FOR PUBLICATION

UNITED STATES COURT OF APPEALS

FOR THE NINTH CIRCUIT

CIVIL BEAT LAW CENTER FOR THE No. 16-16960

PUBLIC INTEREST, INC.,

Plaintiff-Appellant, D.C. No. 1:16-cv-00008- v. JMS-KSC

CENTERS FOR DISEASE CONTROL &

PREVENTION, OPINION

Defendant-Appellee.

Appeal from the United States District Court for the District of Hawai’i J. Michael Seabright, Chief District Judge, Presiding

Argued and Submitted October 9, 2018 Honolulu, Hawai’i

Filed July 10, 2019

Before: Kim McLane Wardlaw, Marsha S. Berzon, and Johnnie B. Rawlinson, Circuit Judges.

Opinion by Judge Berzon SUMMARY *

Freedom of Information Act

In a case involving disclosures under the Freedom of Information Act (“FOIA”), the panel dismissed as moot that part of the appeal pertaining to the disclosure of the specific regulatory violations and vacated those portions of the district court’s order; affirmed the district court’s grant of summary judgment as to the withholding under FOIA Exemption 6 of the identity and contact information of certain Centers for Disease Control & Prevention (“CDC”) employees; reversed the district court’s grant of summary judgment to the CDC on a Public Health Security and Bioterrorism Preparedness and Response Act of 2002 (“BPRA”) public endangerment exemption; and remanded to the district court for further proceedings.

Plaintiff sought disclosure under FOIA of two documents from the CDC concerning its inspection of the University of Hawaii’s biolab. CDC provided redacted versions of the requested records.

FOIA Exemption 6 allows agencies to withhold personnel and medical files that would constitute an unwarranted invasion of privacy. FOIA Exemption 3 applies to any material that is specifically exempted from disclosure by statute. BPRA exempts certain federal agencies from disclosing specified types of information

* This summary constitutes no part of the opinion of the court. It has been prepared by court staff for the convenience of the reader.

CIVIL BEAT LAW CTR. V. CDC 3

regarding biological agents and toxins in response to a FOIA request.

Concerning Exemption 3, the panel held as an initial matter that BPRA was a qualifying statute under Exemption 3. The CDC relied on two enumerated BPRA exemptions to justify the redactions in the requested information: the site- specific exemption and the public endangerment exemption. The panel held that it did not have jurisdiction to address the CDC’s redactions of the specific regulatory violations found at the biolab, that were justified under BPRA’s site-specific exemption, because plaintiff’s claims are moot. Turning to the BPRA public endangerment exemption, the panel held that Congress intended the public endangerment determination to be made on a case-by-case basis. The panel further held that on the current record, the CDC did not justify its complete withholding of identity and location information, and the district court erred in granting summary judgment to the agency. The panel also held that plaintiff was not entitled to judgment as a matter of law on its cross- motion for summary judgment. The panel remanded for further proceedings on this issue.

Concerning Exemption 6, the panel held that the CDC satisfied its burden of establishing a nontrivial privacy interest, and plaintiff provided no reason why disclosure of CDC employees’ identities and contact information would further the public interest. The panel concluded, therefore, that the CDC’s withholding of this information under Exemption 6 was proper. R. Brian Black (argued), Civil Beat Law Center for the Public Interest Inc., Honolulu, Hawaii, for Plaintiff- Appellant.

Anne Murphy (argued) and Matthew Collette, Appellate Staff; Kenji M. Price, United States Attorney; Civil Division, United States Department of Justice, Washington, D.C.; for Defendant-Appellee.

OPINION

BERZON, Circuit Judge:

Anonymous letters containing deadly anthrax spores were mailed to several media companies and congressional offices in September 2001. Five individuals were killed; seventeen others were sickened. U.S. Dep’t of Justice, Amerithrax Investigative Summary 1–3 (2010), https://www.justice.gov/archive/amerithrax/docs/amx-inves tigative-summary.pdf. In the wake of these attacks, Congress moved “to improve the ability of the United States to prevent, prepare for, and respond to bioterrorism and other public health emergencies.” H.R. Rep. No. 107-481, at 1 (2002) (Conf. Rep.), reprinted at 2002 U.S.C.C.A.N. 464, 464. The resulting legislation is the Public Health Security and Bioterrorism Preparedness and Response Act of 2002 (BPRA), Pub. L. No. 107-188, 116 Stat. 594 (codified as amended at scattered sections of 7, 18, 21, 29, 38, 42, and 47

U.S.C.).

