, they can only describe how they
“intended to use” or “would have used” the data “that would have been available” under the
Electronic Filing Rule. Civil Action No. 19-166, ECF No. 16-2 (“Benjamin Decl.”), ¶ 4;
Carome Decl. ¶ 3; Civil Action No. 19-166, ECF No. 16-3 (“Harrison Decl.”), ¶ 9. This data
never played a role in the Public Health Plaintiffs’ ability to provide services or their daily
operations. Thus, the Revised Rule, which effectively withholds this data from them, could not
have perceptively impaired their ability to provide those services or inhibited those daily
operations. And the Public Health Plaintiffs do not point to any case in which a court has held
that an organization’s interest suffered injury for standing purposes in a similar situation.
14 For similar reasons, the Public Health Plaintiffs have not shown that they meet the second
prong of the organizational standing test: that they expended resources to counteract their alleged
injuries. To satisfy this requirement, an organization must expend resources in response to the
impairment of its ability to provide services. Litigation or advocacy expenses do not satisfy this
requirement. See Food & Water Watch, 808 F.3d at 919 (“Our precedent makes clear that an
organization’s use of resources for litigation, investigation in anticipation of litigation, or
advocacy is not sufficient to give rise to an Article III injury.”). And a plaintiff organization
“cannot convert its ordinary program costs into an injury in fact.” Nat’l Taxpayers Union, Inc. v.
United States, 68 F.3d 1428, 1434 (D.C. Cir. 1995).
Each of the Public Health Plaintiffs claim that the loss of data they would have received
from Forms 300 and 301 will set back their efforts, but none assert that they spent any money to
counteract this harm. See Carome Decl. ¶ 11 (concluding OSHA’s rescission of the Electronic
Filing Rule substantially curtails the type and amount of workplace injury data HRG will be able
to use to conduct research); Benjamin Decl. ¶ 6 (explaining without this data it is significantly
harder to identify workplace hazards and to develop policies accordingly); Harrison Decl. ¶ 9
(alleging the 2019 Final Rule has caused CTSE and its members to lose access to an important
source of injury and illness information). Instead, they represent that their failure to receive this
data will require them to “continue to use data available from other sources, [but] such data is not
as complete and is more difficult to gather.” Public Health Pls. Opp. at 8. But simply
maintaining their current operational costs cannot help them stablish organizational injury. See
Nat’l Taxpayers Union, 68 F.3d at 1434 (finding no injury without any evidence that
organization was subject “to operational costs beyond those normally expended”). Thus, they
15 have failed to show the “consequent drain on the organization’s resources” necessary to establish
organizational injury. Havens Realty Corp., 455 U.S. at 379.
Since the Public Health Plaintiffs have failed to show an impairment of their ability to
provide services, nor expenditures to counteract that impairment, they do not have an injury to
support organizational standing. Thus, the Court must dismiss their complaint for lack of
subject-matter jurisdiction.5
B. Defendants’ and the State Plaintiffs’ Motions for Summary Judgment on the State Plaintiffs’ APA Claim
The State Plaintiffs argue that the Revised Rule violates APA for three broad reasons: (1)
OSHA’s calculation of the costs of collecting Forms 300 and 301 was arbitrary and capricious;
(2) OSHA’s calculation of the benefits of collecting Forms 300 and 301 was also arbitrary and
capricious; and (3) OSHA’s reasoning was internally consistent regarding the Revised Rule’s
costs and benefits.
1. OSHA’s Assessment of the Costs of Collecting Forms 300 and 301
A. Changes to OSHA’s Privacy Risk Assessment
First, the State Plaintiffs argue that OSHA’s privacy risk assessment in the Revised Rule
is “contrary to the evidence before the agency and not supported by sufficient reasoning.” State
Pls. MSJ at 18. And it is true that agency action “based on a factual premise that is flatly
contradicted by the agency’s own record does not constitute reasoned administrative
decisionmaking, and cannot survive review under the arbitrary and capricious standard.” City of
5 The Public Health Plaintiffs point out that in Public Citizen I, in denying Defendants’ motion to dismiss for lack of subject-matter jurisdiction, this Court found that they had organizational standing to pursue substantially similar claims, a ruling at odds with the one here. Public Citizen I, 363 F. Supp. 3d at 12. The Court notes that for whatever reason, Defendants in that case only contested redressability and not injury-in-fact, so the Court did not have the benefit of the briefing on the injury-in-fact requirement that the parties have provided here. And in any event, that case was eventually dismissed for lack of subject-matter jurisdiction on other grounds.
