The Center for Investigative Reporting v. United States Department of Labor

Opinion

THE CENTER FOR INVESTIGATIVE Case No. 19-cv-05603-SK REPORTING, et al., Plaintiffs, ORDER REGARDING CROSS v. JUDGMENT UNITED STATES DEPARTMENT OF LABOR, Regarding Docket Nos. 25, 36

Defendant.

The matter comes before the Court upon consideration of the motion for summary judgment filed by Defendant United States Department of Labor (“DOL”) and the cross-motion for summary judgment filed by Plaintiffs The Center for Investigative Reporting and Will Evans (collectively, “Plaintiffs”). Having carefully considered the parties’ papers, relevant legal authority, record in the case, and oral argument, the Court DENIES the DOL’s motion for summary judgment and GRANTS Plaintiffs’ cross-motion for summary judgment for the reasons set forth below. BACKGROUND1 In this action, Plaintiffs seeks to compel the disclosure of documents from DOL’s Occupational Safety and Health Administration (“OSHA”) pursuant to the Freedom of Information Act (“FOIA”). Plaintiffs submitted three FOIA requests, all to obtain Amazon’s injury and illness data that it provided to OSHA. Plaintiff submitted their first request on April 22,

1 The DOL objects to the declarations of Deepa Varadarajan, Sharon Sandeen, and David 2019 for OSHA’s file on an inspection of an Amazon warehouse in Stoughton, Massachusetts. (Dkt. No. 1 (Compl.), ¶ 2.) This request and DOL’s response to it are no longer disputed. (Dkt. No. 24 (Parties’ Stipulation), ¶ 1.) Plaintiffs submitted their second request on May 13, 2019 to OSHA seeking the forms Amazon provided on its annual statistics on injuries, illnesses and fatalities at certain Amazon facilities in Ohio. (Dkt. No. 1, ¶ 3.) Plaintiffs submitted their third request on May 15, 2019 to OSHA seeking the forms Amazon provided on its annual statistics on injuries, illnesses and fatalities at certain Amazon facilities in Illinois. (Id., ¶ 4.) The sole dispute regarding Plaintiff’s second and third FOIA requests is whether Plaintiffs may obtain Amazon’s unredacted data on its OSHA Form 300As, which are summaries of Amazon’s work-related injuries and illnesses. (Dkt. No. 24, ¶ 2.) A. OSHA’s Forms. The Occupational Safety and Health Act of 1970 (the “Act”), 29 U.S.C. § 651 et seq., was enacted “to assure so far as possible every working man and woman in the Nation safe and healthful working conditions. . . .” 29 U.S.C. § 651(b). “To that end, Congress authorized the Secretary of Labor to set mandatory occupational safety and health standards applicable to all businesses affecting interstate commerce.” Gade v. Nat’l Solid Wastes Mgmt. Ass’n, 505 U.S. 88, 96 (1992) (citing 29 U.S.C. § 651(b)(3)). OSHA, a division of the DOL, promulgates and enforces these standards, as well as regulations that require “employers to maintain accurate records of, and to make periodic reports on, work-related deaths, injuries and illnesses . . .” 29 U.S.C. § 655, 657(c)(2). Pursuant to DOL’s statutory authority to “develop and maintain an effective program of collection, compilation, and analysis of occupational safety and health statistics,” 29 U.S.C. § 673(a), “OSHA requires employers with more than 10 employees to use a set of standardized forms when recording workplace injuries and illnesses – Form 300 to generate a log of all work- related injuries or illnesses, Form 301 to generate an incident report for each individual case, and Form 300A to prepare an annual summary derived from the information collected on the log.” Pub. Citizen Health Research Grp. v. Acosta, 363 F. Supp. 3d 1, 7 (D.D.C. 2018) (citing 29 C.F.R. OSHA’s Form 300 provides a log of work-related injuries and illnesses, including identifying the employee’s name and job title, and requires a description of the date and location on the premises of the event, as well as a description of the injury or illness, the parts of the body affected, and the object or substance which caused the injury or illness. Additionally, for each illness or injury, the employer must state whether the event resulted in death, days away from work, job transfer or restriction, or was an “[o]ther recordable” case; must provide the number of days the employee was away from work was on a job transfer or restriction; and must classify the illness or injury into one of the six categories stated above. See OSHA Form 300 available at https://www.osha.gov/recordkeeping/osha-rkforms-winstr_fillable.pdf. OSHA’s Form 301 injury and illness incident report provides even more detailed information about each work-related injury or illness, including the full name and address of the affected employee, the employee’s physician or health care professional’s information, details about the employee’s medical treatment, the date and time of the event, and more detailed descriptions about the event. See OSHA Form 301 available at https://www.osha.gov/recordkeeping/osha-rkforms-winstr_fillable.pdf. OSHA’s Form 300A, which is the only form at issue in this case, is entitled “Summary of Work-Related Injuries and Illnesses.” (Dkt. No. 26 (Declaration of Marc Choi), Ex. C.) On the form, employers are required to list the total number in a calendar year of: (1) deaths; (2) cases with days away from work; (3) cases with job transfer or restriction; (4) other recordable cases; (5) days away from work; and (6) days of job transfer or restriction. The form also breaks down the types of injuries and illnesses into 6 broad categories, and requires employers to state the total number of: (1) injuries; (2) skin disorders; (3) respiratory conditions; (4) poisonings; (5) hearing loss; and (6) all other illnesses. The employer then provides the following establishment information: company name, address, industry description, annual average number of employees, and total hours worked by all employees in the last year. (Id.) The Form 300A does not include any identifying information on the injured or sick employees. B. OSHA’s Regulations. the injuries and illnesses recorded on the OSHA 300 Log, which is the OSHA Form 300A, and post the summary. 29 C.F.R. § 1904.32(a). Employers must post the Form 300As “in a conspicuous place or places where notices to employees are customarily posted[]” from February 1 through April 30 “of the year following the year covered by the records.” 29 C.F.R. § 1904.32(b)(5), (6). OSHA regulations require employers to save the OSHA Form 300A, along with the 300 Log and the 301 Incident Report forms, for five years following the end of the calendar year that these records cover. 29 C.F.R. § 1904.33. Employers are required to provide copies of these illness and injury records to current employees, former employers, and the employees’ representatives. 29 C.F.R. § 1904.35(a)(3), (b)(2). The regulations define employee representative to include an authorized collective bargaining agent of the employee, the legal representative, or any person that the employee or former employee designates as their representative in writing. Id., § 1904.25(b)(2)(i), (ii).2 In the preamble to the Final Rule creating these forms, OSHA stated that an “employer may not require an employee, former employee or designated employee representative to agree to limit the use of the records as a condition for viewing or obtaining copies of records.” Occupational Injury and Illness Recording and Reporting Requirements, 66 Fed. Reg. 5916-01, 6058 (Jan. 19, 2001). In 2016, OSHA issued a Final Rule requiring certain employers to electronically submit the three illness and injury forms to OSHA on an annual basis. See Improve Tracking of Workplace Injuries and Illnesses, 81 Fed. Reg. 29624-01, 29692 (May 12, 2016); 29 C.F.R. § 1904.41. Under new the rule, employers with 250 or more employees were required to electronically submit the Forms 300, 300A, and 301 to OSHA each year, and employers in certain industries with 20 or more employees were required to electronically submit the Form 300A. 29 C.F.R. § 1904.41(a). However, OSHA subsequently amended this regulation to require employers 2 Defendants purport to quote from this regulation, stating that “the regulation itself describes this mandatory disclosure framework as “limited access to . . . injury and illness records to submit only the Form 300A electronically every year. Tracking of Workplace Injuries and Illnesses, 84 Fed. Reg. 380-01, 405 (Jan. 25, 2019); 29 C.F.R. § 1904.41. C. OSHA’s Statements Regarding Publicly Posting the Form 300As. In 2013, OSHA announced its plan to publicly post the data from the Form 300As online. See OSHA National News Release, OSHA announces proposed new rule to improve tracking of workplace injuries and illnesses (Nov. 7, 2013) available at https://www.osha.gov/news/newsreleases/national/11072013. The news release stated: [OSHA] today issued a proposed rule to improve workplace safety and health through improved tracking of workplace injuries and illnesses. The announcement follows the Bureau of Labor Statistics’ release of its annual Occupational Injuries and Illnesses report, which estimates that three million workers were injured on the job in 2012. . . . OSHA plans to eventually post the data online, as encouraged by President Obama’s Open Government Initiative. . . . (Id.) In the preamble to the 2016 Final Rule requiring certain employers to electronically submit the illness and injury forms to OSHA on an annual basis, OSHA stated that it “intends to post the data from these submissions on a publicly accessible Web site,” but “does not intend to post any information on the Web site that could be used to identify individual employees.” Improve Tracking of Workplace Injuries and Illnesses, 81 Fed. Reg. at 29625. The preamble further states: the final rule recognizes that public disclosure of data can be a powerful tool in changing behavior. In this case, the objective of disclosure of data on injuries and illnesses is to encourage employers to abate hazards and thereby prevent injuries and illnesses, so that the employer’s establishment can be seen by members of the public, including investors and job seekers, as one in which the risk to workers’ safety and health is low. OSHA believes that disclosure of and public access to these data will (using the word commonly used in the behavioral sciences literature) “nudge” some employers to abate hazards and thereby prevent workplace injuries and illnesses, without OSHA having to conduct onsite inspections . . . . Id., 81 Fed. Reg. at 29629. In commentating on the how the planned public posting was just a small change, OSHA stated: injury and illness records kept under part 1904 are already available to OSHA and the public in a variety of ways. The annual summary data must be posted where employees can see it. Employees or their representatives can also obtain and make public most of the information from these records at any time, if they wish. . . . Id., 81 Fed. Reg. at 29684. OSHA further summarized the benefits of publicizing the injury and illness data: First, the online posting of establishment-specific injury and illness information will encourage employers to improve workplace safety and health to support their reputations as good places to work or do business with. . . . By requiring complete, accurate reporting, interested parties will be able to gauge the full range of injury and illness outcomes. Second, these data will be useful to employers who want to use benchmarking to improve their own safety and health performance. . . . Using data collected under this final rule, employers can compare injury and illness rates at their establishments to those at comparable establishments, and set workplace safety/health goals benchmarked to the establishments they consider most comparable. Third, online availability of establishment-specific injury and illness information will allow employees to compare their own workplaces to the safest workplaces in their industries . . . . In addition, if employees preferentially choose employment at the safest workplaces in their industries, then employers may take steps to improve workplace safety and health (preventing injuries and illnesses from occurring) in order to attract and retain employees. Fourth, access to these [sic] data will improve the workings of the labor market by providing more complete information to job seekers, and, as a result, encourage employers to abate hazards in order to attract more desirable employees . . . . Fifth, access to data will permit investors to identify investment opportunities in firms with low injury and illness rates. If investors . . . preferentially invest in firms with low rates, then employers may take steps to improve workplace safety and health and prevent injuries and illnesses from occurring in order to attract investment. Sixth, using data collected under this final rule, members of the public will be able to make more informed decisions about current and potential places with which to conduct business. . . . Such decisions by customers would also encourage establishments with higher injury/illness rates in a given industry to improve workplace safety in order to become more attractive to potential customers. . . . . Public disclosure of employers’ injury and illness rates will be Disclosure of and access to injury and illness data have the potential to improve research on the distribution and determinants of workplace injuries and illnesses, and therefore to prevent workplace injuries and illnesses from occurring. Like the general public, researchers currently have access only to the limited injury/illness data described above. Using data collected under this final rule, researchers might identify previously unrecognized patterns of injuries and illnesses across establishments where workers are exposed to similar hazards. . . . The availability of establishment-specific injury and illness data will also be of great use to county, state and territorial Departments of Health and other public institutions charged with injury and illness surveillance. . . . [O]nline access to this large database of injury and illness information will support the development of innovative ideas for improving workplace safety and health, and will allow everyone with a stake in workplace safety and health to participate in improving occupational safety and health. Furthermore, because the data will be publicly available, industries, trade associations, unions, and other groups representing employers and workers will be able to evaluate the effectiveness of privately- initiated injury and illness prevention initiatives that affect groups of establishments. . . . Finally, public access to these data will enable developers of software and smartphone applications to develop tools that facilitate use of these data by employers, workers, researchers, consumers and others. . . . Id., 81 Fed. Reg. at 29630-631. OSHA further stated it: strongly disagrees with the commenter that a strong illness and injury prevention program can be based on hiding basic information on injury and illness rates from either employees or the public. Illness and injury prevention programs work best when data on injuries and illnesses is collected and analyzed frequently and used as a tool to improve safety and health. As discussed above, this data collection effort will allow scholars and public health experts to analyze establishment data, discover patterns in injuries and illnesses, and recommend solutions. Id., 81 Fed. Reg. at 29683. In a FOIA lawsuit filed in the United States District Court for the District of Columbia, the DOL asserted that the Form 300As were confidential business information under Exemption 4. See Public Citizen Foundation v. United States Department of Labor, Case No. 18-cv-00117- EGS-GMH (D.D.C.), cited to by the DOL in Declaration of Patrick Kapust, ¶ 24 (Dkt. No. 39-1).) On June 1, 2018, the DOL stated in a motion for summary judgment filed in District of D.C. case: “It is OSHA’s intent to release the data only when it finishes using the data to target employers for inspection – approximately four years after the year to which the data relates.” (Public Citizen Foundation v. United States Department of Labor, Case No. 18-cv-00117 - EGS-GMH (D.D.C.), Dkt. No. 14 at pp.19-20.) DOL went on to explain that data from the calendar year 2016 would be released in 2020 and that data from the calendar year 2017 would be released in 2021. (Id.) In the preamble to the 2019 Final Rule rescinding the requirement for employers to electronically submit Forms 300 and 301 annually, OSHA stated: [I]n relation to concerns raised about possible publication of data submitted electronically to OSHA from Form 300A . . . the agency takes the position that these [sic] data are exempt from public disclosure under FOIA. It should likewise be noted that OSHA uses and will continue to use 300A data to prioritize its inspections and enforcement actions. Among other considerations, disclosure of 300A data through FOIA may jeopardize OSHA's enforcement efforts by enabling employers to identify industry trends and anticipate the inspection of their particular workplaces. As OSHA has explained elsewhere, OSHA is strongly opposed to disclosure of 300A data, has not made such data public, and does not intend to make any such data public for at least the approximately four years after its receipt that OSHA intends to use the data for enforcement purposes. 