1 2 3 4 UNITED STATES DISTRICT COURT 5 NORTHERN DISTRICT OF CALIFORNIA 6 7 THE CENTER FOR INVESTIGATIVE Case No. 19-cv-05603-SK REPORTING, et al., 8 Plaintiffs, ORDER REGARDING CROSS 9 MOTIONS FOR SUMMARY v. JUDGMENT 10

UNITED STATES DEPARTMENT OF

11 LABOR, Regarding Docket Nos. 25, 36

12 Defendant.

13 14 The matter comes before the Court upon consideration of the motion for summary 15 judgment filed by Defendant United States Department of Labor (“DOL”) and the cross-motion 16 for summary judgment filed by Plaintiffs The Center for Investigative Reporting and Will Evans 17 (collectively, “Plaintiffs”). Having carefully considered the parties’ papers, relevant legal 18 authority, record in the case, and oral argument, the Court DENIES the DOL’s motion for 19 summary judgment and GRANTS Plaintiffs’ cross-motion for summary judgment for the reasons 20 set forth below. 21 BACKGROUND1 22 In this action, Plaintiffs seeks to compel the disclosure of documents from DOL’s 23 Occupational Safety and Health Administration (“OSHA”) pursuant to the Freedom of 24 Information Act (“FOIA”). Plaintiffs submitted three FOIA requests, all to obtain Amazon’s 25 injury and illness data that it provided to OSHA. Plaintiff submitted their first request on April 22, 26