16 Kansas City, Mo. v. Dep’t of Hous. & Urban Dev., 923 F.2d 188, 194 (D.C. Cir. 1991). State
Plaintiffs argue that the change in how OSHA treated privacy risks from the Electronic
Reporting Rule to the Revised Rule is evidence of such contradiction. See Civil Action No. 19-
166, ECF No. 1 (“State Pls. Compl.”), ¶ 103; see also Ass’n of Priv. Sector Colls. & Univs. v.
Duncan, 681 F.3d 427, 441 (D.C. Cir. 2012) (“An agency’s departure from past practice can . . .
if unexplained, render regulations arbitrary and capricious.”). And the State Plaintiffs note that
“OSHA carefully considered [privacy issues] when it promulgated the Electronic [Filing] Rule in
2016” and “identified numerous actions it would take” to mitigate privacy concerns. State Pls.
MSJ at 16. They insist that the Revised Rule “cites no new evidence” to support OSHA’s
“abrupt change of position.” Id. at 17. For that reason, the State Plaintiffs argue, this new
position is insufficiently justified and contrary to the evidence before the agency. Id.
But the Revised Rule’s conclusion about the privacy risks at stake is not based on a
factual premise “flatly contradicted by the agency’s own record.” City of Kansas City, 923 F.2d
at 194. Both the Electronic Filing Rule and the Revised Rule reflect OSHA’s concern with the
privacy risks associated with the collection of Forms 300 and 301. Compare 81 Fed. Reg. at
29,632 with 84 Fed. Reg. at 385. The Revised Rule merely reflects a change in the level of risk
to privacy that OSHA found acceptable, rather than new information about those risks. And, for
what it’s worth, OSHA characterized that change as merely “restor[ing] OSHA’s historical
emphasis on protecting the privacy of workers and its longstanding practice of releasing sensitive
data on a case-by-case basis only to those with a ‘need to know.’” See 84 Fed. Reg. at 384. The
State Plaintiffs evidently disagree with that change. But that hardly makes OSHA’s changed
position contrary to the record before it.
17 In addition, despite the State Plaintiffs’ suggestions otherwise, OSHA need not meet a
special burden to adjust the level of risk to privacy that it found acceptable. See F.C.C. v. Fox
Television Stations, Inc., 556 U.S. 502, 514 (2009) (there is “no basis in the Administrative
Procedure Act or in [Supreme Court] opinions for a requirement that all agency change be
subjected to more searching review.”). Of course, an agency should “display awareness that [the
agency] is changing position,” but “the APA imposes no special burden when an agency elects to
change course.” Home Care Ass’n of Am. v. Weil, 799 F.3d 1084, 1094–95 (D.C. Cir. 2015).
But the Revised Rule acknowledges that OSHA changed its position about the level of risk to
privacy it found acceptable. Indeed, the Revised Rule describes how “OSHA considered the
issue of worker privacy in the 2016 final rule and included protections to reduce the likelihood of
sensitive information being made public.” 84 Fed. Reg. at 385. But OSHA concluded that it “no
longer views such protections as sufficient,” given the effectiveness of PII-removing software, as
well as the risk of reidentification. Id.
Similarly, the State Plaintiffs’ argument that OSHA must provide “a more detailed
justification than what would suffice for a new policy created on a blank slate” because the “new
policy rests upon factual findings that contradict those which underlay its prior policy” fails. Fox
Television, 556 U.S. at 515. As already discussed, the Revised Rule does not stem from new
factual findings, but a change in the level of risk to privacy that the agency found acceptable.
Thus, it is enough that OSHA has shown awareness of and a reasoned explanation for its change.
See Home Care Ass’n, 799 F.3d at 1095.