84 Fed. Reg. at 383. On August 23, 2019, OSHA publicly stated on its website that it considers “the 300A data as confidential commercial information, and will not release it to the public.” (Dkt. No. 39-1, ¶ 25 (citing https://www.osha.gov/recordkeeping/index.html).) OSHA’s Field Operations Manual, as it was updated on September 13, 2019, provides that “information obtained during inspections is confidential, but can be disclosable or non-disclosable based on criteria established in the Freedom of Information Act.” (Dkt. No. 26, ¶¶ 15, 17 (citing to https://www.osha.gov/sites/default/files/enforcement/directives/CPL_02-00-163.pdf).) The Field Operations Manual OM further states that, “[a]ny classified or trade secret information and/or personal knowledge of such information by Agency personnel shall be handled in accordance with OSHA regulations.”3 (Id.) /// D. DOL’s and Department of Justice’s Positions Regarding Confidentiality and Exemption 4. FOIA includes a number of exemptions – materials which are not required to be produced in response to a request for documents. Under Exemption 4, FOIA provides that it does not apply to: “trade secrets and commercial or financial information obtained from a person and privileged or confidential.” 5 U.S.C.A. § 552(b)(4). Before the Supreme Court ruling in Food Marketing Institute v. Argus Leader Media, 139 S. Ct. 2356, 2362 (2019) (“Food Marketing”), OSHA routinely released OSHA 300, 300A, and 301 forms in response to FOIA requests. (Dkt. No. 26, ¶ 29; Dkt No. 28 (Declaration of Francis Meilinger), ¶ 6.) Amazon submitted all of the Form 300As at issue in this litigation before Food Marketing. (Dkt No. 26, Ex. F; Dkt. No. 48 (chart of responsive documents); Dkt. No. 25 n.10 (“These Form 300As were submitted by Amazon prior to the [Food Marketing] decision . . .”).) However, after Food Marketing in which the Supreme Court address the meaning of “confidential” in Exemption 4, OSHA reevaluated its policy and, as of September 12, 2019, now contends that all three forms contain confidential commercial data which should be withheld under FOIA Exemption 4. (Dkt. No. 26, ¶ 30; Dkt. No. 28, ¶ 7.) The Department of Justice (“DOJ”) guidelines regarding FOIA Exemption 4 state that when notices on agency websites or communications with submitters explicitly notify submitters of the agency’s intention to publicly disseminate the information, the information would be deemed to have lost its confidential character. See Department of Justice, Exemption 4 After the Supreme Court’s Ruling in Food Marketing Institute v. Argus Leader Media (updated Oct. 7, 2019) (referred to as “DOJ Exemption 4 Guidelines”), available at https://www.justice.gov/oip/exemption-4-after-supreme-courts-ruling-food-marketing-institute-v- argus-leader-media. The DOJ Exemption 4 Guidelines provide: . . . notices [on agency websites] or communications [with submitters] could also explicitly notify submitters of the agency’s intention to publicly disseminate the information. In those situations, the information, when objectively viewed in context, would be deemed to have lost its “confidential” character under Exemption 4 upon its submission to the government, given that the submitter was on notice that it would be disclosed. E. Plaintiff’s FOIA Requests and DOL’s Production. DOL provided Plaintiffs with nine Amazon’s Form 300As in response to Plaintiffs’ FOIA request. (Dkt No. 26, Ex. F; Dkt. No. 48.) DOL provided Plaintiffs with one form for the 2015 calendar year, one form for the 2016 calendar year, four forms for the 2017 calendar year, two forms for the 2018 calendar year, and one form for the 2019 calendar year. Three of the forms for the 2017 calendar year were signed by Amazon in late January 2018 and one was unsigned and undated. The form for the 2016 calendar year was also unsigned and undated. (Dkt No. 26, Ex. F; Dkt. No. 48.) According to the chart, Amazon did not submit the unsigned forms from 2015, 2016, and 2017 to OSHA under the regulations, but provided them to OSHA pursuant to the inspections between September 6 and December 12, 2018. (Dkt. No. 48.) Amazon submitted its signed 2017 forms pursuant to the regulations between March 14, 2018 and October 10, 2018 and pursuant to OSHA’s inspections on June 28, 2018. (Id.) One of the forms for 2018 was dated January 29, 2018 and the form for 2019 was dated February 7, 2019. These dates are likely incorrect because the forms summarize the data collected at the year end. (Dkt No. 26, Ex. F; Dkt. No. 48, n.4 (citing 29 CFR 1904.32(a)).) Amazon submitted these forms pursuant to the regulations on February 23, 2019 and March 2, 2019 and pursuant to OSHA’s inspections between February 6 and May 8, 2019. (Id.) The second form for the 2018 calendar year was unsigned and undated, but according to the chart, Amazon submitted this form to OSHA pursuant to the inspection between January 16 and 24, 2019 and pursuant to the regulations on January 23, 2019. (Id.) DOL redacted most of the data on these forms it produced to Plaintiffs. DOL provided Amazon’s name, address and industry description, but redacted the average number of employees, total hours worked, and all of the data on the injuries and illnesses. (Dkt. No. 26, Ex. F.) Although DOL initially redacted this information both FOIA Exemptions 4 and 7, DOL now only contends that Exemption 4 warrants withholding the data on Amazon’s Form 300As. F. Amazon’s Declaration. Amazon submits a declaration from Heather MacDougall, Vice President of Workplace Health & Safety for Amazon.com Services LLC. (Dkt. No. 27.) She states that it is Amazon’s policy to treat OSHA’s Form 300A, Form 300, and Form 301 confidential and refers to all three forms together as Amazon’s “OSHA recordkeeping forms.” (Id. at ¶ 2.) MacDougall states that Amazon considers the Form 300A to be confidential and that it has been Amazon’s longstanding policy to treat this form as confidential and stamps it as confidential. (Id., ¶¶ 3, 6.) Amazon only shares the form in four circumstances: “(1) upon request to current or former employees or their representatives; (2) upon request to OSHA through inspection or enforcement actions, (3) through electronic submission to OSHA; and (4) through posting in each fulfillment center for the required three month period between February 1 and April 30 each year.” (Id., ¶ 3.) MacDougall notes that when Amazon provides the form to current and former employees, or their authorized representatives, Amazon marks the form as confidential with the following message: In response to your request for the OSHA 300 Logs [and/or] 300A forms for the ____ facility located in [city] [state], I have enclosed the following: [year range] logs. OSHA and Amazon consider this information confidential because, among other things, it has personally identifiable information and personal medical information involving you or your co-workers. We do not share this information with third-parties. As a [current] [former] employee we respect your right to access this confidential information pursuant to OSHA regulations and request that you maintain its confidentiality. Please review and observe the following notice from OSHA that is in a box at the top of the form 300: Attention: This form contains information relating to employee health and must be used in a manner that protects the confidentiality of employees to the extent possible while information is being used for occupational safety and health purpose. (Id., ¶ 4.) Amazon posts the Form 300A in an area which is only accessible to employees and restricts access to the logs to employees with record keeping responsibilities. (Id., ¶¶ 