Title II of BPRA is directed at improving the safety and security of dangerous biological agents and toxins located

CIVIL BEAT LAW CTR. V. CDC 5

throughout the United States. Toward this goal, BPRA directed the federal Department of Health and Human Services (HHS) to “establish and maintain a list of each biological agent and each toxin that has the potential to pose a severe threat to public health and safety,” 42 U.S.C. § 262a(a)(1)(A), and to create a system for “registration with [HHS] of the possession, use, and transfer of listed agents and toxins,” id. § 262a(d)(1). Registered entities must comply with “appropriate safeguard[s] [established by HHS] . . . for persons possessing, using, or transferring a listed agent or toxin.” Id. § 262a(e)(1).

In addition to these safeguards, BPRA exempts certain federal agencies from disclosing specified types of information regarding biological agents and toxins in response to a Freedom of Information Act (FOIA) request. See id. § 262a(h)(1). Relying on this exemption, the Centers for Disease Control and Prevention (CDC) withheld information from a FOIA response pertaining to a biological research laboratory (“biolab”) located at the University of Hawai’i. Much of the withheld information was already publicly available. The primary question before us is whether the CDC properly refused to disclose the requested information.

I

The University of Hawai’i at Mānoa (UH) maintains a biolab that is “the only facility of its kind for researchers in the entire State.” UH publicizes the biolab’s location at “the Biosciences Building” on “the Kaka‘ako campus, near downtown Honolulu.” Facilities, Dep’t Tropical Med., Med. Microbiology & Pharmacology, http://manoa.hawaii.edu/tr opicalmedicine/?page_id=925 (last updated June 20, 2014). According to the UH website, researchers at the UH biolab study a number of highly dangerous biotoxins, including botulinum neurotoxins, the Ebola virus, Tetrodotoxin, Brucella abortus, Brucella melitensis, Brucella suis, Burkholderia pseudomallei, Burkholderia pseudomallei, the Nipah virus, Ralstonia solanacearum, and Xanthomonas oryzae.

News reports in 2014 revealed that the CDC had uncovered “widespread regulatory noncompliance” at the UH biolab, relating to UH’s failure to meet certain standards for biotoxin safety and security. In response to these reports, Civil Beat Law Center, a government watchdog group in Hawai’i, filed a FOIA request with the CDC seeking two documents: (1) a May 2014 CDC inspection report detailing the regulatory violations found at the UH biolab; and (2) a May 2014 letter from the CDC demanding that UH “show cause” for why the UH biolab’s registration to possess, use, and transfer biological agents and toxins should not be suspended or revoked. The CDC denied both requests, maintaining that the records sought were “specifically exempted from disclosure by 42 U.S.C. § 262a(h)(1)(C) and (E).” Civil Beat requested reconsideration, which the CDC also denied.

Seeking to compel disclosure of the two disputed documents, Civil Beat filed suit under FOIA. The parties filed cross-motions for summary judgment, with the CDC continuing to assert that no disclosure at all of the requested documents was required.

A few weeks later, the CDC changed positions. In response to Civil Beat’s motion for summary judgment, the CDC included redacted versions of the requested records. The redactions in the newly disclosed documents fell into three categories:

CIVIL BEAT LAW CTR. V. CDC 7

The first two categories of redactions were based on exemptions found in BPRA. First, the CDC redacted information concerning the specific regulatory violations found at UH, asserting that “public disclosure of the redacted information . . . would endanger public health or safety because it could assist unauthorized individuals to obtain illegal access to listed agents.” See 42 U.S.C. § 262a(h)(1)(E) (“No Federal agency . . . shall disclose . . . [a]ny portion of an evaluation or report of an inspection . . . that identifies the listed agent or toxin possessed by a specific registered person or that discloses the identity or location of a specific registered person if the agency determines that public disclosure of the information would endanger public health or safety.”). Second, the CDC redacted all references to UH, its employees, and the laboratory, because revealing any of that information “would inform individuals with nefarious intentions of site-specific weaknesses in the safeguards and/or security measures employed by the particular registered entity at a particular location.” See 42 U.S.C. § 262a(h)(1)(C) (“No Federal agency . . . shall disclose . . . [a]ny portion of a record that discloses the site-specific or transfer-specific safeguard and security measures used by a registered person to prevent unauthorized access to listed agents and toxins.”).

Third, the CDC redacted “[t]he names and telephone numbers of individual [Division of Select Agents and Toxins] staff members” who conducted the UH inspection, based on “the sensitive nature of the select agent information that these staff members possess and process.” These redactions were based on FOIA Exemption 6, covering “personnel and medical files and similar files the disclosure of which would constitute a clearly unwarranted invasion of personal privacy.” 5 U.S.C. § 552(b)(6). Unsatisfied, Civil Beat opposed all three categories of redactions. It also argued, in the alternative, that if the district court determined that the BPRA exemptions were possibly applicable, the district court should conduct in camera review of the unredacted documents to determine whether the redactions were in fact proper.