27 1 The DOL objects to the declarations of Deepa Varadarajan, Sharon Sandeen, and David 1 2019 for OSHA’s file on an inspection of an Amazon warehouse in Stoughton, Massachusetts. 2 (Dkt. No. 1 (Compl.), ¶ 2.) This request and DOL’s response to it are no longer disputed. (Dkt. 3 No. 24 (Parties’ Stipulation), ¶ 1.) Plaintiffs submitted their second request on May 13, 2019 to 4 OSHA seeking the forms Amazon provided on its annual statistics on injuries, illnesses and 5 fatalities at certain Amazon facilities in Ohio. (Dkt. No. 1, ¶ 3.) Plaintiffs submitted their third 6 request on May 15, 2019 to OSHA seeking the forms Amazon provided on its annual statistics on 7 injuries, illnesses and fatalities at certain Amazon facilities in Illinois. (Id., ¶ 4.) The sole dispute 8 regarding Plaintiff’s second and third FOIA requests is whether Plaintiffs may obtain Amazon’s 9 unredacted data on its OSHA Form 300As, which are summaries of Amazon’s work-related 10 injuries and illnesses. (Dkt. No. 24, ¶ 2.) 11 A. OSHA’s Forms. 12 The Occupational Safety and Health Act of 1970 (the “Act”), 29 U.S.C. § 651 et seq., was 13 enacted “to assure so far as possible every working man and woman in the Nation safe and 14 healthful working conditions. . . .” 29 U.S.C. § 651(b). “To that end, Congress authorized the 15 Secretary of Labor to set mandatory occupational safety and health standards applicable to all 16 businesses affecting interstate commerce.” Gade v. Nat’l Solid Wastes Mgmt. Ass’n, 505 U.S. 88, 17 96 (1992) (citing 29 U.S.C. § 651(b)(3)). OSHA, a division of the DOL, promulgates and 18 enforces these standards, as well as regulations that require “employers to maintain accurate 19 records of, and to make periodic reports on, work-related deaths, injuries and illnesses . . .” 29 20 U.S.C. § 655, 657(c)(2). 21 Pursuant to DOL’s statutory authority to “develop and maintain an effective program of 22 collection, compilation, and analysis of occupational safety and health statistics,” 29 U.S.C. § 23 673(a), “OSHA requires employers with more than 10 employees to use a set of standardized 24 forms when recording workplace injuries and illnesses – Form 300 to generate a log of all work- 25 related injuries or illnesses, Form 301 to generate an incident report for each individual case, and 26 Form 300A to prepare an annual summary derived from the information collected on the log.” 27 Pub. Citizen Health Research Grp. v. Acosta, 363 F. Supp. 3d 1, 7 (D.D.C. 2018) (citing 29 C.F.R. 1 OSHA’s Form 300 provides a log of work-related injuries and illnesses, including 2 identifying the employee’s name and job title, and requires a description of the date and location 3 on the premises of the event, as well as a description of the injury or illness, the parts of the body 4 affected, and the object or substance which caused the injury or illness. Additionally, for each 5 illness or injury, the employer must state whether the event resulted in death, days away from 6 work, job transfer or restriction, or was an “[o]ther recordable” case; must provide the number of 7 days the employee was away from work was on a job transfer or restriction; and must classify the 8 illness or injury into one of the six categories stated above. See OSHA Form 300 available at 9 https://www.osha.gov/recordkeeping/osha-rkforms-winstr_fillable.pdf. 10 OSHA’s Form 301 injury and illness incident report provides even more detailed 11 information about each work-related injury or illness, including the full name and address of the 12 affected employee, the employee’s physician or health care professional’s information, details 13 about the employee’s medical treatment, the date and time of the event, and more detailed 14 descriptions about the event. See OSHA Form 301 available at 15 https://www.osha.gov/recordkeeping/osha-rkforms-winstr_fillable.pdf. 16 OSHA’s Form 300A, which is the only form at issue in this case, is entitled “Summary of 17 Work-Related Injuries and Illnesses.” (Dkt. No. 26 (Declaration of Marc Choi), Ex. C.) On the 18 form, employers are required to list the total number in a calendar year of: (1) deaths; (2) cases 19 with days away from work; (3) cases with job transfer or restriction; (4) other recordable cases; (5) 20 days away from work; and (6) days of job transfer or restriction. The form also breaks down the 21 types of injuries and illnesses into 6 broad categories, and requires employers to state the total 22 number of: (1) injuries; (2) skin disorders; (3) respiratory conditions; (4) poisonings; (5) hearing 23 loss; and (6) all other illnesses. The employer then provides the following establishment 24 information: company name, address, industry description, annual average number of employees, 25 and total hours worked by all employees in the last year. (Id.) The Form 300A does not include 26 any identifying information on the injured or sick employees. 27 B. OSHA’s Regulations. 1 the injuries and illnesses recorded on the OSHA 300 Log, which is the OSHA Form 300A, and 2 post the summary. 29 C.F.R. § 1904.32(a). Employers must post the Form 300As “in a 3 conspicuous place or places where notices to employees are customarily posted[]” from February 4 1 through April 30 “of the year following the year covered by the records.” 29 C.F.R. § 5 1904.32(b)(5), (6). 6 OSHA regulations require employers to save the OSHA Form 300A, along with the 300 7 Log and the 301 Incident Report forms, for five years following the end of the calendar year that 8 these records cover. 29 C.F.R. § 1904.33. Employers are required to provide copies of these 9 illness and injury records to current employees, former employers, and the employees’ 10 representatives. 29 C.F.R. § 1904.35(a)(3), (b)(2). The regulations define employee 11 representative to include an authorized collective bargaining agent of the employee, the legal 12 representative, or any person that the employee or former employee designates as their 13 representative in writing. Id., § 1904.25(b)(2)(i), (ii).2 14 In the preamble to the Final Rule creating these forms, OSHA stated that an “employer 15 may not require an employee, former employee or designated employee representative to agree to 16 limit the use of the records as a condition for viewing or obtaining copies of records.” 17 Occupational Injury and Illness Recording and Reporting Requirements, 66 Fed. Reg. 5916-01, 18 6058 (Jan. 19, 2001). 19 In 2016, OSHA issued a Final Rule requiring certain employers to electronically submit 20 the three illness and injury forms to OSHA on an annual basis. See Improve Tracking of 21 Workplace Injuries and Illnesses, 81 Fed. Reg. 29624-01, 29692 (May 12, 2016); 29 C.F.R. § 22 1904.41. Under new the rule, employers with 250 or more employees were required to 23 electronically submit the Forms 300, 300A, and 301 to OSHA each year, and employers in certain 24 industries with 20 or more employees were required to electronically submit the Form 300A. 29 25 C.F.R. § 1904.41(a). However, OSHA subsequently amended this regulation to require employers 26 2 Defendants purport to quote from this regulation, stating that “the regulation itself 27 describes this mandatory disclosure framework as “limited access to . . . injury and illness records 1 to submit only the Form 300A electronically every year. Tracking of Workplace Injuries and 2 Illnesses, 84 Fed. Reg. 380-01, 405 (Jan. 25, 2019); 29 C.F.R. § 1904.41. 3 C. OSHA’s Statements Regarding Publicly Posting the Form 300As. 4 In 2013, OSHA announced its plan to publicly post the data from the Form 300As online. 5 See OSHA National News Release, OSHA announces proposed new rule to improve tracking of 6 workplace injuries and illnesses (Nov. 7, 2013) available at 7 https://www.osha.gov/news/newsreleases/national/11072013. The news release stated: 8 [OSHA] today issued a proposed rule to improve workplace safety and health through improved tracking of workplace injuries and 9 illnesses. The announcement follows the Bureau of Labor Statistics’ release of its annual Occupational Injuries and Illnesses report, which 10 estimates that three million workers were injured on the job in 2012. 11 . . . 12 OSHA plans to eventually post the data online, as encouraged by President Obama’s Open Government Initiative. . . . 13 (Id.) 14 In the preamble to the 2016 Final Rule requiring certain employers to electronically submit 15 the illness and injury forms to OSHA on an annual basis, OSHA stated that it “intends to post the 16 data from these submissions on a publicly accessible Web site,” but “does not intend to post any 17 information on the Web site that could be used to identify individual employees.” Improve 18 Tracking of Workplace Injuries and Illnesses, 81 Fed. Reg. at 29625. 19 The preamble further states: 20 the final rule recognizes that public disclosure of data can be a 21 powerful tool in changing behavior. In this case, the objective of disclosure of data on injuries and illnesses is to encourage employers 22 to abate hazards and thereby prevent injuries and illnesses, so that the employer’s establishment can be seen by members of the public, 23 including investors and job seekers, as one in which the risk to workers’ safety and health is low. 24 OSHA believes that disclosure of and public access to these data will 25 (using the word commonly used in the behavioral sciences literature) “nudge” some employers to abate hazards and thereby prevent 26 workplace injuries and illnesses, without OSHA having to conduct onsite inspections . . . . 27 Id., 81 Fed. Reg. at 29629. In commentating on the how the planned public posting was just a 1 small change, OSHA stated: 2 injury and illness records kept under part 1904 are already available to OSHA and the public in a variety of ways. The annual summary 3 data must be posted where employees can see it. Employees or their representatives can also obtain and make public most of the 4 information from these records at any time, if they wish. . . . 5 Id., 81 Fed. Reg. at 29684. OSHA further summarized the benefits of publicizing the injury and 6 illness data: 7 First, the online posting of establishment-specific injury and illness information will encourage employers to improve workplace safety 8 and health to support their reputations as good places to work or do business with. . . . By requiring complete, accurate reporting, 9 interested parties will be able to gauge the full range of injury and illness outcomes. 10 Second, these data will be useful to employers who want to use 11 benchmarking to improve their own safety and health performance. . . . Using data collected under this final rule, employers can compare 12 injury and illness rates at their establishments to those at comparable establishments, and set workplace safety/health goals benchmarked 13 to the establishments they consider most comparable. 14 Third, online availability of establishment-specific injury and illness information will allow employees to compare their own workplaces 15 to the safest workplaces in their industries . . . . In addition, if employees preferentially choose employment at the safest workplaces 16 in their industries, then employers may take steps to improve workplace safety and health (preventing injuries and illnesses from 17 occurring) in order to attract and retain employees. 18 Fourth, access to these [sic] data will improve the workings of the labor market by providing more complete information to job seekers, 19 and, as a result, encourage employers to abate hazards in order to attract more desirable employees . . . . 20 Fifth, access to data will permit investors to identify investment 21 opportunities in firms with low injury and illness rates. If investors . . . preferentially invest in firms with low rates, then employers may 22 take steps to improve workplace safety and health and prevent injuries and illnesses from occurring in order to attract investment. 23 Sixth, using data collected under this final rule, members of the public 24 will be able to make more informed decisions about current and potential places with which to conduct business. . . . Such decisions 25 by customers would also encourage establishments with higher injury/illness rates in a given industry to improve workplace safety in 26 order to become more attractive to potential customers. 27 . . . . Public disclosure of employers’ injury and illness rates will be Disclosure of and access to injury and illness data have the potential 1 to improve research on the distribution and determinants of workplace injuries and illnesses, and therefore to prevent workplace injuries and 2 illnesses from occurring. Like the general public, researchers currently have access only to the limited injury/illness data described 3 above. Using data collected under this final rule, researchers might identify previously unrecognized patterns of injuries and illnesses 4 across establishments where workers are exposed to similar hazards. . . . 5 The availability of establishment-specific injury and illness data will 6 also be of great use to county, state and territorial Departments of Health and other public institutions charged with injury and illness 7 surveillance. . . . 8 [O]nline access to this large database of injury and illness information will support the development of innovative ideas for improving 9 workplace safety and health, and will allow everyone with a stake in workplace safety and health to participate in improving occupational 10 safety and health. 11 Furthermore, because the data will be publicly available, industries, trade associations, unions, and other groups representing employers 12 and workers will be able to evaluate the effectiveness of privately- initiated injury and illness prevention initiatives that affect groups of 13 establishments. . . . 14 Finally, public access to these data will enable developers of software and smartphone applications to develop tools that facilitate use of 15 these data by employers, workers, researchers, consumers and others. . . . 16 Id., 81 Fed. Reg. at 29630-631. OSHA further stated it: 17 strongly disagrees with the commenter that a strong illness and injury 18 prevention program can be based on hiding basic information on injury and illness rates from either employees or the public. Illness 19 and injury prevention programs work best when data on injuries and illnesses is collected and analyzed frequently and used as a tool to 20 improve safety and health. As discussed above, this data collection effort will allow scholars and public health experts to analyze 21 establishment data, discover patterns in injuries and illnesses, and recommend solutions. 22 Id., 81 Fed. Reg. at 29683. 23 In a FOIA lawsuit filed in the United States District Court for the District of Columbia, the 24 DOL asserted that the Form 300As were confidential business information under Exemption 4. 25 See Public Citizen Foundation v. United States Department of Labor, Case No. 18-cv-00117- 26 EGS-GMH (D.D.C.), cited to by the DOL in Declaration of Patrick Kapust, ¶ 24 (Dkt. No. 39-1).) 27 On June 1, 2018, the DOL stated in a motion for summary judgment filed in District of D.C. case: 1 “It is OSHA’s intent to release the data only when it finishes using the data to target employers for 2 inspection – approximately four years after the year to which the data relates.” (Public Citizen 3 Foundation v. United States Department of Labor, Case No. 18-cv-00117 - EGS-GMH (D.D.C.), 4 Dkt. No. 14 at pp.19-20.) DOL went on to explain that data from the calendar year 2016 would be 5 released in 2020 and that data from the calendar year 2017 would be released in 2021. (Id.) 6 In the preamble to the 2019 Final Rule rescinding the requirement for employers to 7 electronically submit Forms 300 and 301 annually, OSHA stated: 8 [I]n relation to concerns raised about possible publication of data submitted electronically to OSHA from Form 300A . . . the agency 9 takes the position that these [sic] data are exempt from public disclosure under FOIA. It should likewise be noted that OSHA uses 10 and will continue to use 300A data to prioritize its inspections and enforcement actions. Among other considerations, disclosure of 11 300A data through FOIA may jeopardize OSHA's enforcement efforts by enabling employers to identify industry trends and 12 anticipate the inspection of their particular workplaces. As OSHA has explained elsewhere, OSHA is strongly opposed to disclosure of 13 300A data, has not made such data public, and does not intend to make any such data public for at least the approximately four years after its 14 receipt that OSHA intends to use the data for enforcement purposes. 15 84 Fed. Reg. at 383. 16 On August 23, 2019, OSHA publicly stated on its website that it considers “the 300A data 17 as confidential commercial information, and will not release it to the public.” (Dkt. No. 39-1, ¶ 25 18 (citing https://www.osha.gov/recordkeeping/index.html).) 19 OSHA’s Field Operations Manual, as it was updated on September 13, 2019, provides that 20 “information obtained during inspections is confidential, but can be disclosable or non-disclosable 21 based on criteria established in the Freedom of Information Act.” (Dkt. No. 26, ¶¶ 15, 17 (citing 22 to https://www.osha.gov/sites/default/files/enforcement/directives/CPL_02-00-163.pdf).) The 23 Field Operations Manual OM further states that, “[a]ny classified or trade secret information 24 and/or personal knowledge of such information by Agency personnel shall be handled in 25 accordance with OSHA regulations.”3 (Id.) 26 /// 27