5, 6.) MacDougall states that: Form 300-A includes confidential commercial information specific to each Amazon facility, including total hours worked, total number of employees, total rates of injury, and total rates of missed work. . . . Although Form 300-A does not itself contain personally identifiable sensitive medical information, the total injuries and illnesses that are listed by categories could be used to profile Amazon’s injury trends at individual fulfillment centers, which would be a major component of the sensitive information contained in OSHA Form 300 and 301. (Id., ¶ 7.) As an example of how Amazon responds to OSHA requests for its injury and illness records, which include the Form 300A, MacDougall attached a cover letter Amazon sent to OSHA in connection with one of the inspections at issue in this litigation. (Id., ¶ 11, Ex. A.) Amazon’s letter states that it was providing its Form 300 Logs for 2017-2018, Form 300A Summary Form for 2017, and Forklift Training Information in connection with OSHA’s onsite inspection of the Amazon facility located in Waukegan, Illinois. (Id., Ex. A.) Amazon stated that it considered the documents produced to be and to contain trade secrets and/or confidential, sensitive or proprietary information and requested that OSHA protect the documents. (Id.) MacDougall stated that Amazon stamped the Form 300A as confidential when it produced these documents to OSHA and that the treatment of the Waukegan Form 300A reflects Amazon’s general policies and practices regarding these forms. (Dkt. No. 38 (Supplemental Declaration of Heather MacDougall), ¶¶ 6-7.) G. Plaintiffs’ Previous Public Records Requests for Amazon’s Form 300As. Plaintiffs have previously requested Amazon’s Form 300As through FOIA and its state- law analogues. (Dkt. No. 42-3 (Supplemental Declaration of Will Evans), ¶ 4.) In response to such previous public records requests made between April 3, 2019 and August 19, 2019, Plaintiffs received at least twenty of Amazon’s Form 300As which were not stamped confidential by Amazon. (Id., ¶ 5, Ex. A.) A. Legal Standards. The purpose of the Freedom of Information Act (“FOIA”) is “‘to pierce the veil of administrative secrecy and open agency action to the light of public scrutiny. . . .’” Department of the Air Force v. Rose, 425 U.S. 352, 361 (1976) (citation omitted). FOIA reflects “‘a general philosophy of full agency disclosure unless information is exempted under clearly delineated statutory language.’” Id. at 360-61 (quoting S.Rep. No. 813, 89th Cong., 1st Sess., 3 (1965)). FOIA’s “‘core purpose’ is to inform citizens about ‘what their government is up to.’” Yonemoto v. U.S. Dep’t of Veterans Affairs, 686 F.3d 681, 687 (9th Cir. 2012) (quoting Dep’t of Justice v. must bear in mind that FOIA mandates a ‘strong presumption in favor of disclosure,’ . . . and that the statutory exemptions, which are exclusive, are to be ‘narrowly construed,’” Nat’l Ass’n of Home Builders v. Norton, 309 F.3d 26, 32 (D.C. Cir. 2002) (quoting Dep’t of State v. Ray, 502 U.S. 164, 173 (1991) and Rose, 425 U.S. at 361); see also Maricopa Audubon Soc. v. U.S. Forest Serv., 108 F.3d 1082, 1085 (9th Cir. 1997) (FOIA’s exemptions are “explicitly exclusive” and “must be narrowly construed in light of FOIA’s dominant objective of disclosure, not secrecy.”) (citations and quotations omitted). “FOIA’s strong presumption in favor of disclosure places the burden on the government to show that an exemption properly applies to the records it seeks to withhold.” Hamdan v. U.S. Dep’t of Justice, 797 F.3d 759, 772 (9th Cir. 2015). Further, “[a] basic policy of FOIA is to ensure that Congress and not administrative agencies determines what information is confidential.” Lessner v. U.S. Dep’t of Commerce, 827 F.2d 1333, 1335 (9th Cir. 1987). For this reason, courts do not give deference to a federal agency’s determination that requested information falls under a particular FOIA exemption. Carlson v. U.S. Postal Serv., 504 F.3d 1123, 1127 (9th Cir. 2007). To satisfy its burden, the agency “must provide a relatively detailed justification, specifically identifying the reasons why a particular exemption is relevant and correlating those claims with the particular part of a withheld document to which they apply.” Mead Data Cent., Inc. v. U.S. Dep’t of the Air Force, 566 F.2d 242, 251 (D.C. Cir. 1977). FOIA cases are typically decided on motions for summary judgment because the facts are rarely in dispute. See Minier v. Cent. Intelligence Agency, 88 F.3d 796, 800 (9th Cir. 1996). On a motion for summary judgment, district courts analyze the withholding of agency records de novo. 5 U.S.C. § 552(a)(4)(B). B. The Parties’ Cross-Motions. Exemption 4 under FOIA shields from mandatory disclosure “commercial or financial information obtained from a person” which is “privileged or confidential.” Food Marketing, 139 S. Ct. at 2362. (quoting 5 U.S.C. § 552(b)(4)). In order to invoke Exemption 4, the government agency must demonstrate that the information it seeks to protect is (1) commercial and financial confidential.” Watkins v. U.S. Bureau of Customs & Border Prot., 643 F.3d 1189, 1194 (9th Cir. 2011) (citations and quotations omitted). There is no dispute here that Amazon, as the submitting company, constitutes a person under FOIA, as the definition includes corporations. 5 U.S.C. § 551(2). Thus, the issues in dispute are whether the information sought is commercial or financial in nature and whether it is privileged or confidential. Additionally, the parties dispute whether the DOL has demonstrated it reasonably foresees that disclosure would harm an interest protected by Exemption 4 as required by the FOIA Improvement Act of 2016. See 5 U.S.C. § 552(a)(8)(A)(i). However, because the Court finds, as discussed below, that the Form 300As are not confidential, the Court need not address whether the documents are financial or commercial or whether the DOL has satisfied the foreseeable harm standard. The Supreme Court clarified the standard for determining whether information is “confidential” under Exemption 4 in Food Marketing. Contrary to what some courts previously held, there is no statutory requirement to demonstrate “substantial competitive harm.” 139 S. Ct. at 2360. Instead, the term “confidential” must be given its “ordinary, contemporary, common meaning[,]” which is “private” or “secret.” Id. at 2363. Information may be communicated to another and remain confidential, so long as the information is “customarily kept private, or at least closely held, by the person imparting it.” Id. The Court in Food Marketing held that the company submitting information satisfied this standard because it did not disclose the data or make it publicly available and, even within the company, only small groups of employees had access to it. Id. The Court declined to address whether assurances that the government would keep the information private was also required to keep the information confidential because the government did make such assurances. Id. The Court concluded that “[a]t least where commercial or financial information is both customarily and actually treated as private by its owner and provided to the government under an assurance of privacy, the information is ‘confidential’ within the meaning of Exemption 4.” Id. at 2366. 1. Customarily and Actually Treated as Private. 300As as confidential and does not disclose them to the public. (Dkt. No. 25 at p.1.) However, the Court finds that, based on the evidence in the record, Amazon has not customarily and actually treated the data in the Form 300As as confidential.4 i. Required Posting at Facilities. Pursuant to the regulations, Amazon is required to post the Form 300As for three months. See 29 C.F.R. § 1904.32. Significantly, Amazon did not state that, when it posts the forms in its facilities, that it cautions employees to keep the data on the form confidential and not to disclose this data. (Dkt. No. 27.) In fact, in light of the regulations discussed below, it is not clear that Amazon could restrict employee’s use and disclosure of these forms. Amazon explained that it posts the forms in an area which is accessible only to employees. Nevertheless, Amazon is a large company. Thus, pursuant to the regulation, the Form 300A is accessible to a large number of people. The DOL misleadingly cites two cases to argue that Amazon’s required posting does not undermine Amazon’s confidentiality claim. (Dkt. No. 25 at p.18 (citing OSHA Data/CIH, Inc. v. U.S. Dep’t of Labor, 220 F.3d 153, 163 n.25 (3d Cir. 2000) and New York Times Co. v. U.S. Dep’t of Labor, 340 F. Supp. 2d 394, 402 (S.D.N.Y. 2004).) In OSHA Data, the court stated in a footnote that “the posting of an annual injury and illness summary at the work site itself is a limited disclosure to a limited audience, a disclosure which is surely insufficient to render the data publicly available.” OSHA Data, 220 F.3d at 163 n.25. However, there are several important distinctions to note. The regulation in effect at that time only required employers to post the total number of incidents of lost workday injuries and illnesses for one month, as opposed to the three months now required. See 66 Fed. Reg. 5916-01. Additionally, the regulations in effect at that time did not require companies to provide the forms to all current, former, and representatives of employees upon request. Id. Moreover, the plaintiff