The district court granted the CDC’s summary judgment motion in nearly all respects. Civil Beat Law Ctr. for the Pub. Interest, Inc. v. CDC, 204 F. Supp. 3d 1132, 1134 (D. Haw. 2016). The court held the redactions justified under BPRA appropriate, and the withholding of the names and contact information of CDC employees proper under FOIA Exemption 6. Id. at 1144–48. Civil Beat timely appealed.

II

Congress enacted FOIA “to pierce the veil of administrative secrecy and to open agency action to the light of public scrutiny.” U.S. Dep’t of State v. Ray, 502 U.S. 164, 173 (1991) (quoting Dep’t of Air Force v. Rose, 425 U.S. 352, 361 (1976)). Providing information to the public under FOIA, it was hoped, would “ensure an informed citizenry, vital to the functioning of a democratic society, needed to check against corruption and to hold the governors accountable to the governed.” NLRB v. Robbins Tire & Rubber Co., 437 U.S. 214, 242 (1978).

Toward this goal, FOIA “requires federal agencies to make Government records available to the public, subject to nine exemptions for specific categories of material.” Milner v. Dep’t of Navy, 562 U.S. 562, 564 (2011). “These exemptions are ‘explicitly made exclusive,’ and must be ‘narrowly construed.’” Id. at 565 (citations omitted) (first quoting EPA v. Mink, 410 U.S. 73, 79 (1973); then quoting FBI v. Abramson, 456 U.S. 615, 630 (1982)). Given FOIA’s

CIVIL BEAT LAW CTR. V. CDC 9

overarching purpose, “the strong presumption in favor of disclosure places the burden on the agency to justify the withholding of any requested documents.” Ray, 502 U.S. at 173.

This case concerns two FOIA exemptions, Exemption 3 and Exemption 6. Exemption 3 applies to any material that is “specifically exempted from disclosure by statute” if, as relevant here, the statute “establishes particular criteria for withholding or refers to particular types of matters to be withheld.” 5 U.S.C. § 552(b)(3)(A)(ii). Exemption 6 allows agencies to withhold “personnel and medical files and similar files the disclosure of which would constitute a clearly unwarranted invasion of personal privacy.” Id. § 552(b)(6). We consider each exemption in turn.

A

Exemption 3 does not itself provide the standards for an exemption from disclosure but instead incorporates other applicable statutory exemptions. See id. § 552(b)(3)(A)(ii). We use a two-step inquiry in considering whether withholding under Exemption 3 is proper. “First, we determine whether the withholding statute meets the requirements of Exemption 3. Then, we determine whether the requested information falls within the scope of the withholding statute.” Carlson v. U.S. Postal Serv., 504 F.3d 1123, 1127 (9th Cir. 2007).

The parties here agree, correctly, that BPRA is a qualifying statute under Exemption 3. BPRA exempts certain federal agencies, including the CDC, from disclosing certain categories of information relating to biological agents and toxins. See 42 U.S.C. § 262a(h)(1). 1 Thus, the statute “clearly identif[ies] the types of material to be

1 BPRA exempts five categories of information from disclosure:

(A) Any registration or transfer documentation submitted under [42 U.S.C. § 262a(b) and (c)] for the possession, use, or transfer of a listed agent or toxin; or information derived therefrom to the extent that it identifies the listed agent or toxin possessed, used, or transferred by a specific registered person or discloses the identity or location of a specific registered person.

(B) The national database developed pursuant to [42 U.S.C. § 262a(d)], or any other compilation of the registration or transfer information submitted under [42 U.S.C. § 262a(b) and (c)] to the extent that such compilation discloses site-specific registration or transfer information.

(C) Any portion of a record that discloses the site- specific or transfer-specific safeguard and security measures used by a registered person to prevent unauthorized access to listed agents and toxins.

(D) Any notification of a release of a listed agent or toxin submitted under [42 U.S.C. 262a(b) and (c)], or any notification of theft or loss submitted under such subsections.

(E) Any portion of an evaluation or report of an inspection of a specific registered person conducted under [42 U.S.C. 262a(f)] that identifies the listed agent or toxin possessed by a specific registered person or that discloses the identity or location of a specific registered person if the agency determines that public disclosure of

CIVIL BEAT LAW CTR. V. CDC 11

withheld under their scope as required by 5 U.S.C. § 552(b)(3), and therefore qualif[ies] as” an Exemption 3 statute. Minier v. CIA, 88 F.3d 796, 801 (9th Cir. 1996).

As to “whether the requested information falls within the scope of the withholding statute,” Carlson, 504 F.3d at 1127, the CDC relied on two of the enumerated BPRA exemptions to justify the redactions in the requested information. First, the CDC redacted all references to the specific regulatory violations found at UH, relying on the exemption for “[a]ny portion of a record that discloses the site-specific or transfer- specific safeguard and security measures used by a registered person to prevent unauthorized access to listed agents and toxins.” 42 U.S.C. § 262a(h)(1)(C). We refer to this first exemption as the “site-specific exemption.” Second, the CDC redacted all references to UH and to the specific lab at issue, reasoning that this information fell under the exemption for “[a]ny portion of an evaluation or report of an inspection of a specific registered person . . . that discloses the identity or location of a specific registered person if the agency determines that public disclosure of the information would endanger public health or safety.” Id. § 262a(h)(1)(E). We refer to this second exemption as the “public endangerment exemption.”