D. DOL’s and Department of Justice’s Positions Regarding Confidentiality and

1 Exemption 4. 2 FOIA includes a number of exemptions – materials which are not required to be produced 3 in response to a request for documents. Under Exemption 4, FOIA provides that it does not apply 4 to: “trade secrets and commercial or financial information obtained from a person and privileged 5 or confidential.” 5 U.S.C.A. § 552(b)(4). 6 Before the Supreme Court ruling in Food Marketing Institute v. Argus Leader Media, 139 7 S. Ct. 2356, 2362 (2019) (“Food Marketing”), OSHA routinely released OSHA 300, 300A, and 8 301 forms in response to FOIA requests. (Dkt. No. 26, ¶ 29; Dkt No. 28 (Declaration of Francis 9 Meilinger), ¶ 6.) Amazon submitted all of the Form 300As at issue in this litigation before Food 10 Marketing. (Dkt No. 26, Ex. F; Dkt. No. 48 (chart of responsive documents); Dkt. No. 25 n.10 11 (“These Form 300As were submitted by Amazon prior to the [Food Marketing] decision . . .”).) 12 However, after Food Marketing in which the Supreme Court address the meaning of 13 “confidential” in Exemption 4, OSHA reevaluated its policy and, as of September 12, 2019, now 14 contends that all three forms contain confidential commercial data which should be withheld under 15 FOIA Exemption 4. (Dkt. No. 26, ¶ 30; Dkt. No. 28, ¶ 7.) 16 The Department of Justice (“DOJ”) guidelines regarding FOIA Exemption 4 state that 17 when notices on agency websites or communications with submitters explicitly notify submitters 18 of the agency’s intention to publicly disseminate the information, the information would be 19 deemed to have lost its confidential character. See Department of Justice, Exemption 4 After the 20 Supreme Court’s Ruling in Food Marketing Institute v. Argus Leader Media (updated Oct. 7, 21 2019) (referred to as “DOJ Exemption 4 Guidelines”), available at 22 https://www.justice.gov/oip/exemption-4-after-supreme-courts-ruling-food-marketing-institute-v- 23 argus-leader-media. The DOJ Exemption 4 Guidelines provide: 24 . . . notices [on agency websites] or communications [with submitters] could also explicitly notify submitters of the agency’s intention to 25 publicly disseminate the information. In those situations, the information, when objectively viewed in context, would be deemed 26 to have lost its “confidential” character under Exemption 4 upon its submission to the government, given that the submitter was on notice 27 that it would be disclosed. E. Plaintiff’s FOIA Requests and DOL’s Production. 1 DOL provided Plaintiffs with nine Amazon’s Form 300As in response to Plaintiffs’ FOIA 2 request. (Dkt No. 26, Ex. F; Dkt. No. 48.) DOL provided Plaintiffs with one form for the 2015 3 calendar year, one form for the 2016 calendar year, four forms for the 2017 calendar year, two 4 forms for the 2018 calendar year, and one form for the 2019 calendar year. Three of the forms for 5 the 2017 calendar year were signed by Amazon in late January 2018 and one was unsigned and 6 undated. The form for the 2016 calendar year was also unsigned and undated. (Dkt No. 26, Ex. F; 7 Dkt. No. 48.) According to the chart, Amazon did not submit the unsigned forms from 2015, 8 2016, and 2017 to OSHA under the regulations, but provided them to OSHA pursuant to the 9 inspections between September 6 and December 12, 2018. (Dkt. No. 48.) Amazon submitted its 10 signed 2017 forms pursuant to the regulations between March 14, 2018 and October 10, 2018 and 11 pursuant to OSHA’s inspections on June 28, 2018. (Id.) One of the forms for 2018 was dated 12 January 29, 2018 and the form for 2019 was dated February 7, 2019. These dates are likely 13 incorrect because the forms summarize the data collected at the year end. (Dkt No. 26, Ex. F; Dkt. 14 No. 48, n.4 (citing 29 CFR 1904.32(a)).) Amazon submitted these forms pursuant to the 15 regulations on February 23, 2019 and March 2, 2019 and pursuant to OSHA’s inspections between 16 February 6 and May 8, 2019. (Id.) The second form for the 2018 calendar year was unsigned and 17 undated, but according to the chart, Amazon submitted this form to OSHA pursuant to the 18 inspection between January 16 and 24, 2019 and pursuant to the regulations on January 23, 2019. 19 (Id.) 20 DOL redacted most of the data on these forms it produced to Plaintiffs. DOL provided 21 Amazon’s name, address and industry description, but redacted the average number of employees, 22 total hours worked, and all of the data on the injuries and illnesses. (Dkt. No. 26, Ex. F.) 23 Although DOL initially redacted this information both FOIA Exemptions 4 and 7, DOL now only 24 contends that Exemption 4 warrants withholding the data on Amazon’s Form 300As. 25 F. Amazon’s Declaration. 26 Amazon submits a declaration from Heather MacDougall, Vice President of Workplace 27 Health & Safety for Amazon.com Services LLC. (Dkt. No. 27.) She states that it is Amazon’s 1 policy to treat OSHA’s Form 300A, Form 300, and Form 301 confidential and refers to all three 2 forms together as Amazon’s “OSHA recordkeeping forms.” (Id. at ¶ 2.) 3 MacDougall states that Amazon considers the Form 300A to be confidential and that it has 4 been Amazon’s longstanding policy to treat this form as confidential and stamps it as confidential. 5 (Id., ¶¶ 3, 6.) Amazon only shares the form in four circumstances: “(1) upon request to current or 6 former employees or their representatives; (2) upon request to OSHA through inspection or 7 enforcement actions, (3) through electronic submission to OSHA; and (4) through posting in each 8 fulfillment center for the required three month period between February 1 and April 30 each year.” 9 (Id., ¶ 3.) 10 MacDougall notes that when Amazon provides the form to current and former employees, 11 or their authorized representatives, Amazon marks the form as confidential with the following 12 message: 13 In response to your request for the OSHA 300 Logs [and/or] 300A forms for the ____ facility located in [city] [state], I have enclosed the 14 following: [year range] logs. OSHA and Amazon consider this information confidential because, among other things, it has 15 personally identifiable information and personal medical information involving you or your co-workers. We do not share this information 16 with third-parties. As a [current] [former] employee we respect your right to access this confidential information pursuant to OSHA 17 regulations and request that you maintain its confidentiality. Please review and observe the following notice from OSHA that is in a box 18 at the top of the form 300: Attention: This form contains information relating to employee health and must be used in a manner that protects 19 the confidentiality of employees to the extent possible while information is being used for occupational safety and health purpose. 20 (Id., ¶ 4.) Amazon posts the Form 300A in an area which is only accessible to employees and 21 restricts access to the logs to employees with record keeping responsibilities. (Id., ¶¶ 5, 6.) 22 MacDougall states that: 23 Form 300-A includes confidential commercial information specific to 24 each Amazon facility, including total hours worked, total number of employees, total rates of injury, and total rates of missed work. . . . 25 Although Form 300-A does not itself contain personally identifiable sensitive medical information, the total injuries and illnesses that are 26 listed by categories could be used to profile Amazon’s injury trends at individual fulfillment centers, which would be a major component 27 of the sensitive information contained in OSHA Form 300 and 301. 1 (Id., ¶ 7.) 2 As an example of how Amazon responds to OSHA requests for its injury and illness 3 records, which include the Form 300A, MacDougall attached a cover letter Amazon sent to OSHA 4 in connection with one of the inspections at issue in this litigation. (Id., ¶ 11, Ex. A.) Amazon’s 5 letter states that it was providing its Form 300 Logs for 2017-2018, Form 300A Summary Form 6 for 2017, and Forklift Training Information in connection with OSHA’s onsite inspection of the 7 Amazon facility located in Waukegan, Illinois. (Id., Ex. A.) Amazon stated that it considered the 8 documents produced to be and to contain trade secrets and/or confidential, sensitive or proprietary 9 information and requested that OSHA protect the documents. (Id.) MacDougall stated that 10 Amazon stamped the Form 300A as confidential when it produced these documents to OSHA and 11 that the treatment of the Waukegan Form 300A reflects Amazon’s general policies and practices 12 regarding these forms. (Dkt. No. 38 (Supplemental Declaration of Heather MacDougall), ¶¶ 6-7.) 13 G. Plaintiffs’ Previous Public Records Requests for Amazon’s Form 300As. 14 Plaintiffs have previously requested Amazon’s Form 300As through FOIA and its state- 15 law analogues. (Dkt. No. 42-3 (Supplemental Declaration of Will Evans), ¶ 4.) In response to 16 such previous public records requests made between April 3, 2019 and August 19, 2019, Plaintiffs 17 received at least twenty of Amazon’s Form 300As which were not stamped confidential by 18 Amazon. (Id., ¶ 5, Ex. A.) 19 ANALYSIS 20 A. Legal Standards. 21 The purpose of the Freedom of Information Act (“FOIA”) is “‘to pierce the veil of 22 administrative secrecy and open agency action to the light of public scrutiny. . . .’” Department of 23 the Air Force v. Rose, 425 U.S. 352, 361 (1976) (citation omitted). FOIA reflects “‘a general 24 philosophy of full agency disclosure unless information is exempted under clearly delineated 25 statutory language.’” Id. at 360-61 (quoting S.Rep. No. 813, 89th Cong., 1st Sess., 3 (1965)). 26 FOIA’s “‘core purpose’ is to inform citizens about ‘what their government is up to.’” Yonemoto v. 27 U.S. Dep’t of Veterans Affairs, 686 F.3d 681, 687 (9th Cir. 2012) (quoting Dep’t of Justice v. 1 must bear in mind that FOIA mandates a ‘strong presumption in favor of disclosure,’ . . . and that 2 the statutory exemptions, which are exclusive, are to be ‘narrowly construed,’” Nat’l Ass’n of 3 Home Builders v. Norton, 309 F.3d 26, 32 (D.C. Cir. 2002) (quoting Dep’t of State v. Ray, 502 4 U.S. 164, 173 (1991) and Rose, 425 U.S. at 361); see also Maricopa Audubon Soc. v. U.S. Forest 5 Serv., 108 F.3d 1082, 1085 (9th Cir. 1997) (FOIA’s exemptions are “explicitly exclusive” and 6 “must be narrowly construed in light of FOIA’s dominant objective of disclosure, not secrecy.”) 7 (citations and quotations omitted). 8 “FOIA’s strong presumption in favor of disclosure places the burden on the government to 9 show that an exemption properly applies to the records it seeks to withhold.” Hamdan v. U.S. 10 Dep’t of Justice, 797 F.3d 759, 772 (9th Cir. 2015). Further, “[a] basic policy of FOIA is to 11 ensure that Congress and not administrative agencies determines what information is 12 confidential.” Lessner v. U.S. Dep’t of Commerce, 827 F.2d 1333, 1335 (9th Cir. 1987). For this 13 reason, courts do not give deference to a federal agency’s determination that requested information 14 falls under a particular FOIA exemption. Carlson v. U.S. Postal Serv., 504 F.3d 1123, 1127 (9th 15 Cir. 2007). To satisfy its burden, the agency “must provide a relatively detailed justification, 16 specifically identifying the reasons why a particular exemption is relevant and correlating those 17 claims with the particular part of a withheld document to which they apply.” Mead Data Cent., 18 Inc. v. U.S. Dep’t of the Air Force, 566 F.2d 242, 251 (D.C. Cir. 1977). 19 FOIA cases are typically decided on motions for summary judgment because the facts are 20 rarely in dispute. See Minier v. Cent. Intelligence Agency, 88 F.3d 796, 800 (9th Cir. 1996). On a 21 motion for summary judgment, district courts analyze the withholding of agency records de novo. 22 5 U.S.C. § 552(a)(4)(B). 23 B. The Parties’ Cross-Motions. 24 Exemption 4 under FOIA shields from mandatory disclosure “commercial or financial 25 information obtained from a person” which is “privileged or confidential.” Food Marketing, 139 26 S. Ct. at 2362. (quoting 5 U.S.C. § 552(b)(4)). In order to invoke Exemption 4, the government 27 agency must demonstrate that the information it seeks to protect is (1) commercial and financial 1 confidential.” Watkins v. U.S. Bureau of Customs & Border Prot., 643 F.3d 1189, 1194 (9th Cir. 2 2011) (citations and quotations omitted). 3 There is no dispute here that Amazon, as the submitting company, constitutes a person 4 under FOIA, as the definition includes corporations. 5 U.S.C. § 551(2). Thus, the issues in 5 dispute are whether the information sought is commercial or financial in nature and whether it is 6 privileged or confidential. Additionally, the parties dispute whether the DOL has demonstrated it 7 reasonably foresees that disclosure would harm an interest protected by Exemption 4 as required 8 by the FOIA Improvement Act of 2016. See 5 U.S.C. § 552(a)(8)(A)(i). However, because the 9 Court finds, as discussed below, that the Form 300As are not confidential, the Court need not 10 address whether the documents are financial or commercial or whether the DOL has satisfied the 11 foreseeable harm standard. 12 The Supreme Court clarified the standard for determining whether information is 13 “confidential” under Exemption 4 in Food Marketing. Contrary to what some courts previously 14 held, there is no statutory requirement to demonstrate “substantial competitive harm.” 139 S. Ct. 15 at 2360. Instead, the term “confidential” must be given its “ordinary, contemporary, common 16 meaning[,]” which is “private” or “secret.” Id. at 2363. Information may be communicated to 17 another and remain confidential, so long as the information is “customarily kept private, or at least 18 closely held, by the person imparting it.” Id. The Court in Food Marketing held that the company 19 submitting information satisfied this standard because it did not disclose the data or make it 20 publicly available and, even within the company, only small groups of employees had access to it. 21 Id. The Court declined to address whether assurances that the government would keep the 22 information private was also required to keep the information confidential because the government 23 did make such assurances. Id. The Court concluded that “[a]t least where commercial or financial 24 information is both customarily and actually treated as private by its owner and provided to the 25 government under an assurance of privacy, the information is ‘confidential’ within the meaning of 26 Exemption 4.” Id. at 2366. 27 1. Customarily and Actually Treated as Private. 1 300As as confidential and does not disclose them to the public. (Dkt. No. 25 at p.1.) However, 2 the Court finds that, based on the evidence in the record, Amazon has not customarily and actually 3 treated the data in the Form 300As as confidential.4 4 i. Required Posting at Facilities. 5 Pursuant to the regulations, Amazon is required to post the Form 300As for three months. 6 See 29 C.F.R. § 1904.32. Significantly, Amazon did not state that, when it posts the forms in its 7 facilities, that it cautions employees to keep the data on the form confidential and not to disclose 8 this data. (Dkt. No. 27.) In fact, in light of the regulations discussed below, it is not clear that 9 Amazon could restrict employee’s use and disclosure of these forms. Amazon explained that it 10 posts the forms in an area which is accessible only to employees. Nevertheless, Amazon is a large 11 company. Thus, pursuant to the regulation, the Form 300A is accessible to a large number of 12 people. 13 The DOL misleadingly cites two cases to argue that Amazon’s required posting does not 14 undermine Amazon’s confidentiality claim. (Dkt. No. 25 at p.18 (citing OSHA Data/CIH, Inc. v. 15 U.S. Dep’t of Labor, 220 F.3d 153, 163 n.25 (3d Cir. 2000) and New York Times Co. v. U.S. Dep’t 16 of Labor, 340 F. Supp. 2d 394, 402 (S.D.N.Y. 2004).) 17 In OSHA Data, the court stated in a footnote that “the posting of an annual injury and 18 illness summary at the work site itself is a limited disclosure to a limited audience, a disclosure 19 which is surely insufficient to render the data publicly available.” OSHA Data, 220 F.3d at 163 20 n.25. However, there are several important distinctions to note. The regulation in effect at that 21 time only required employers to post the total number of incidents of lost workday injuries and 22 illnesses for one month, as opposed to the three months now required. See 66 Fed. Reg. 5916-01. 23 Additionally, the regulations in effect at that time did not require companies to provide the forms 24 to all current, former, and representatives of employees upon request. Id. Moreover, the plaintiff 25