4 The parties dispute whether the Court should examine only Amazon’s conduct or whether the Court should also examine how other companies in the industry treat the Form 300A. However, because the Court finds that Amazon does not customarily and actually treat the Form in OSHA Data requested information which went beyond what employers were required to post at that time.5 Even more significantly, the court in OSHA Data was not making a determination as to whether the information was, in fact, confidential under Exemption 4. Instead, the court was merely determining whether the DOL was required to provide notification of the FOIA request to the companies which submitted their data to OSHA. OSHA Data, 220 F.3d at 162-63. The regulations at that time required the DOL to provide notice of a FOIA request to a company submitter whenever the DOL had “reason to believe that disclosure of the information could reasonably be expected to cause substantial competitive harm[.]” Id. at 163 (quoting 29 C.F.R. § 70.26(d)(2)(ii)). However, notification was not required under FOIA if the information was lawfully published or had been “officially made available to the public.” Id. (quoting 29 C.F.R. § 70.26(g)(2)). Thus, the issue before the court was not whether the information was confidential under Exemption 4 but whether notification was required under FOIA or if the information had been “officially made available to the public.” Id. at 163 n.25 (“we reject OSHA Data’s argument that these limited disseminations of information render the . . . data ‘officially made available to the public’ such that predisclosure notification would not be required”). The import of this distinction is made clear by the court’s analysis New York Times. Before the regulations enacted on January 19, 2001 became effective on January 1, 2002, employers were only required to post the total number of incidents of lost workday injuries and illnesses (annual summaries of the OSHA Form 200 Log) and not the number of hours that employees worked. See 66 Fed. Reg. 5916-01 (establishing the OSHA Form 300, 300A and 301); see also New York Times, 340 F. Supp. 2d at 396-97. In addition to changing the substance of the annual summaries to include employees’ worked hours (compare OSHA Form 200 Log with OSHA Form 300A), the regulations also changed the posting and disclosure requirements. As

5 The plaintiff was requesting data collected by OSHA to calculate Lost Work Day Injury and Illness (“LWDII”) rates, which included the number of employee hours worked. At the time of OSHA Data, employers were required to post the total number of incidents of lost workday noted above, pursuant to the regulations in effect before January 1, 2020, employers were only required to post the annual summaries of the Form 200 Log for one month and were not required to provide copies of the injury and illness data to current, former, and representatives of employees, as is now required under 29 C.F.R. § 1904.35. See 66 Fed. Reg. 5916-01. The court in New York Times explained that employers were required to provide OSHA (but not post) the total number of hours worked by all employees and data from illness and injury records. 340 F. Supp. 2d at 396. OSHA then used that information to calculate the LWDII rates. Id. Based on data received for the year 2000, OSHA identified approximately 13,000 workplaces with high LWDII rates. Id. OSHA posted on its website the names of these 13,000 workplaces, but not the LWDII rates. In October 2002, pursuant to FOIA, a reporter for the New York Times requested the LWDII rates for these workplaces. Id at 397. The DOL withheld that information on the grounds that releasing the LWDII rates was tantamount to releasing confidential commercial information – the number of hours that employees worked – under Exemption 4. The DOL argued that the number of hours that employees worked could be ascertained or reverse engineered using the LWDII rate and the total number of incidents of lost workday injuries and illnesses posted under the regulations. Id. at 401. The court held the one-month posting of total number of incidents of lost workday injuries under the regulations then in effect was insufficient to render the data “publicly available.” Id. The court noted that, because the total number of incidents of lost workday injuries were posted for only a one-month period several years ago, is was “difficult to believe that the general public could track down those summaries years later and use them to reverse engineer outdated LWDII rates.” Id. at 402 n.10. Therefore, the court held that providing the newspaper the LWDII rates in 2002 which were calculated from calendar year 2000 data would not enable the New York Times to reverse engineer and determine the number of employee hours worked in the year 2000. Id. at 401-402. Notably, the court did not hold that the posting was not long enough or public enough to undermine the confidentiality of the data under Exemption 4. In fact, the court appeared to find employers’ posting to include employee hours in the Form 300A, the court observed that “OSHA no longer regards employee hours as ‘confidential commercial information,’ and employers have no expectation of a competitive advantage based on their ability to keep the hours confidential.” Id. at 402; see also id. at 403 (distinguishing OSHA Data because “employee hours are no longer confidential”). ii. Requiring Disclosure to Current, Former, and Representatives of Employees. The regulations further require Amazon to maintain the Form 300As for five years and to provide them to any current or former employee, or any employee’s representative, which the regulations define broadly to include anyone the employee designates as a representative. See 29 C.F.R. §§ 1904.33, 1904.35.6 Amazon states that when it provides employees, former employees, or their representatives Form 300As upon request, Amazon marks the form as confidential and includes the following message: In response to your request for the OSHA 300 Logs [and/or] 300A forms for the ____ facility located in [city] [state], I have enclosed the following: [year range] logs. OSHA and Amazon consider this information confidential because, among other things, it has personally identifiable information and personal medical information involving you or your co-workers. We do not share this information with third-parties. As a [current] [former] employee we respect your right to access this confidential information pursuant to OSHA regulations and request that you maintain its confidentiality. Please review and observe the following notice from OSHA that is in a box at the top of the form 300: Attention: This form contains information relating to employee health and must be used in a manner that protects the confidentiality of employees to the extent possible while information is being used for occupational safety and health purpose. (Dkt. No. 27, ¶ 4.) However, in this message, Amazon groups together the Form 300 Logs with the Form 300As. OSHA’s Form 300 Logs, as distinct from the Form 300A, provide a log of the work-related injuries and illnesses and identify the employee’s name and job title, the date of the event, and the location of the event on the premises. Additionally, on the Form 300 Logs, employers