B. OSHA’s Privacy Standard
Next, the State Plaintiffs argue that OSHA’s determination that manual review of Forms
300 and 301 is required is unsupported by the record in two ways. State Pls. MSJ at 18. They
18 contend that OSHA adopted a standard for handling PII that is a “100 percent privacy
guarantee[]” and that is “an unreasonable and unrealistic standard for any entity to set.” Id. at
19. They also assert that the record does not support OSHA’s privacy concerns nor the need for
a two-tiered manual review process. Id. Of course, if OSHA’s action is arbitrary, capricious,
and unsupported by the record, it would violate the APA. See 5 U.S.C. § 706. But it complies
with the statute if is supported by “such relevant evidence as a reasonable mind might accept as
adequate” to do so. See Sage IT, Inc. v. Cissna, 314 F. Supp. 3d 203, 207 (D.D.C. 2018)
(quoting Consolo v. Fed. Mar. Comm’n, 383 U.S. 607, 620 (1966)).
To begin with, OSHA did not, as the State Plaintiffs say, require the manual review of
Forms 300 and 301 to reduce the privacy risk to zero. Instead, the comments that the State
Plaintiffs string together in their brief merely reflect that OSHA considered the relevant privacy
risks. See 84 Fed. Reg. at 385 (“Although OSHA previously thought to address this issue with
software, de-identification software is not 100% effective, and OSHA believes that some PII
could be released even after being processed through the software.”). Specifically, the Revised
Rule reflects that OSHA decided that manual review of the forms was needed to avoid
“expos[ing] sensitive worker information to a meaningful risk of disclosure”—not no risk. Id. at
387 (emphasis added). Otherwise, inasmuch as the State Plaintiffs again question the level of
privacy risk that OSHGA found acceptable, for reasons already explained, OSHA did not violate
the APA by prioritizing privacy interests as it did; making such a value judgment is well within
its discretion. State Farm, 463 U.S. at 43 (“[A] court is not to substitute its judgment for that of
the agency.”).6
6 In addition, OSHA’s determination of the privacy risk it found acceptable was of course not the end of the story; it then considered that risk as part of a “balancing test to weigh the value of
19 Moreover, OSHA’s privacy concerns, and its determination that a manual review process
was necessary to remove PII from Forms 300 and 301, are not contrary to or lacking support in
the record. As for OSHA’s privacy concerns, the Revised Rule explains that employers often
submit PII, even though Forms 300 and 301 do not require it. 84 Fed. Reg. at 384. Citing
comments in the administrative record, the rule then explains that automated software may be
able to eliminate some of this inadvertently submitted PII, but that it is not capable of the level of
review needed to prevent re-identification. Id. And as for OSHA’s determination that a manual
review process is necessary, the State Plaintiffs also argue that automated review is enough—and
even that two-tier manual review is potentially less effective. State Pls. MSJ at 19–20. They cite
evidence in the administrative record for the proposition that automated processes “have been
shown to allow for high accuracy” and that the problems they have “are also shared with manual
de-identification approaches.” Id. at 20. But the authorities cited by the State Plaintiffs refer to
the removal of PII in clinical medical records. See Civil Case No. 19-621, ECF No. 26-1 at 78
(explaining that de-identification targets specific identifiers like “personal names and social
security numbers”). Instead, the Revised Rule focuses on the risk of re-identification because of
non-PII information contained in Forms 300 and 301. And on that score, OSHA determined that
“even if PII could be completely removed from the data, concerns about re-identification would
remain.” 84 Fed. Reg. at 384. Moreover, the Revised Rule states that “particularly in a small
town,” information like “what was the employee doing just before the incident occurred, what
happened, and what was the injury or illness” could allow re-identification. Id. (cleaned up).
The articles cited by the State Plaintiffs do not discuss the efficacy of software in removing this
worker privacy against the usefulness of releasing the data.” 84 Fed. Reg. at 384; see also Civil Case No. 19-621, ECF No. 25 (“Defs. Reply”) at 12–13.
20 kind of contextual information. Thus, neither OSHA’s privacy concerns nor its assessment that
manual review is necessary to prevent re-identification is unsupported by or contrary to the
record. Both are supported by “such relevant evidence as a reasonable mind might accept as
adequate.” Sage IT, Inc., 314 F. Supp. 3d 203 at 207 (quoting Consolo, 383 U.S. at 620).
C. Notice of OSHA’s Cost Assessment
The State Plaintiffs’ final cost-related argument is procedural. They argue that OSHA
failed to provide notice and the opportunity to be heard about the two-tier manual review process
described in the final Revised Rule. State Pls. MSJ at 20–22. “Notice requirements are designed
(1) to ensure that agency regulations are tested via exposure to diverse public comment, (2) to
ensure fairness to affected parties, and (3) to give affected parties an opportunity to develop
evidence in the record to support their objections to the rule and thereby enhance the quality of
judicial review.” Int'l Union, United Mine Workers of Am. v. Mine Safety & Health Admin., 407
F.3d 1250, 1259 (D.C. Cir. 2005). Thus, a proposed rule and the final rule may only differ to the
extent that the final rule is a “logical outgrowth” of the proposal. Envtl. Integrity Project v.