1

We begin with the CDC’s redactions of the specific regulatory violations found at the UH biolab, justified under BPRA’s site-specific exemption. For the reasons discussed

the information would endanger public health or safety.

42 U.S.C. § 262a(h)(1). below, we do not have jurisdiction to address these redactions.

While this appeal was pending, the CDC discovered that it had, in response to a separate 2015 FOIA request, disclosed a version of the CDC’s May 2014 letter to UH that included—without redactions—the regulatory violations found at UH. Accordingly, the CDC provided Civil Beat with both the unredacted May 2014 letter and a version of the inspection report with those regulatory violations revealed. The CDC contends that this disclosure mooted Civil Beat’s challenge to the CDC’s redactions of regulatory violations under § 262a(h)(1)(C). We agree.

Generally, “after the agency produces all non-exempt documents . . . , the specific FOIA claim is moot because the injury has been remedied.” Hajro v. U.S. Citizenship & Immigration Servs., 811 F.3d 1086, 1103 (9th Cir. 2016); see also Papa v. United States, 281 F.3d 1004, 1013 (9th Cir. 2002). An exception exists, however, when a FOIA requester alleges “that an agency policy or practice will impair the party’s lawful access to information in the future.” Hajro, 811 F.3d at 1103 (quoting Payne Enters., Inc. v. United States, 837 F.2d 486, 491 (D.C. Cir. 1988)). That exception has no application here.

Civil Beat’s complaint sought relief only for the FOIA request at issue—that is, a request for the two specific documents the CDC had refused to provide. Because the CDC has now produced versions of the documents revealing one category of the information Civil Beat sought—the regulatory violations uncovered at the UH biolab—Civil Beat’s claim is moot as to that information. See id.; Papa, 281 F.3d at 1013.

CIVIL BEAT LAW CTR. V. CDC 13

Civil Beat’s contention that the CDC has not “abandoned” its interpretation of BPRA does not, on its own, give rise to a pattern-or-practice claim. To establish such a claim, a plaintiff must show that “the plaintiff himself has a sufficient likelihood of future harm by the policy or practice.” Hajro, 811 F.3d at 1103. A plaintiff’s allegations that he regularly files FOIA requests with a certain agency but that agency consistently fails to respond to those requests in a timely fashion would, for example, support a pattern-or- practice claim. See id. at 1104. Here, however, apart from vague allusions in Civil Beat’s briefs to “the next Law Center request for inspection results,” nothing in the record suggests that Civil Beat will be affected by the CDC’s invocation of the site-specific BPRA exemption to FOIA. “Past exposure to illegal conduct does not in itself show a present case or controversy regarding injunctive relief . . . if unaccompanied by any continuing, present adverse effects.” O’Shea v. Littleton, 414 U.S. 488, 495–96 (1974). Civil Beat’s claim as to the site-specific exemption is therefore moot.

Because this mootness “result[ed] from the unilateral action of the party who prevailed in the lower court,” we vacate the district court’s decision pertaining to the redactions CDC justified on the site-specific exemption. U.S. Bancorp Mortg. Co. v. Bonner Mall P’ship, 513 U.S. 18, 23 (1994); see also United States v. Munsingwear, Inc., 340 U.S. 36, 39 (1950); All. for the Wild Rockies v. U.S. Forest Serv., 907 F.3d 1105, 1121 (9th Cir. 2018). 2

2 We decline Civil Beat’s invitation to declare that the district court’s opinion has “no persuasive authority” as to the mooted issues. “No matter what we conclude, the opinion of the district court will not be ripped from Federal Supplement [3]d. It will still be available and will 2

We turn to the second BPRA exemption at issue—the public endangerment exemption, under which an agency may withhold “[a]ny portion of an evaluation or report of an inspection of a specific registered person . . . that discloses the identity or location of a specific registered person if the agency determines that public disclosure of the information would endanger public health or safety.” 42 U.S.C. § 262a(h)(1)(E). 3 Relying on this exemption, the CDC withheld all references to the registered entity—that is, the University of Hawai’i at Mānoa—as well as the names of UH’s employees and the location of the specific biolab at issue.

(a) At this juncture, these redactions seem rather trivial. It is now publicly known that the biolab is located at the University of Hawai’i at Mānoa and that researchers use the biolab to study several biological agents and toxins. The CDC nonetheless contends that public health and safety would be endangered were it to publish any information concerning the “identity or location” of the registered entity in conjunction with the regulatory violations already disclosed.