describe the injury or illness, the parts of the body affected, and the object or substance 6 Employees, former employees, and their representatives are entitled to receive copies of the current and the five years of stored data and are not limited to the data collected during their which caused the injury or illness. Amazon states that it considers these forms (referring to both the Form 300 Logs and the Form 300As) confidential because they contain personally identifiable information and personal medical information of other employees. (Id.) Notably, this type of information is only listed on the Form 300 Logs and not on the Form 300As. Thus, Amazon’s stated rationale for marking these documents as confidential – employee privacy – is unrelated to the data on the Form 300A. Therefore, it is not clear whether or how this message is designed to maintain the purported confidentiality of the Form 300A.7 Additionally, it is not clear that the regulations permit Amazon’s directive to its current, former, and representatives of its employees to keep the Form 300As confidential. As OSHA has made clear, an “employer may not require an employee . . . to agree to limit the use of the records as a condition of viewing or obtaining the records.” See 66 Fed. Reg. at 6058. OSHA explained that: Employees and their representatives might reasonably fear that they could be found personally liable for violations of such restrictions. This would have a chilling effect on employees’ willingness to use the records for safety and health purposes, since few employees would voluntarily risk such liability.” Id. As recently recognized by another court in this district, “[t]here are no restrictions on further dissemination of Form 300A information[.]” Ctr. for Investigative Reporting, 2020 WL 2995209, at *4 (citing 81 Fed. Reg. at 29684). Notably, when discussing OSHA’s 2016 Final Rule, OSHA referred to these disclosure requirements (posting the Form 300As and providing them to employees and their representatives upon request) under the regulations as making the forms available to the public: 7 Confusingly, MacDougall, Amazon’s Declarant, also states: “Although Form 300-A does not itself contain personally identifiable sensitive medical information, the total injuries and illnesses that are listed by categories could be used to profile Amazon’s injury trends at individual fulfillment centers, which would be a major component of the sensitive information contained in OSHA Form 300 and 301. Amazon therefore customarily treats all three forms as private due to the sensitive and confidential nature of the source data.” (Dkt. No. 27, ¶ 27.) MacDougall acknowledges that the Form 300A does not contain any personally identifiable sensitive information. To the extent she contends that the Form 300A somehow reveals sensitive information contained in the Form 300 or 301, she does not explain how. Nor does she explain what she means by “source data.” It is not clear what MacDougall means by this statement or how injury and illness records kept under part 1904 are already available to OSHA and the public in a variety of ways. The annual summary data must be posted where employees can see it. Employees or their representatives can also obtain and make public most of the information from these records at any time, if they wish. Improve Tracking of Workplace Injuries and Illnesses, 81 Fed. Reg. at 29684 (emphasis added). The DOL argues that OSHA was concerned about possible “misuse” of the data on the Form 300As and suggests that “misuse” would include providing the forms to the press. (Dkt. No. 25 at pp.18-19.) However, when OSHA stated that “[e]ncouraging parties with access to the forms to keep the information confidential where possible is reasonable[,]” it was discussing the potential misuse of the private medical and personal information about employees contained in the Form 300 Log and the Form 301 injury and illness incident report. See 66 Fed. Reg. at 6058. In line with this important distinction, OSHA added onto the Forms 300 and 301 “a statement . . . indicating that these records contain information related to employee health and must be used in a manner that protects the confidentiality of employees to the extent possible while the information is used for occupational safety and health purposes.” Id. at 6058. Employees’ personal and medical information does not appear on the Form 300As, and OSHA has not added a similar statement onto the Form 300A. iii. Impact of OSHA’s Regulations on Confidentiality. The Court finds that Amazon’s broad disclosures required under the regulations to all current employees, former employees, and employees’ representatives, with no restrictions on their further disclosures, defeats the DOL’s effort to demonstrate confidentiality. The DOL’s arguments to the contrary are not convincing. The DOL characterizes the required disclosure to all current and former employees and their representatives as disclosure to a “small subset of all employees” because such individuals must affirmatively request the forms. (Dkt. No. 25 at p.18.) However, there is no evidence in the record regarding how many Amazon employees, current or former, have requested the Form 300As pursuant to 29 C.F.R. § 1904.35. Moreover, the DOL does not and could not dispute that Amazon is legally required to provide the Form 300As to any current or former employee, or their representative, which is a large group of people. For example, if a document were posted on the internet on an unrestricted website, indisputably it would be widely available, regardless if a small number of people actually visited the website and viewed the document. Similarly, as discussed below, the DOL points to a statement it made in a legal brief filed in a district court case in the District of Columbia to support its argument that OSHA publicly retracted its statement on posting the Form 300As online, regardless of whether Amazon was aware of litigation in that district or, more importantly, the DOL’s filing. Additionally, Amazon is required to post the Form 300As at its facilities for all employees to see for three months. See New York Times, 340 F. Supp. 2d at 402, 403 (noting that posting requirement rendered information about employees’ hours not confidential). Relying on language from Center for Auto Safety v. National Highway Traffic Safety Administration, 93 F. Supp. 2d 1, 17-18 (D.D.C. 2000), the DOL appears to make the argument that disclosing documents to anyone “affiliated” with Amazon does not undermine the information’s confidentiality because Amazon does not customarily disclose its Form 300As to the “general public.” (Dkt. No. 27 at p.17.) Amazon relies on the following statement in Center for Auto Safety: “[l]imited disclosures, such as to suppliers or employees, do not preclude protection under Exemption 4, as long as those disclosures are not made to the general public.” 93 F. Supp. 2d at 17-18. The DOL construes the meaning of this statement and the holding of that case too broadly. Although the court in Center for Auto Safety made this expansive statement, the court noted that the information at issue was only disclosed only to employees or other entities as necessary and was always accompanied by a confidentiality agreement or protective order. Id. at 18. Nevertheless, to the extent Center for Auto Safety actually stands for the proposition that information is confidential so long as it is only disclosed to anyone who ever works or worked for a large company, or any representative of a current of former employee, the Court finds it unpersuasive. In light of the requirement to construe FOIA exemptions narrowly, finding documents confidential even if they are available to and broadly disclosed to all current and former employees of a large company without any confidentiality or nondisclosure agreements is untenable. In fact, even absent the requirement to narrowly construe exemptions, the Court cannot people without any restrictions. See Food Marketing, 139 S. Ct. at 2363 (noting definitions of confidential include “closely held” and “known only to a limited few”). Next, the DOL points to language from American Small Business League v. United States Department of Defense, 411 F. Supp. 3d 824 (N.D. Cal. 2019) to support its argument that Amazon’s forms are confidential under