26 4 The parties dispute whether the Court should examine only Amazon’s conduct or whether the Court should also examine how other companies in the industry treat the Form 300A. 27 However, because the Court finds that Amazon does not customarily and actually treat the Form 1 in OSHA Data requested information which went beyond what employers were required to post at 2 that time.5 3 Even more significantly, the court in OSHA Data was not making a determination as to 4 whether the information was, in fact, confidential under Exemption 4. Instead, the court was 5 merely determining whether the DOL was required to provide notification of the FOIA request to 6 the companies which submitted their data to OSHA. OSHA Data, 220 F.3d at 162-63. The 7 regulations at that time required the DOL to provide notice of a FOIA request to a company 8 submitter whenever the DOL had “reason to believe that disclosure of the information could 9 reasonably be expected to cause substantial competitive harm[.]” Id. at 163 (quoting 29 C.F.R. § 10 70.26(d)(2)(ii)). However, notification was not required under FOIA if the information was 11 lawfully published or had been “officially made available to the public.” Id. (quoting 29 C.F.R. § 12 70.26(g)(2)). Thus, the issue before the court was not whether the information was confidential 13 under Exemption 4 but whether notification was required under FOIA or if the information had 14 been “officially made available to the public.” Id. at 163 n.25 (“we reject OSHA Data’s argument 15 that these limited disseminations of information render the . . . data ‘officially made available to 16 the public’ such that predisclosure notification would not be required”). 17 The import of this distinction is made clear by the court’s analysis New York Times. 18 Before the regulations enacted on January 19, 2001 became effective on January 1, 2002, 19 employers were only required to post the total number of incidents of lost workday injuries and 20 illnesses (annual summaries of the OSHA Form 200 Log) and not the number of hours that 21 employees worked. See 66 Fed. Reg. 5916-01 (establishing the OSHA Form 300, 300A and 301); 22 see also New York Times, 340 F. Supp. 2d at 396-97. In addition to changing the substance of the 23 annual summaries to include employees’ worked hours (compare OSHA Form 200 Log with 24 OSHA Form 300A), the regulations also changed the posting and disclosure requirements. As 25