The district court agreed, reasoning that “there is no exception in [BPRA] allowing the CDC to produce exempt

still be citable for its persuasive weight.” NASD Dispute Resolution, Inc. v. Judicial Council, 488 F.3d 1065, 1069 (9th Cir. 2007).

3 BPRA refers to “registered persons,” which includes “person[s] other than . . . individual[s],” as permissible registrants with HHS. 42 U.S.C. § 262a(e)(6)(B); see also 42 C.F.R. § 73.7(a) (discussing registration for “an individual or entity”). Because the “registered person” at issue here is a university, we use the term “registered entity.”

CIVIL BEAT LAW CTR. V. CDC 15

information that has already entered the public domain through other means.” Civil Beat Law Ctr., 204 F. Supp. 3d at 1145. Because the CDC “has never ‘officially acknowledged’ or made any documented disclosure of the redacted information,” the district court concluded, “the CDC has satisfied its burden for redacting any references to the University of Hawai’i in the Documents.” Id. In reaching this conclusion, the district court relied on cases establishing a principle termed the “official-acknowledgment doctrine.” That doctrine has no application here.

Under the official acknowledgment doctrine, “[i]f the government has officially acknowledged information, a FOIA plaintiff may compel disclosure of that information even over an agency’s otherwise valid exemption claim.” ACLU v. U.S. Dep’t of Def., 628 F.3d 612, 620 (D.C. Cir. 2011); see also Pickard v. Dep’t of Justice, 653 F.3d 782, 786 (9th Cir. 2011). “For information to qualify as ‘officially acknowledged,’ it must satisfy three criteria: (1) the information requested must be as specific as the information previously released; (2) the information requested must match the information previously disclosed; and (3) the information requested must already have been made public through an official and documented disclosure.” ACLU, 628 F.3d at 620–21. The public availability of the requested information does not, on its own, trigger application of the official-acknowledgment doctrine. “[I]nstead, the specific information sought by the plaintiff must already be in the public domain by official disclosure.” Id. at 621 (quoting Wolf v. CIA, 473 F.3d 370, 378 (D.C. Cir. 2007)).

The official-acknowledgment doctrine, however, applies only as to waiver to an “otherwise valid” assertion of a FOIA exemption. ACLU, 628 F.3d at 620. In that context, official acknowledgement functions as a waiver—that is, the government, by officially acknowledging information it could otherwise have withheld, waives its right to withhold it. See Wolf, 473 F.3d at 379 (referring to the doctrine as the “official acknowledgment waiver”). Here, Civil Beat contests the availability of a FOIA exemption at step one— that is, it asserts the CDC was not permitted to rely on BPRA’s exemption for information that “endanger[s] public health or safety.” 42 U.S.C. § 262a(h)(1)(E). If Civil Beat is correct that the CDC never had the right to withhold the requested information in the first place, no waiver concept is pertinent, and the official-acknowledgment doctrine has no application.

(b) Our question, then, is simply whether the CDC has met its burden of showing that the public endangerment exemption applies. That is, we must determine whether the CDC correctly “determine[d] that public disclosure of the information would endanger public health or safety.” 42 U.S.C. § 262a(h)(1)(E). 4

4 The CDC argues that we should accord deference to the agency’s interpretation of the statute, but our case law is to the contrary. We have explicitly rejected the applicability of “a more deferential, administrative law standard of review” in determining the scope of an Exemption 3 statute. Carlson, 504 F.3d at 1126–27; see also Lessner v. U.S. Dep’t of Commerce, 827 F.2d 1333, 1335 (9th Cir. 1987); Long v. IRS, 742 F.2d 1173, 1178 n.12 (9th Cir. 1984). But see Tax Analysts v. IRS, 117 F.3d 607, 613 (D.C. Cir. 1997); Aronson v. IRS, 973 F.2d 962, 965 (1st Cir. 1992). By contrast, we do “accord substantial weight to an agency’s declarations regarding the application of a FOIA exemption.” Shannahan v. IRS, 672 F.3d 1142, 1148 (9th Cir. 2012). Still, even if we were to apply a deferential standard, we would reject the CDC’s interpretation, for the reasons stated in the text.

We reject the CDC’s contention that special deference is accorded to agencies in determining the scope of a FOIA exemption relating to

CIVIL BEAT LAW CTR. V. CDC 17

The CDC’s essential contention in its briefing to us is that disclosure of a registered entity’s identity or location will always endanger public health or safety. That categorical position cannot be squared with BPRA’s text, structure, and legislative history. Instead, BPRA requires that the CDC justify the applicability of the exemption on a case-by-case basis.

The statute clearly contemplates that, in some circumstances, disclosure of an identity or location would not endanger public health or safety. Otherwise, the qualification that the exemption apply only “if the agency determines that public disclosure of the information would endanger public health or safety,” 42 U.S.C. § 262a(h)(1)(E), would be meaningless.