E.P.A., 425 F.3d 992, 996 (D.C. Cir. 2005); see also 5 U.S.C. § 553(c). “A final rule is a logical
outgrowth of a proposed rule only if interested parties should have anticipated that the change
was possible, and thus reasonably should have filed their comments on the subject during the
notice-and-comment period,” United Mine Workers of Am., 407 F.3d at 1259 (quotations
omitted).
State Plaintiffs argue that OSHA violated the APA when it determined, for the first time
in the final Revised Rule, that a two-tiered manual review process was necessary to protect PII.
State Pls. MSJ at 21. The NPRM had anticipated use of an automated process to remove PII
from Forms 300 and 301. 83 Fed. Reg. at 36,503. OSHA thus determined that it would save
21 $53,000 to $64,000 per year if it no longer collected Forms 300 and 301. Id. But the final
Revised Rule determined that a manual review process would be necessary to adequately protect
privacy. Thus, the Revised Rule added roughly $7.5 million to its proposed savings to account
for the manual review process. 84 Fed. Reg. at 402.
Despite its impact on OSHA’s expected savings, the final Revised Rule is a logical
outgrowth of the proposed rule with respect to the methods OSHA proposed to use to protect PII.
Therefore, the notice the State Plaintiffs received was adequate. “[C]ases finding that a rule was
not a logical outgrowth have often involved situations where the proposed rule gave no
indication that the agency was considering a different approach, and the final rule revealed that
the agency had completely changed its position.” CSX Transp., Inc. v. Surface Transp. Bd., 584
F.3d 1076, 1081 (D.C. Cir. 2009). Here, the NPRM conveyed that OSHA was assessing the
proposed automated review of the forms to determine whether that review was adequate to
protect PII. The NPRM even asked for comment on the issue. See 83 Fed. Reg. at 36,500
(“What risks to worker privacy are posed by the electronic collection of information from Forms
300 and 301[?] How could OSHA make [these risks] less likely, and what resources would be
required?” Id. (“[W]hat other agencies and organizations in the public and private sectors use
automated de-identification systems to remove PII from text data before making the data
available to the public? What challenges have they faced in using those systems to keep PII
protected?”). This was enough to put interested parties on notice that OSHA was reconsidering
its approach and weighing alternatives to the automated review process. See CSX Transp., 584
F.3d at 1081 (“[A] final rule represents a logical outgrowth where the NPRM expressly asked for
comments on a particular issue or otherwise made clear that the agency was contemplating a
22 particular change.”) Thus, the final Revised Rule is a logical outgrowth of the NPRM, and this
change did not violate the APA’s notice requirements.
2. OSHA’s Assessment of the Benefits of Collecting Forms 300 and 301
The State Plaintiffs also argue that OSHA did not properly consider evidence of potential
benefits of the collection of Forms 300 and 301. State Pls. MSJ at 22–26. “[A]n agency rule
would be arbitrary and capricious if the agency . . . entirely failed to consider an important aspect
of the problem.” State Farm, 463 U.S. at 43. And while “an agency’s decision need not be a
model of analytic precision to survive a challenge,” Frizelle v. Slater, 111 F.3d 172, 176 (D.C.
Cir. 1997) (cleaned up), it must be clear to the Court that an agency has “grapple[d] with”
evidence contradicting its position, see Aragon v. Tillerson, 240 F. Supp. 3d 99, 112 (D.D.C.
2017).
State Plaintiffs argue that Defendants failed to consider, or “blithely dismissed” the
benefits to three types of entities: (1) state programs addressing worker safety, (2) workers, their
representatives, and advocacy groups, and (3) researchers. State Pls. MSJ at 22. As evidence of
these benefits, they point to comments in the administrative record discussing the potential use of
Form 300 and 301 data for public health and occupational safety studies and efforts. Id. at 22,
23, 25.