26 5 The plaintiff was requesting data collected by OSHA to calculate Lost Work Day Injury and Illness (“LWDII”) rates, which included the number of employee hours worked. At the time 27 of OSHA Data, employers were required to post the total number of incidents of lost workday 1 noted above, pursuant to the regulations in effect before January 1, 2020, employers were only 2 required to post the annual summaries of the Form 200 Log for one month and were not required 3 to provide copies of the injury and illness data to current, former, and representatives of 4 employees, as is now required under 29 C.F.R. § 1904.35. See 66 Fed. Reg. 5916-01. 5 The court in New York Times explained that employers were required to provide OSHA 6 (but not post) the total number of hours worked by all employees and data from illness and injury 7 records. 340 F. Supp. 2d at 396. OSHA then used that information to calculate the LWDII rates. 8 Id. Based on data received for the year 2000, OSHA identified approximately 13,000 workplaces 9 with high LWDII rates. Id. OSHA posted on its website the names of these 13,000 workplaces, 10 but not the LWDII rates. In October 2002, pursuant to FOIA, a reporter for the New York Times 11 requested the LWDII rates for these workplaces. Id at 397. The DOL withheld that information 12 on the grounds that releasing the LWDII rates was tantamount to releasing confidential 13 commercial information – the number of hours that employees worked – under Exemption 4. The 14 DOL argued that the number of hours that employees worked could be ascertained or reverse 15 engineered using the LWDII rate and the total number of incidents of lost workday injuries and 16 illnesses posted under the regulations. Id. at 401. 17 The court held the one-month posting of total number of incidents of lost workday injuries 18 under the regulations then in effect was insufficient to render the data “publicly available.” Id. 19 The court noted that, because the total number of incidents of lost workday injuries were posted 20 for only a one-month period several years ago, is was “difficult to believe that the general public 21 could track down those summaries years later and use them to reverse engineer outdated LWDII 22 rates.” Id. at 402 n.10. Therefore, the court held that providing the newspaper the LWDII rates in 23 2002 which were calculated from calendar year 2000 data would not enable the New York Times 24 to reverse engineer and determine the number of employee hours worked in the year 2000. Id. at 25 401-402. 26 Notably, the court did not hold that the posting was not long enough or public enough to 27 undermine the confidentiality of the data under Exemption 4. In fact, the court appeared to find 1 employers’ posting to include employee hours in the Form 300A, the court observed that “OSHA 2 no longer regards employee hours as ‘confidential commercial information,’ and employers have 3 no expectation of a competitive advantage based on their ability to keep the hours confidential.” 4 Id. at 402; see also id. at 403 (distinguishing OSHA Data because “employee hours are no longer 5 confidential”). 6 ii. Requiring Disclosure to Current, Former, and Representatives of Employees. 7 The regulations further require Amazon to maintain the Form 300As for five years and to 8 provide them to any current or former employee, or any employee’s representative, which the 9 regulations define broadly to include anyone the employee designates as a representative. See 29 10 C.F.R. §§ 1904.33, 1904.35.6 Amazon states that when it provides employees, former employees, 11 or their representatives Form 300As upon request, Amazon marks the form as confidential and 12 includes the following message: 13 In response to your request for the OSHA 300 Logs [and/or] 300A 14 forms for the ____ facility located in [city] [state], I have enclosed the following: [year range] logs. OSHA and Amazon consider this 15 information confidential because, among other things, it has personally identifiable information and personal medical information 16 involving you or your co-workers. We do not share this information with third-parties. As a [current] [former] employee we respect your 17 right to access this confidential information pursuant to OSHA regulations and request that you maintain its confidentiality. Please 18 review and observe the following notice from OSHA that is in a box at the top of the form 300: Attention: This form contains information 19 relating to employee health and must be used in a manner that protects the confidentiality of employees to the extent possible while 20 information is being used for occupational safety and health purpose. 21 (Dkt. No. 27, ¶ 4.) However, in this message, Amazon groups together the Form 300 Logs with 22 the Form 300As. OSHA’s Form 300 Logs, as distinct from the Form 300A, provide a log of the 23 work-related injuries and illnesses and identify the employee’s name and job title, the date of the 24 event, and the location of the event on the premises. Additionally, on the Form 300 Logs, 25 employers describe the injury or illness, the parts of the body affected, and the object or substance 26 6 Employees, former employees, and their representatives are entitled to receive copies of 27 the current and the five years of stored data and are not limited to the data collected during their 1 which caused the injury or illness. Amazon states that it considers these forms (referring to both 2 the Form 300 Logs and the Form 300As) confidential because they contain personally identifiable 3 information and personal medical information of other employees. (Id.) Notably, this type of 4 information is only listed on the Form 300 Logs and not on the Form 300As. Thus, Amazon’s 5 stated rationale for marking these documents as confidential – employee privacy – is unrelated to 6 the data on the Form 300A. Therefore, it is not clear whether or how this message is designed to 7 maintain the purported confidentiality of the Form 300A.7 8 Additionally, it is not clear that the regulations permit Amazon’s directive to its current, 9 former, and representatives of its employees to keep the Form 300As confidential. As OSHA has 10 made clear, an “employer may not require an employee . . . to agree to limit the use of the records 11 as a condition of viewing or obtaining the records.” See 66 Fed. Reg. at 6058. OSHA explained 12 that: 13 Employees and their representatives might reasonably fear that they could be found personally liable for violations of such restrictions. 14 This would have a chilling effect on employees’ willingness to use the records for safety and health purposes, since few employees 15 would voluntarily risk such liability.” 16 Id. As recently recognized by another court in this district, “[t]here are no restrictions on further 17 dissemination of Form 300A information[.]” Ctr. for Investigative Reporting, 2020 WL 2995209, 18 at *4 (citing 81 Fed. Reg. at 29684). 19 Notably, when discussing OSHA’s 2016 Final Rule, OSHA referred to these disclosure 20 requirements (posting the Form 300As and providing them to employees and their representatives 21 upon request) under the regulations as making the forms available to the public: 22 7 Confusingly, MacDougall, Amazon’s Declarant, also states: “Although Form 300-A does 23 not itself contain personally identifiable sensitive medical information, the total injuries and illnesses that are listed by categories could be used to profile Amazon’s injury trends at individual 24 fulfillment centers, which would be a major component of the sensitive information contained in OSHA Form 300 and 301. Amazon therefore customarily treats all three forms as private due to 25 the sensitive and confidential nature of the source data.” (Dkt. No. 27, ¶ 27.) MacDougall acknowledges that the Form 300A does not contain any personally identifiable sensitive 26 information. To the extent she contends that the Form 300A somehow reveals sensitive information contained in the Form 300 or 301, she does not explain how. Nor does she explain 27 what she means by “source data.” It is not clear what MacDougall means by this statement or how injury and illness records kept under part 1904 are already available 1 to OSHA and the public in a variety of ways. The annual summary data must be posted where employees can see it. Employees or their 2 representatives can also obtain and make public most of the information from these records at any time, if they wish. 3 Improve Tracking of Workplace Injuries and Illnesses, 81 Fed. Reg. at 29684 (emphasis added). 4 The DOL argues that OSHA was concerned about possible “misuse” of the data on the 5 Form 300As and suggests that “misuse” would include providing the forms to the press. (Dkt. No. 6 25 at pp.18-19.) However, when OSHA stated that “[e]ncouraging parties with access to the 7 forms to keep the information confidential where possible is reasonable[,]” it was discussing the 8 potential misuse of the private medical and personal information about employees contained in the 9 Form 300 Log and the Form 301 injury and illness incident report. See 66 Fed. Reg. at 6058. In 10 line with this important distinction, OSHA added onto the Forms 300 and 301 “a statement . . . 11 indicating that these records contain information related to employee health and must be used in a 12 manner that protects the confidentiality of employees to the extent possible while the information 13 is used for occupational safety and health purposes.” Id. at 6058. Employees’ personal and 14 medical information does not appear on the Form 300As, and OSHA has not added a similar 15 statement onto the Form 300A. 16 iii. Impact of OSHA’s Regulations on Confidentiality. 17 The Court finds that Amazon’s broad disclosures required under the regulations to all 18 current employees, former employees, and employees’ representatives, with no restrictions on 19 their further disclosures, defeats the DOL’s effort to demonstrate confidentiality. The DOL’s 20 arguments to the contrary are not convincing. 