the broad standard in Food Marketing. The court in American Small Business stated that “[u]nder Food Marketing, it appears that defendants need merely invoke the magic words – “customarily and actually kept confidential” – to prevail and noted “how prolifically companies claim confidentiality.” Id. at 832-33. However, the court made clear that a plaintiff could defeat these “magic words” by pointing to actual practices which contradict those statements. Id. at 832 (“plaintiff can show that the information is in fact publicly available or possibly point to other competitors who release the information”). Notably, in addition to claiming confidentiality, the company in American Small Business demonstrated with evidence the protective measures it took to ensure the documents remained confidential, “such as (1) requiring employees and business partners to enter into confidentiality agreements; (2) using restrictive markings on documents and communications; (3) using secure, password-protected IT networks for the information at issue; and/or (4) limiting access to the information at issue on a “need to know” basis” Id. at 831; see also Food Marketing, 139 S. Ct. at 2363 (highlighting that “[e]ven within a company, witnesses testified, only small groups of employees usually have access to it”). In light of the applicable regulations, Amazon does not and could not similarly restrict access to the Form 300As. And the limited attempts Amazon has made to shield its Form 300As are ineffective and inconsistent. As discussed above, the message of confidentiality Amazon includes when it sends out the form to current, former and representatives of employees does not pertain to the data on the Form 300A – the message discusses the confidentiality of personally identifiable and medical information which is not on the Form 300A. Amazon also states that it stamps the Form 300A as confidential and restricts access to only employees with record keeping responsibilities. (Dkt. No. 26, ¶ 6.) However, these measures do not actually protect the Form required to send the form to all employees, former employees and employee representatives upon request without any restrictions.8 Therefore, as another court in this district recently recognized, due to the regulations “the Form 300A information is both readily observable by and shared with employees, who have the right to make the information public.” Ctr. for Investigative Reporting, 2020 WL 2995209, at *4. The Court finds that where, as here, a large company is required by law to post the forms for current employees and to provide the forms upon request to all current and former employees, and their representatives, with no restrictions on these individual’s further disclosure of the forms, the information is not and cannot be considered confidential under the test set forth in Food Marketing. See Ctr. for Investigative Reporting, 2020 WL 2995209, at *4 (finding OSHA’s Form 300As were not confidential because “submitting companies are required by law to make the Form 300A information available to current and former employees”). Accordingly, the DOL has not met its burden to demonstrate that Amazon customarily and actually keeps the Form 300A confidential. 2. Provided Under an Assurance of Privacy. In addition to Amazon’s lack of customary and actual confidential treatment of the Form 300As, the DOL fails to demonstrate confidentiality for a separate and independent reason. As noted above, the Supreme Court declined to address whether assurances that the government would keep the information private was also required for confidentiality because in that case the government did make such assurances. Food Marketing, 139 S. Ct. at 2363. However, while it is uncertain whether an assurance of privacy is required, where, as here OSHA indicated the opposite – that it would disclose the Form 300As – Amazon lost any claim of confidentiality it may have 8 Additionally, the Court notes that the evidence in the record undermines Amazon’s assertion that it actually stamps the Form 300A as confidential. MacDougall, Amazon’s declarant, states that Amazon stamped a Form 300A as confidential when it produced the document to OSHA and that this practice reflects Amazon’s general policies and practices regarding these forms. (Dkt. No. 38, ¶¶ 6-7.) However, Plaintiffs submitted twenty examples of other Form 300As that Amazon produced to governmental agencies between April 3, 2019 and August 19, had.9 As the DOJ guidelines regarding Exemption 4 explain, information from submitters lose their confidential character when notices on agency websites or communications with submitters explicitly notify submitters of the agency’s intention to publicly disseminate the information. See DOJ Exemption 4 Guidelines, available at https://www.justice.gov/oip/exemption-4-after- supreme-courts-ruling-food-marketing-institute-v-argus-leader-media; see also Center for Investigative Reporting, 2020 WL 2995209, at *5 (noting DOJ’s guidelines “provide that information loses its character of confidentiality where there is express agency notification that submitted information will be publicly disclosed.”) (emphasis in original). The DOL concedes this point: “[W]hen there is reason to expect that the government might disclose the information at issue, express or implied assurances by the government that the information will remain private may be relevant in assessing whether the information retained its confidential nature.” (Dkt. No. 27 at 21.) The DOL, however, argues that Amazon had no reason to expect that OSHA would disclose its information on the Form 300As. (Id.) Based on the evidence in the record, the Court disagrees. The court in Center for Investigative Reporting recognized: “OSHA expressly stated in rulemaking in 2016 that it would ‘post the data’ from the electronic submissions of Forms 300, 301, and 300A ‘on a publicly accessible Web Site.’” Ctr. for Investigative Reporting, 2020 WL 2995209, at *5. OSHA stated its intent to do so in 2013. See OSHA National News Release, OSHA announces proposed new rule to improve tracking of workplace injuries and illnesses (Nov. 7, 2013) available at https://www.osha.gov/news/newsreleases/national/11072013 (“OSHA plans to eventually post the data online”). In the preamble to the 2016 Final Rule, OSHA stated that it “intends to post the data from these submissions on a publicly accessible Web site[.]” See 81 Fed. Reg. at 29625. OSHA described the benefits from publishing the data from the Form

9 The DOL argues that the Court should not examine whether OSHA provided an assurance of privacy because Amazon was required to submit its Form 300As and did not do so voluntarily. However, where, as here, the government makes an affirmative public statement 300As, including encouraging employers to abate hazards, enabling employers to benchmark their safety and health performance, allowing employees to compare and choose safe workplaces, enabling the public to make informed purchasing decisions, and improving research on and developing innovative ideas to alleviate workplace injuries and illnesses. 81 Fed. Reg. at 29629- 631. The DOL argues that OSHA subsequently reversed its position and, since 2017, has taken the position that the Form 300As electronically submitted should be kept private. (Dkt. No. 37 at p.17.) The DOL made the same argument in Center for Investigative Reporting. 2020 WL 2995209, at *5. That court rejected the DOL’s argument that any internal position change was relevant. Instead, it found only the DOL’s public statements regarding disclosure were relevant to counter the impact of OSHA’s public statements on posting the data. Id. This Court agrees. In both Center for Investigative Reporting and here, the first public statement the DOL points to is in a legal brief it filed in litigation in the District Court for the District of Columbia.10 (Dkt. No. 39-1 (Kapust Decl.), ¶ 24 (citing to the DOL’s summary judgment motion filed on June 1, 2018, in Public Citizen Foundation v. United States Dep’t of Labor, et al., Case No. 1:18-cv- 00117 (D.D.C.), Dkt. No. 14).)11 In its legal brief filed in D.C., the DOL referenced OSHA’s statement during rulemaking that it intended to make the data from the Form 300As public but that noted that “OSHA neglected to mention the timing of when the data would be made public.”