The benefits at issue, however, would never accrue to these outside organizations (the
State Plaintiffs cite no benefits to OSHA) unless these entities successfully sued to receive Form
300 and 301 data through FOIA. This is so because even before the rulemaking process related
to the Revised Rule, OSHA decided not to make the data publicly available. 84 Fed. Reg. at 391
(noting OSHA “determined publishing the data would do more harm than good” and did not
intend to release it.). And it is OSHA’s view that the data would be exempt from public
disclosure under FOIA, so it will not produce them voluntarily in response to a FOIA request.
23 Thus, the Revised Rule concluded that “many of the benefits discussed by commenters would
not materialize.”7 84 Fed. Reg. at 391.
The Court can think of no reason why the APA required OSHA, when promulgating the
Revised Rule, to consider benefits that would accrue to outside entities only if those entities
successfully sued the agency for the information under FOIA. Regardless of the likelihood those
entities would be successful, such a holding would effectively require OSHA to consider FOIA a
reason why the information needed to be collected or created in the first place. That stretches the
effect of the statute too far. “[O]nly the Federal Records Act, and not the FOIA, requires an
agency to actually create records.” Kissinger v. Reporters Comm. for Freedom of the Press, 445
U.S. 136, 152 (1980). FOIA itself “does not obligate agencies to create or retain documents; it
only obligates them to provide access to those which it in fact has created and retained.” Id.
Moreover, even if OSHA had to consider the potential benefits accruing to these outside
entities if they mounted a successful FOIA lawsuit, the Revised Rule hardly “entirely failed” to
consider them. State Farm, 463 U.S. at 43. The rule acknowledged that commenters raised
these potential benefits. See 84 Fed. Reg. at 392–93 (“Commenters pointed to OSHA’s
statements in the 2016 final rule that collecting data from Forms 300 and 301 would allow the
agency to leverage its resources to execute its mission by . . . providing data to employers,
workers, unions and academics that would assist them in researching and innovating to improve
7 The State Plaintiffs also argue that OSHA committed to sharing data with state agencies through the Revised Rule. State Pls. MSJ at 23. But that argument misreads the plain language of the rule, which says “OSHA also notes, in response to a comment that some states have more limited surveillance capacity than others, that those states will have access to the summary data collected by OSHA.” 84 Fed. Reg. at 381. The phrase “summary data” refers to the information provided in Form 300A, “Summary of Work-Related Injuries and Illnesses,” which is still collected under the Revised Rule. See generally 84 Fed. Reg. at 380.
24 workplace safety and health.”); id. at 393 (“Although OSHA identified these potential benefits,
OSHA never quantified them.”). But OSHA “d[id] not ignore . . . the possibility that benefits
could result from collecting the data, but conclude[d] that the scope of any such benefits [was]
uncertain.” Id. Ultimately, OSHA concluded that it “does not believe that these uncertain
benefits justify the diversion of OSHA’s resources from other agency initiatives with a proven
record of effectiveness.” Id.8 And a court should not substitute its judgment for that of the
agency in such matters. See Burlington, 371 U.S. at 168.9 See also Envtl. Integrity Project v.
McCarthy, 139 F. Supp. 3d 25, 47 (D.D.C. 2015) (holding that EPA’s decision not to collect
information, so it could prioritize other enforcement tools, was not a clear error in judgment).
3. Internal Inconsistencies
Finally, the State Plaintiffs argue that OSHA’s weighing of the costs and benefits of the
Revised Rule is internally inconsistent. They note that OSHA’s assessment of the costs of
collecting Forms 300 and 301 presumes that the information in those forms will be released,
while its assessment of the benefits assumes that the information will not. State Pls. MSJ at 14.
And to be sure, “it would be arbitrary and capricious for [an] agency’s decision making to be
‘internally inconsistent.’” Nat. Res. Def. Council v. U.S. Nuclear Regul. Comm’n, 879 F.3d
8 State Plaintiffs also object to OSHA’s dismissal of the benefits of Form 300 and 301 data for research on the grounds “that researchers already have access to BLS data and severe injury data.” 84 Fed. Reg. at 391. But this remark does not mean that OSHA failed to recognize or consider these benefits. The Revised Rule does not say that BLS and other available data are perfect substitutes for the data collected from Forms 300 and 301. Instead, OSHA merely suggested that at least some of the benefits might be realized in other ways, such that lack of access to Form 300 and 301 data will not leave researchers in the dark. 9 The Electronic Filing Rule says that data from Forms 300 and 301 might be “of great use” to outside entities. 81 Fed. Reg. at 29,631. In contrast, the Revised Rule describes those benefits as “speculative.” But the preamble of the Electronic Filing Rule suggested that OSHA would publish the information gathered in the collection of Forms 300 and 301. Id. at 29,625. Afterward, OSHA decided to change course, which accounts for the change.