21 The DOL characterizes the required disclosure to all current and former employees and 22 their representatives as disclosure to a “small subset of all employees” because such individuals 23 must affirmatively request the forms. (Dkt. No. 25 at p.18.) However, there is no evidence in the 24 record regarding how many Amazon employees, current or former, have requested the Form 25 300As pursuant to 29 C.F.R. § 1904.35. Moreover, the DOL does not and could not dispute that 26 Amazon is legally required to provide the Form 300As to any current or former employee, or their 27 representative, which is a large group of people. For example, if a document were posted on the 1 internet on an unrestricted website, indisputably it would be widely available, regardless if a small 2 number of people actually visited the website and viewed the document. Similarly, as discussed 3 below, the DOL points to a statement it made in a legal brief filed in a district court case in the 4 District of Columbia to support its argument that OSHA publicly retracted its statement on posting 5 the Form 300As online, regardless of whether Amazon was aware of litigation in that district or, 6 more importantly, the DOL’s filing. 7 Additionally, Amazon is required to post the Form 300As at its facilities for all employees 8 to see for three months. See New York Times, 340 F. Supp. 2d at 402, 403 (noting that posting 9 requirement rendered information about employees’ hours not confidential). Relying on language 10 from Center for Auto Safety v. National Highway Traffic Safety Administration, 93 F. Supp. 2d 1, 11 17-18 (D.D.C. 2000), the DOL appears to make the argument that disclosing documents to anyone 12 “affiliated” with Amazon does not undermine the information’s confidentiality because Amazon 13 does not customarily disclose its Form 300As to the “general public.” (Dkt. No. 27 at p.17.) 14 Amazon relies on the following statement in Center for Auto Safety: “[l]imited disclosures, such as 15 to suppliers or employees, do not preclude protection under Exemption 4, as long as those 16 disclosures are not made to the general public.” 93 F. Supp. 2d at 17-18. 17 The DOL construes the meaning of this statement and the holding of that case too broadly. 18 Although the court in Center for Auto Safety made this expansive statement, the court noted that 19 the information at issue was only disclosed only to employees or other entities as necessary and 20 was always accompanied by a confidentiality agreement or protective order. Id. at 18. 21 Nevertheless, to the extent Center for Auto Safety actually stands for the proposition that 22 information is confidential so long as it is only disclosed to anyone who ever works or worked for 23 a large company, or any representative of a current of former employee, the Court finds it 24 unpersuasive. In light of the requirement to construe FOIA exemptions narrowly, finding 25 documents confidential even if they are available to and broadly disclosed to all current and 26 former employees of a large company without any confidentiality or nondisclosure agreements is 27 untenable. In fact, even absent the requirement to narrowly construe exemptions, the Court cannot 1 people without any restrictions. See Food Marketing, 139 S. Ct. at 2363 (noting definitions of 2 confidential include “closely held” and “known only to a limited few”). 3 Next, the DOL points to language from American Small Business League v. United States 4 Department of Defense, 411 F. Supp. 3d 824 (N.D. Cal. 2019) to support its argument that 5 Amazon’s forms are confidential under the broad standard in Food Marketing. The court in 6 American Small Business stated that “[u]nder Food Marketing, it appears that defendants need 7 merely invoke the magic words – “customarily and actually kept confidential” – to prevail and 8 noted “how prolifically companies claim confidentiality.” Id. at 832-33. However, the court made 9 clear that a plaintiff could defeat these “magic words” by pointing to actual practices which 10 contradict those statements. Id. at 832 (“plaintiff can show that the information is in fact publicly 11 available or possibly point to other competitors who release the information”). Notably, in 12 addition to claiming confidentiality, the company in American Small Business demonstrated with 13 evidence the protective measures it took to ensure the documents remained confidential, “such as 14 (1) requiring employees and business partners to enter into confidentiality agreements; (2) using 15 restrictive markings on documents and communications; (3) using secure, password-protected IT 16 networks for the information at issue; and/or (4) limiting access to the information at issue on a 17 “need to know” basis” Id. at 831; see also Food Marketing, 139 S. Ct. at 2363 (highlighting that 18 “[e]ven within a company, witnesses testified, only small groups of employees usually have access 19 to it”). 20 In light of the applicable regulations, Amazon does not and could not similarly restrict 21 access to the Form 300As. And the limited attempts Amazon has made to shield its Form 300As 22 are ineffective and inconsistent. As discussed above, the message of confidentiality Amazon 23 includes when it sends out the form to current, former and representatives of employees does not 24 pertain to the data on the Form 300A – the message discusses the confidentiality of personally 25 identifiable and medical information which is not on the Form 300A. Amazon also states that it 26 stamps the Form 300A as confidential and restricts access to only employees with record keeping 27 responsibilities. (Dkt. No. 26, ¶ 6.) However, these measures do not actually protect the Form 1 required to send the form to all employees, former employees and employee representatives upon 2 request without any restrictions.8 3 Therefore, as another court in this district recently recognized, due to the regulations “the 4 Form 300A information is both readily observable by and shared with employees, who have the 5 right to make the information public.” Ctr. for Investigative Reporting, 2020 WL 2995209, at *4. 6 The Court finds that where, as here, a large company is required by law to post the forms for 7 current employees and to provide the forms upon request to all current and former employees, and 8 their representatives, with no restrictions on these individual’s further disclosure of the forms, the 9 information is not and cannot be considered confidential under the test set forth in Food 10 Marketing. See Ctr. for Investigative Reporting, 2020 WL 2995209, at *4 (finding OSHA’s Form 11 300As were not confidential because “submitting companies are required by law to make the Form 12 300A information available to current and former employees”). Accordingly, the DOL has not 13 met its burden to demonstrate that Amazon customarily and actually keeps the Form 300A 14 confidential. 15 2. Provided Under an Assurance of Privacy. 16 In addition to Amazon’s lack of customary and actual confidential treatment of the Form 17 300As, the DOL fails to demonstrate confidentiality for a separate and independent reason. As 18 noted above, the Supreme Court declined to address whether assurances that the government 19 would keep the information private was also required for confidentiality because in that case the 20 government did make such assurances. Food Marketing, 139 S. Ct. at 2363. However, while it is 21 uncertain whether an assurance of privacy is required, where, as here OSHA indicated the opposite 22 – that it would disclose the Form 300As – Amazon lost any claim of confidentiality it may have 23 24 8 Additionally, the Court notes that the evidence in the record undermines Amazon’s 25 assertion that it actually stamps the Form 300A as confidential. MacDougall, Amazon’s declarant, states that Amazon stamped a Form 300A as confidential when it produced the document to 26 OSHA and that this practice reflects Amazon’s general policies and practices regarding these forms. (Dkt. No. 38, ¶¶ 6-7.) However, Plaintiffs submitted twenty examples of other Form 27 300As that Amazon produced to governmental agencies between April 3, 2019 and August 19, 1 had.9 2 As the DOJ guidelines regarding Exemption 4 explain, information from submitters lose 3 their confidential character when notices on agency websites or communications with submitters 4 explicitly notify submitters of the agency’s intention to publicly disseminate the information. See 5 DOJ Exemption 4 Guidelines, available at https://www.justice.gov/oip/exemption-4-after- 6 supreme-courts-ruling-food-marketing-institute-v-argus-leader-media; see also Center for 7 Investigative Reporting, 2020 WL 2995209, at *5 (noting DOJ’s guidelines “provide that 8 information loses its character of confidentiality where there is express agency notification that 9 submitted information will be publicly disclosed.”) (emphasis in original). 10 The DOL concedes this point: “[W]hen there is reason to expect that the government 11 might disclose the information at issue, express or implied assurances by the government that the 12 information will remain private may be relevant in assessing whether the information retained its 13 confidential nature.” (Dkt. No. 27 at 21.) The DOL, however, argues that Amazon had no reason 14 to expect that OSHA would disclose its information on the Form 300As. (Id.) Based on the 15 evidence in the record, the Court disagrees. 16 The court in Center for Investigative Reporting recognized: “OSHA expressly stated in 17 rulemaking in 2016 that it would ‘post the data’ from the electronic submissions of Forms 300, 18 301, and 300A ‘on a publicly accessible Web Site.’” Ctr. for Investigative Reporting, 2020 WL 19 2995209, at *5. OSHA stated its intent to do so in 2013. See OSHA National News Release, 20 OSHA announces proposed new rule to improve tracking of workplace injuries and illnesses 21 (Nov. 7, 2013) available at https://www.osha.gov/news/newsreleases/national/11072013 (“OSHA 22 plans to eventually post the data online”). In the preamble to the 2016 Final Rule, OSHA stated 23 that it “intends to post the data from these submissions on a publicly accessible Web site[.]” See 24 81 Fed. Reg. at 29625. OSHA described the benefits from publishing the data from the Form 25