10 The court in Center for Investigative Reporting did not need to address the impact, if any, from the DOL’s argument in its summary judgment brief filed in the D.C. litigation because that brief was filed six months after the first deadline for the Form 300As submissions at issue in that Center for Investigative Reporting. Id., 2020 WL 2995209, at *5. However here, Amazon submitted some of its Form 300As before and some after June 1, 2018. Amazon first submitted most of the Form 300As at issue here as part of OSHA’s inspections and pursuant to the regulations between March 14, 2018 and January 23, 2019. (Dkt No. 26, Ex. F; Dkt. No. 48.) Amazon first submitted the last two, one for calendar year 2018 and one for calendar year 2019, between February 6 and March 2, 2019. (Id.) Accordingly, the Court will evaluate the impact of the DOL’s statements in its legal brief filed in D.C. on June 1, 2018. 11 In his declaration, Kapust also points to OSHA’s responses to other FOIA requests as public demonstrations of OSHA’s position. (Dkt. No. 39-1, ¶ 23.) When DOL originally filed this declaration in Center for Investigative Reporting v. Dep’t of Labor, Case No. 18-cv-02414- DMR (N.D. Cal.), Dkt. No. 28, the DOL attached those response letters as Exhibit H. The DOL did not file or cite to that Exhibit in this case, and so it is unclear whether the DOL is making the Public Citizen Foundation v. United States Dep’t of Labor, et al., Case No. 1:18-cv-00117 (D.D.C.), Dkt. No. 14 at pp.16-17. The DOL then clarified that it was: OSHA’s intent to release the data only when it finishes using the data to target employers for inspection – approximately four years after the year to which the data relates. . . . Specifically, OSHA plans to use the CY 2016 data for targeting purposes in 2018 and 2019, and to release the CY 2016 data in 2020, and plans to use the CY 2017 data for targeting purposes in 2019 and 2020, and to release the CY 2017 data in 2021. . . . Id. at pp.19-20 (citations omitted). Contrary to the DOL’s characterization of this prior legal brief, the DOL did not publicly retract OSHA’s statement that it would publicly post the data from the Form 300As. It merely clarified the timing of when it would disclose the data. After Amazon submitted all but two of the Form 300As at issue here, OSHA publicly stated in the preamble to the 2019 Final Rule on January 25, 2019: [I]n relation to concerns raised about possible publication of data submitted electronically to OSHA from Form 300A . . . the agency takes the position that these data [sic] are exempt from public disclosure under FOIA. . . . OSHA is strongly opposed to disclosure of 300A data, has not made such data public, and does not intend to make any such data public for at least the approximately four years after its receipt that OSHA intends to use the data for enforcement purposes. 84 Fed. Reg. at 383. Again, although the preamble includes stronger language against posting the data, OSHA still stated that it would publicly post the Form 300As in four years. It was not until August 23, 2019, that OSHA publicly retracted its stated intent to publish the Form 300As when it wrote on its website: “OSHA views the 300a form data as confidential commercial information, and will not release it to the public.” (Dkt. No. 39-1, ¶ 25 (citing https://www.osha.gov/recordkeeping/index.html).) However, OSHA did not make this statement until after Amazon submitted all of the Form 300As at issue. (Dkt. No. 26, Ex. F; Dkt. No. 48.) OSHA’s statements made after Amazon submitted its documents are not relevant. OSHA’s public position at the time Amazon made its submissions is what matters and OSHA did not definitively retract its statements regarding publishing the data until August 2019, after Amazon had submitted all of its Form 300As at issue. Although OSHA clarified the timeline for publication in June 2018 and again in January 2019, OSHA still stated that the Form 300As would be publicly disclosed. The DOL also could have asserted statements OSHA made directly to Amazon to counter its public statements regarding posting but it has not done so. At most, the DOL points to statements in OSHA’s Field Operations Manual, but those statements do not assist the DOL. OSHA’s Field Operations Manual, as it was updated on September 13, 2019, provides that “information obtained during inspections is confidential, but can be disclosable or non-disclosable based on criteria established in [FOIA].” (Dkt. No. 26, ¶ 17 (citing to https://www.osha.gov/sites/default/files/enforcement/directives/CPL_02-00-163.pdf).) The Operations Manual to which the DOL cites was updated after Amazon submitted the documents at issue. However, even if the Field Operations Manual in effect when Amazon submitted the documents contained similar language, it would not alter the analysis. When Amazon submitted its Form 300As, OSHA routinely released Form 300As pursuant to FOIA requests. (Dkt. No. 25 at p.22 n.10; Dkt. No. 26, ¶ 29, Ex. F.; Dkt. No. 48.) Therefore, the Field Operations manual cannot be read to provide an assurance of privacy in relation to Plaintiff’s FOIA request for Amazon’s Form 300As or otherwise retract OSHA’s public statement regarding disclosure. Because Amazon submitted its Form 300As to OSHA at a time when OSHA publicly stated it would publicly post the data (and when OSHA released the data pursuant to FOIA requests), the DOL cannot demonstrate confidentiality. See DOJ Exemption 4 Guidelines, available at https://www.justice.gov/oip/exemption-4-after-supreme-courts-ruling-food-marketing- institute-v-argus-leader-media (documents lose their confidential character when submitted on notice of an agency’s intent to publicly disseminate the information). Accordingly, the Court finds that the Form 300As do not contain confidential information under Exemption 4 and cannot be withheld on that basis. For the foregoing reasons, the Court DENIES the DOL’s motion for summary judgment and GRANTS Plaintiff’s cross-motion for summary judgment. Within fourteen days of this 1 Order, the DOL shall provide Plaintiffs with Amazon’s Form 300As without redacting the data.'* 2 The Court will issue a separate judgment. The Clerk is instructed to close the file. 4 Dated: July 6, 2020 + 5 _ fitlhan lOw~w SALLIE KIM 6 United States Magistrate Judge 7 8 9 10 11 12

15 16

= 17

Z 18 19 20 21 22 23 24 25 26 07 The DOL redacted the signatures and direct phone numbers of the signatories of the Form 300As based on privacy concerns under Exemption 7(C). Plaintiffs did not object to this 2g || redaction. The DOL may continue to redact the signatures and direct phone numbers when they provide the Form 300As.