Our noncategorical understanding of the public endangerment exemption is reinforced by the history of the statute’s enactment. “[W]here ‘the language is ambiguous or is capable of more than one reasonable interpretation, we “consult the legislative history, to the extent that it is of value, to aid in [the] interpretation.”’” United States v. Lyle, 742 F.3d 434, 436 (9th Cir. 2014) (alteration in original) (quoting United States v. Thompson, 728 F.3d 1011, 1015 (9th Cir. 2013)).

The original version of BPRA, as passed by the House of Representatives, categorically barred agencies from disclosing an identity or location of a registered entity. That

national security. As in other FOIA cases, we determine for ourselves the scope of national security FOIA exemptions but give deference to the agency’s factual assertions. See Hamdan v. U.S. Dep’t of Justice, 797 F.3d 759, 769 (9th Cir. 2015). version provided that “[a]ny information in the possession of any Federal agency that identifies a person, or the geographic location of a person, who is registered pursuant to regulations under this section . . . shall not be disclosed under section 552(a) of title 5, United States Code.” H.R. 3448, 107th Cong., § 201(a)(1) (as passed by House, Dec. 12, 2001). 5 The version of BPRA ultimately enacted, however, was less restrictive, allowing for the disclosure of an identity or location unless that disclosure “would endanger public health or safety.” 42 U.S.C. § 262a(h)(1)(E).

Notably, BPRA’s legislative history speaks directly to the role of public availability in making a public endangerment determination. While introducing the conference report for BPRA, Representative Billy Tauzin, the chief architect of BPRA, discussed the public endangerment exemption at length. He noted that the purpose of the exemption was to “protect site-specific information on inspection reports, provided that the agency determines public disclosure would endanger public health and safety.” 148 Cong. Rec. H2846 (May 22, 2002) (statement of Rep. Tauzin). “By adding this additional requirement for inspection documents,” Representative Tauzin explained, “we are striving to ensure a fair balance between public accountability and security.” Id. He provided an example:

When a registered person is publicly known to be working with select agents, public disclosure of an inspection report is less

5 This language did not change after the Senate passed an amended version of the bill. See H.R. 3448, 107th Cong., § 201(a)(1) (as passed by Senate, Dec. 20, 2001).

CIVIL BEAT LAW CTR. V. CDC 19

likely to endanger public health or safety (provided that security-specific information is redacted), and may improve it by ensuring public accountability. But when the activities of a registered person are not publicly known, revealing the identity and location of a registered person would more likely endanger public health or safety. The agencies will need to consider such matters on a case-by-case basis.

Id. (emphasis added).

The CDC’s position in its brief—that it may always redact the identity or location of a registered entity, even if the identity or location are publicly known—borders on the categorical exemption Congress considered and rejected. 6

6 At oral argument, the CDC suggested for the first time that disclosure could be permissible if the requested “evaluation or report of an inspection” reported a clean bill of health for the registered entity. See Oral Argument at 21:09–22:10, Civil Beat Law Ctr. for the Pub. Interest, Inc. v. Ctrs. for Disease Control & Prevention, No. 16-16960 (9th Cir. Oct. 9, 2018), https://www.ca9.uscourts.gov/media/view_video.php?pk _vid=0000014323. But the public endangerment concern regarding disclosure of identity and location of individuals working with toxins presumably is that knowing where the toxins are and who is working with them could make it easier to find, take, and use the toxins for nefarious purposes. That concern does not correlate with whether a particular laboratory violates rather than follows applicable safety and use regulations.

Moreover, as this litigation shows, the public interest in accountability is at its peak when the requested record does contain regulatory deficiencies. Given that the stated purpose of the exemption was “to ensure a fair balance between public accountability and security,” 148 Cong. Rec. H2846 (May 22, 2002) (statement of Rep. Tauzin), it would make little sense for Congress to prohibit disclosure in Moreover, the CDC offers no explanation for how its position can be reconciled with Representative Tauzin’s instruction that “public disclosure of an inspection report is less likely to endanger public health or safety” when the requested information is “publicly known” and, to the contrary, “may improve [public health and safety] by ensuring public accountability.” 148 Cong. Rec. H2846 (May 22, 2002) (statement of Rep. Tauzin).

In sum, Congress intended the public endangerment determination to be “consider[ed] . . . on a case-by-case basis.” Id. That principle applies to publicly available information as well as to information not known to the public.

(c) The case-by-case approach under the BPRA public endangerment exemption is consistent with our general FOIA requirement that, “[t]o justify withholding, the government must provide tailored reasons in response to a FOIA request. It may not respond with boilerplate or conclusory statements.” Shannahan, 672 F.3d at 1148. Here, the CDC offered only cursory statements explaining how public health and safety would be endangered by FOIA disclosure. These “boilerplate” and “conclusory” statements did not establish that the CDC conducted an adequate case- by-case inquiry in reaching its public endangerment determination.