26 9 The DOL argues that the Court should not examine whether OSHA provided an assurance of privacy because Amazon was required to submit its Form 300As and did not do so 27 voluntarily. However, where, as here, the government makes an affirmative public statement 1 300As, including encouraging employers to abate hazards, enabling employers to benchmark their 2 safety and health performance, allowing employees to compare and choose safe workplaces, 3 enabling the public to make informed purchasing decisions, and improving research on and 4 developing innovative ideas to alleviate workplace injuries and illnesses. 81 Fed. Reg. at 29629- 5 631. 6 The DOL argues that OSHA subsequently reversed its position and, since 2017, has taken 7 the position that the Form 300As electronically submitted should be kept private. (Dkt. No. 37 at 8 p.17.) The DOL made the same argument in Center for Investigative Reporting. 2020 WL 9 2995209, at *5. That court rejected the DOL’s argument that any internal position change was 10 relevant. Instead, it found only the DOL’s public statements regarding disclosure were relevant to 11 counter the impact of OSHA’s public statements on posting the data. Id. This Court agrees. 12 In both Center for Investigative Reporting and here, the first public statement the DOL 13 points to is in a legal brief it filed in litigation in the District Court for the District of Columbia.10 14 (Dkt. No. 39-1 (Kapust Decl.), ¶ 24 (citing to the DOL’s summary judgment motion filed on June 15 1, 2018, in Public Citizen Foundation v. United States Dep’t of Labor, et al., Case No. 1:18-cv- 16 00117 (D.D.C.), Dkt. No. 14).)11 In its legal brief filed in D.C., the DOL referenced OSHA’s 17 statement during rulemaking that it intended to make the data from the Form 300As public but that 18 noted that “OSHA neglected to mention the timing of when the data would be made public.” 19