25 1202, 1214 (D.C. Cir. 2018) (quoting Air Transp. Ass’n of Am. v. Dep't of Transp., 119 F.3d 38,
43 (D.C. Cir. 1997)); see also Gen. Chemical Corp. v. United States, 817 F.2d 844, 854 (D.C.
Cir. 1987) (concluding that agency must weigh evidence “in a rational and consistent manner”).
But OSHA’s response explains how it can simultaneously claim that it “would not make
the data public even if collected,” 84 Fed. Reg. at 391, and that “collecting the data . . . would
subject sensitive worker information to a meaningful risk of public disclosure.” 84 Fed. Reg. at
383. Before it engaged in the rulemaking that led to the Revised Rule, OSHA decided to change
course and not voluntarily provide the data to the public. Thus, for the reasons already explained
above, OSHA did not need to consider the benefits of voluntarily disclosing the information to
the public, or even those benefits that could accrue if outside entities successfully sued for it
under FOIA—and even if it had to do the latter, it did. 84 Fed. Reg. at 393. At the same time,
again for reasons already explained above, even if OSHA did not voluntarily disclose the data to
the public, it had to weigh the possibility—perhaps even the likelihood 10—that these outside
entities might successfully sue to obtain the Form 300 and 301 data, so it had to consider the
more ascertainable costs of reducing the privacy risk to the point it found acceptable. 11 See id. at
10 See Pub. Citizen I, 363 F. Supp. 3d at 17. 11 The State Plaintiffs briefly raise a second inconsistency argument. They argue that the Revised Rule is inconsistent as to whether OSHA plans to use data from Forms 300 and 301 in its enforcement efforts. See State Pls. MSJ at 36–37. They claim that the Revised Rule cites the need to protect the confidentiality of enforcement efforts as a reason not to release Form 300 and 301 data. However, they argue, this conflicts with OSHA’s suggestion that it would not use this data for enforcement. But OSHA did not cite the confidentiality of enforcement efforts as a reason why it ceased collection of Forms 300 and 301. The portions of the rule that the State Plaintiffs cite for this proposition address only Form 300A. See 84 Fed. Reg. at 383 (“OSHA has already taken the position that Form 300A is exempt from disclosure under FOIA and that OSHA will not make such data public for at least the approximately four years after its receipt that OSHA intends to use the data for enforcement purposes.”).
26 381 (assessing costs of PII stripping for potential FOIA release). Nothing about OSHA’s
decision-making was logically inconsistent. In fact, this argument appears merely a rehashing of
the State Plaintiffs’ earlier challenges to how OSHA assessed the benefits of the Revised Rule.
At bottom, “cost-benefit analyses epitomize the types of decisions that are most
appropriately entrusted to the expertise of an agency.” Off. of Commc’n of United Church of
Christ v. F.C.C., 707 F.2d 1413, 1440 (D.C. Cir. 1983). And despite the State Plaintiffs’
insistence, it was not arbitrary and capricious for OSHA to prioritize “other agency initiatives
with a proven record of effectiveness” over those with “uncertain benefits.” 84 Fed. Reg. at 393.
See In re Barr Labs., Inc., 930 F.2d 72, 76 (D.C. Cir. 1991) (“The agency is in a unique—and
authoritative—position to view its projects as a whole, estimate the prospects for each, and
allocate its resources in the optimal way. Such budget flexibility as Congress has allowed the
agency is not for us to hijack.”).
Conclusion
For all the above reasons, Defendants’ Motion to Dismiss, ECF No. 17 in Civil Action
No. 19-166, and Motion for Summary Judgment, ECF No. 20 in Civil Action No. 19-621, will be
granted and Plaintiffs’ Motions for Summary Judgment, ECF No. 16 in Civil Action No. 19-166
and ECF No. 18 in Civil Action No. 19-621, will be denied. A separate order will issue.
/s/ Timothy J. Kelly TIMOTHY J. KELLY United States District Judge
Date: January 11, 2021