For example, in a letter responding to Civil Beat’s FOIA request, the CDC wrote, “While it is clear that you already know the specific site and the registered person related to

the one circumstance in which the public is best able to hold a registered entity accountable and allow it categorically where the accountability interest is minimal.

CIVIL BEAT LAW CTR. V. CDC 21

your request, release of further details would hinder the prevention of unauthorized access to listed agents and toxins.” No explanation of this conclusion was provided, and the redactions appear to include the information already known. Likewise, in an affidavit filed with the district court, the CDC provided a one-sentence statement:

The fact that Plaintiff may know the identity and/or location of the registered person does not render as non-exempt the redacted information protected by FOIA Exemption 3 and 42 U.S.C. § 262a(h)(1)(C) and/or (E); nor does it excuse the CDC from its duty not to disclose information protected by 42 U.S.C. § 262a(h)(1).

That’s it. Nothing further was said to explain why the CDC redacted the already-known identity and location information.

The most detailed explanation the CDC offered is another affidavit, which asserts that “the release of specific locations (e.g., rooms in a building) where [agents and toxins are] stored or worked with . . . will increase the risk of unauthorized access to [agents and toxins] by increasing the chances that [agents and toxins] will be found when otherwise lost-in-the-crowd of the larger campus of the entity.” This explanation may have been plausible, were more explanation provided, as to redaction of “specific locations (e.g., rooms in a building).” But, again, the CDC redacted all references to identity or location, even though the identity (the University of Hawai’i at Mānoa) and general location (the on-campus biolab) are both publicly known. Nothing was said to explain how those broad redactions protected public health and safety. In sum, the CDC was not entitled to rely on the official- acknowledgment doctrine, and on the current record, it did not otherwise justify its complete withholding of identity and location information. The district court therefore erred in granting summary judgment to the agency.

(d) Civil Beat cross-moved for summary judgment in its favor and has appealed the denial of its motion. “[S]ummary judgment in favor of the FOIA plaintiff is appropriate” only “[w]hen an agency seeks to protect material which, even on the agency’s version of the facts, falls outside the proffered exemption.” Petroleum Info. Corp. v. U.S. Dep’t of Interior, 976 F.2d 1429, 1433 (D.C. Cir. 1992). On the present record, we cannot conclude that the Civil Beat is entitled to judgment as a matter of law. See Fed. R. Civ. P. 56(a). For example, as we have just observed, the record does not negate the possibility that some of the more detailed redacted identity and location information is not publicly known and could, if disclosed, endanger public safety. Further record development could illuminate this point.

We therefore remand to the district court for further proceedings consistent with the principles outlined here. See Animal Legal Def. Fund v. U.S. Food & Drug Admin., 836 F.3d 987, 990 (9th Cir. 2016) (en banc) (per curiam). We emphasize that the CDC will be able justify withholding some of the identity and location information only if it “provide[s] tailored reasons,” not “boilerplate or conclusory statements,” for doing so. Shannahan, 672 F.3d at 1148.

B

In addition to information concerning the identity and location of the UH biolab, Civil Beat also sought the disclosure of parts of the requested documents that revealed the names and contact information of the CDC employees

CIVIL BEAT LAW CTR. V. CDC 23

who conducted the 2014 inspection. The CDC maintains that this information comes within FOIA Exemption 6, which provides that FOIA “does not apply to . . . personnel and medical files and similar files the disclosure of which would constitute a clearly unwarranted invasion of personal privacy.” 5 U.S.C. § 552(b)(6).

To determine whether disclosure would result in a “clearly unwarranted invasion of personal privacy,” we “must balance the public interest in disclosure against the interest Congress intended the [e]xemption to protect.” U.S. Dep’t of Def. v. Fed. Labor Relations Auth., 510 U.S. 487, 495 (1994) (alteration in original) (quoting U.S. Dep’t of Justice v. Reporters Comm. for Freedom of Press, 489 U.S. 749, 776 (1989)).

Balancing these interests involves two steps. “First, we evaluate the personal privacy interest at stake to ensure ‘that disclosure implicates a personal privacy interest that is nontrivial or . . . more than [] de minimis.’” Cameranesi v. U.S. Dep’t of Def., 856 F.3d 626, 637 (9th Cir. 2017) (alterations in original) (quoting Yonemoto v. Dep’t of Veterans Affairs, 686 F.3d 681, 693 (9th Cir. 2012), overruled on other grounds by Animal Legal Def. Fund, 836 F.3d 987). “Disclosures that would subject individuals to possible embarrassment, harassment, or the risk of mistreatment”—including disclosures of an individual’s identity—“constitute nontrivial intrusions into privacy under Exemption 6.” Cameranesi, 856 F.3d at 638.