20 10 The court in Center for Investigative Reporting did not need to address the impact, if any, from the DOL’s argument in its summary judgment brief filed in the D.C. litigation because 21 that brief was filed six months after the first deadline for the Form 300As submissions at issue in that Center for Investigative Reporting. Id., 2020 WL 2995209, at *5. However here, Amazon 22 submitted some of its Form 300As before and some after June 1, 2018. Amazon first submitted most of the Form 300As at issue here as part of OSHA’s inspections and pursuant to the 23 regulations between March 14, 2018 and January 23, 2019. (Dkt No. 26, Ex. F; Dkt. No. 48.) Amazon first submitted the last two, one for calendar year 2018 and one for calendar year 2019, 24 between February 6 and March 2, 2019. (Id.) Accordingly, the Court will evaluate the impact of the DOL’s statements in its legal brief filed in D.C. on June 1, 2018. 25 11 In his declaration, Kapust also points to OSHA’s responses to other FOIA requests as public demonstrations of OSHA’s position. (Dkt. No. 39-1, ¶ 23.) When DOL originally filed 26 this declaration in Center for Investigative Reporting v. Dep’t of Labor, Case No. 18-cv-02414- DMR (N.D. Cal.), Dkt. No. 28, the DOL attached those response letters as Exhibit H. The DOL 27 did not file or cite to that Exhibit in this case, and so it is unclear whether the DOL is making the 1 Public Citizen Foundation v. United States Dep’t of Labor, et al., Case No. 1:18-cv-00117 2 (D.D.C.), Dkt. No. 14 at pp.16-17. The DOL then clarified that it was: 3 OSHA’s intent to release the data only when it finishes using the data to target employers for inspection – approximately four years after the 4 year to which the data relates. . . . Specifically, OSHA plans to use the CY 2016 data for targeting purposes in 2018 and 2019, and to 5 release the CY 2016 data in 2020, and plans to use the CY 2017 data for targeting purposes in 2019 and 2020, and to release the CY 2017 6 data in 2021. . . . 7 Id. at pp.19-20 (citations omitted). Contrary to the DOL’s characterization of this prior legal brief, 8 the DOL did not publicly retract OSHA’s statement that it would publicly post the data from the 9 Form 300As. It merely clarified the timing of when it would disclose the data. 10 After Amazon submitted all but two of the Form 300As at issue here, OSHA publicly 11 stated in the preamble to the 2019 Final Rule on January 25, 2019: 12 [I]n relation to concerns raised about possible publication of data submitted electronically to OSHA from Form 300A . . . the agency 13 takes the position that these data [sic] are exempt from public disclosure under FOIA. . . . OSHA is strongly opposed to disclosure 14 of 300A data, has not made such data public, and does not intend to make any such data public for at least the approximately four years 15 after its receipt that OSHA intends to use the data for enforcement purposes. 16 84 Fed. Reg. at 383. Again, although the preamble includes stronger language against posting the 17 data, OSHA still stated that it would publicly post the Form 300As in four years. 18 It was not until August 23, 2019, that OSHA publicly retracted its stated intent to publish 19 the Form 300As when it wrote on its website: “OSHA views the 300a form data as confidential 20 commercial information, and will not release it to the public.” (Dkt. No. 39-1, ¶ 25 (citing 21 https://www.osha.gov/recordkeeping/index.html).) However, OSHA did not make this statement 22 until after Amazon submitted all of the Form 300As at issue. (Dkt. No. 26, Ex. F; Dkt. No. 48.) 23 OSHA’s statements made after Amazon submitted its documents are not relevant. 24 OSHA’s public position at the time Amazon made its submissions is what matters and OSHA did 25 not definitively retract its statements regarding publishing the data until August 2019, after 26 Amazon had submitted all of its Form 300As at issue. Although OSHA clarified the timeline for 27 publication in June 2018 and again in January 2019, OSHA still stated that the Form 300As would 1 be publicly disclosed. 2 The DOL also could have asserted statements OSHA made directly to Amazon to counter 3 its public statements regarding posting but it has not done so. At most, the DOL points to 4 statements in OSHA’s Field Operations Manual, but those statements do not assist the DOL. 5 OSHA’s Field Operations Manual, as it was updated on September 13, 2019, provides that 6 “information obtained during inspections is confidential, but can be disclosable or non-disclosable 7 based on criteria established in [FOIA].” (Dkt. No. 26, ¶ 17 (citing to 8 https://www.osha.gov/sites/default/files/enforcement/directives/CPL_02-00-163.pdf).) 9 The Operations Manual to which the DOL cites was updated after Amazon submitted the 10 documents at issue. However, even if the Field Operations Manual in effect when Amazon 11 submitted the documents contained similar language, it would not alter the analysis. When 12 Amazon submitted its Form 300As, OSHA routinely released Form 300As pursuant to FOIA 13 requests. (Dkt. No. 25 at p.22 n.10; Dkt. No. 26, ¶ 29, Ex. F.; Dkt. No. 48.) Therefore, the Field 14 Operations manual cannot be read to provide an assurance of privacy in relation to Plaintiff’s 15 FOIA request for Amazon’s Form 300As or otherwise retract OSHA’s public statement regarding 16 disclosure. Because Amazon submitted its Form 300As to OSHA at a time when OSHA publicly 17 stated it would publicly post the data (and when OSHA released the data pursuant to FOIA 18 requests), the DOL cannot demonstrate confidentiality. See DOJ Exemption 4 Guidelines, 19 available at https://www.justice.gov/oip/exemption-4-after-supreme-courts-ruling-food-marketing- 20 institute-v-argus-leader-media (documents lose their confidential character when submitted on 21 notice of an agency’s intent to publicly disseminate the information). Accordingly, the Court 22 finds that the Form 300As do not contain confidential information under Exemption 4 and cannot 23 be withheld on that basis. 24 CONCLUSION 25 For the foregoing reasons, the Court DENIES the DOL’s motion for summary judgment 26 and GRANTS Plaintiff’s cross-motion for summary judgment. Within fourteen days of this 27 1 Order, the DOL shall provide Plaintiffs with Amazon’s Form 300As without redacting the data.'* 2 || The Court will issue a separate judgment. The Clerk is instructed to close the file. 3 IT IS SO ORDERED. 4 Dated: July 6, 2020 + 5 _ fitlhan lOw~w

SALLIE KIM

6 United States Magistrate Judge 7 8 9 10 11 12

13

15 16

= 17

Z 18

19 20 21 22 23 24 25 26 07 The DOL redacted the signatures and direct phone numbers of the signatories of the Form 300As based on privacy concerns under Exemption 7(C). Plaintiffs did not object to this 2g || redaction. The DOL may continue to redact the signatures and direct phone numbers when they provide the Form 300As.