Second, “the requester ‘must show that the public interest sought to be advanced is a significant one and that the information [sought] is likely to advance that interest.’” Id. at 637 (alteration in original) (quoting Lane v. Dep’t of Interior, 523 F.3d 1128, 1137 (9th Cir. 2008)). For this second step, “the only relevant ‘public interest in disclosure’ to be weighed in this balance is the extent to which disclosure would serve the ‘core purpose of the FOIA,’ which is ‘contribut[ing] significantly to public understanding of the operations or activities of the government.’” Fed. Labor Relations Auth., 510 U.S. at 495 (alteration in original) (emphases omitted) (quoting Reporters Comm., 489 U.S. at 775).

Civil Beat argues that the CDC’s employees will not be subject to embarrassment or harassment because their identities are already publicly available. As Civil Beat points out, the CDC maintains a public directory of the employees in the Division of Select Agents and Toxins, the office responsible for inspections, and identifies those employees as “inspectors.” We disagree.

Whether disclosure of an individual’s identity may result in embarrassment, harassment, or risk of mistreatment depends on context. We have previously recognized, for example, that “[government] agents retain an interest in keeping private their involvement in investigations of especially controversial events.” Lahr v. Nat’l Transp. Safety Bd., 569 F.3d 964, 977 (9th Cir. 2009); see also Forest Serv. Emps. for Envtl. Ethics v. U.S. Forest Serv., 524 F.3d 1021, 1026 (9th Cir. 2008). Here, providing the identities of CDC employees in a public directory is somewhat different from disclosing the identities of the specific CDC employees who have knowledge of particular vulnerabilities involving dangerous biological agents and toxins at a single biolab, vulnerabilities that have garnered attention from the press and the public. The CDC notes that, as a result of the inspection, the employees “have knowledge of . . . highly sensitive, national security records.” That knowledge, the CDC explains, may result in the employees “being targeted by a person with nefarious intentions.”

CIVIL BEAT LAW CTR. V. CDC 25

Nor do we agree with Civil Beat that the privacy interests offered by the CDC are “impermissibly speculative.” “[T]he invasion of a personal privacy interest may be ‘clearly unwarranted’ even when the invasion of privacy is far from a certainty.” Prudential Locations LLC v. U.S. Dep’t of Hous. & Urban Dev., 739 F.3d 424, 432 (9th Cir. 2013) (per curiam), abrogated on other grounds by Animal Legal Def. Fund, 836 F.3d 987. “We have never held that an agency must document that harassment or mistreatment have happened in the past or will certainly happen in the future; rather, the agency must merely establish that disclosure would result in a ‘potential for harassment.’” Cameranesi, 856 F.3d at 642 (quoting Forest Serv. Emps., 524 F.3d at 1026). Here, the CDC has provided a detailed affidavit explaining how the disclosure of its employees’ identities and contact information could potentially result in an invasion of privacy.

The threshold for meeting the first prong of the Exemption 6 inquiry is low—only a “nontrivial or . . . more than [] de minimis” privacy interest need be shown. Id. at 637 (alterations in original) (quoting Yonemoto, 686 F.3d at 693). With specific knowledge that particular CDC employees were involved in the UH biolab inspection, a nefarious person interested in the specific toxins handled at the UH biolab could choose to focus on those CDC employees—who would have knowledge of the layout and security measures at that lab—for harassment or threats. This additional location-specific risk is sufficient—albeit barely, in light of the public availability of the names of CDC employees in the Division of Select Agents and Toxins—to meet the low, “nontrivial” privacy interest threshold. On this record, the CDC has satisfied its burden of establishing a nontrivial privacy interest. As to whether disclosure would “‘appreciably further’ the public’s right to monitor the agency’s action,” Forest Serv. Emps., 524 F.3d at 1027 (quoting Fed. Labor Relations Auth., 510 U.S. at 497), Civil Beat has provided no reason why disclosure of the CDC employees’ identities and contact information would further this interest. Nor can we conceive of such a reason. As far as we can determine on this record, any errors in handling the toxic materials were made by the UH biolab and discovered by the CDC employees. The CDC employees have not been accused of any lack of diligence, and knowing their identity would provide no additional information about how the inspection was carried out. Withholding the identities and contact information of the CDC employees under Exemption 6 was therefore proper.

III

We dismiss as moot that part of the appeal pertaining to the disclosure of the specific regulatory violations and vacate those portions of the district court’s order. We affirm the district court’s grant of summary judgment as to the withholding under Exemption 6 of the identity and contact information of CDC employees involved in the UH biolab inspection. Finally, we reverse the district court’s grant of summary judgment to the CDC on the BPRA public endangerment exemption and remand to the district court for further proceedings consistent with this opinion.

DISMISSED in part, VACATED in part, AFFIRMED in part, REVERSED in part, and

REMANDED.