Protecting Confidential Information Following FCC v. AT&T

In today's world of federal regulation, businesses constantly submit documents and information to the government. Whether it is financial information to the SEC, testing data to the FDA, pricing and inspection data to agencies contracting with businesses for goods and services, or the results of internal investigations to any one of a number of federal investigative agencies, businesses supply the government with information that can provide an intimate look into their inner workings.

Such information can be extremely valuable in product liability litigation, and indeed often can determine the outcome of a case. The more information a litigant has, the stronger its case will likely be. Consequently, plaintiffs are constantly looking for ways to obtain information both directly from corporate defendants and indirectly from other sources. Conversely, the better a business can control a plaintiff's access to information, the greater its opportunity to control and limit the scope of litigation. As such, companies must carefully consider what information they submit to the government and how they can limit what portion of that information is later released to the public. This has become increasingly difficult as the use by private litigants of the federal Freedom of Information Act has expanded and access to government documents has become increasingly easy. Further, a recent Supreme Court decision has reinforced the need for businesses to tread carefully in this potentially dangerous battleground.

The Freedom of Information Act

First enacted in 1966, the Freedom of Information Act (FOIA), 5 U.S.C. ' 552, generally gives any person or private entity the right to obtain federal agency records. This allows any person to request copies of agency records, typically through an agency's FOIA office. This process provides individuals with access not only to government-generated records, but also to myriad records and documents that companies submit to the government, either voluntarily or under compulsion. Getting access to such documents has become easier in recent years, as agencies put such information online and the current administration directs agencies to presume that documents should be disclosed in response to FOIA requests.

Despite the ease with which FOIA provides the general public with access to information, it is not without limits. For example, FOIA does not require the government to create new records for the requester. More importantly, FOIA's general presumption in favor of release is limited by nine disclosure exemptions. The government may decline to release records or portions of records, for example, that contain classified information (Exemption 1), personnel and medical files (Exemption 6), or information compiled for law enforcement that reasonably could constitute an unwarranted invasion of privacy (Exemption 7(C)).

Exemption 4 is the most important for businesses that submit information to the government. This exemption protects “trade secrets and commercial or financial information obtained from a person and [that is] privileged or confidential.” Exemption 4 is the one that companies use most commonly to limit public access to the documents they have submitted to the government.

The FOIA commits the application of these exemptions to the discretion of agency officials. However, companies that submit documents to the government can play a significant role in whether those records ultimately become public. Under FOIA regulations, government agencies must notify the original document submitter before releasing potentially proprietary information. Once notified, the submitter can then request that the agency withhold the document in its entirety or at least redact portions of the document prior to release. The agency then determines whether to grant the request of the submitter or release the information. If the agency decides to withhold the information, the original requester may then file a suit in federal district court to compel disclosure. Conversely, if the agency decides to disclose the information, the submitter of the documents may file a “reverse FOIA” lawsuit challenging the agency's disclosure decision.

Using FOIA in Product Liability Cases

Because of the large amounts of information that can be obtained and the ease with which FOIA makes this information available, product liability plaintiffs have increasingly turned to FOIA requests to supplement traditional discovery and obtain information to support their claims. Obtaining information through a FOIA request is a particularly attractive option because it offers low-cost access to documents without the restrictions or limitations imposed by courts during the discovery process. This in turn provides plaintiffs with several distinct advantages.

• Plaintiffs do not have to wait until the start of litigation to begin discovery. Instead, information is available through FOIA at any time, providing plaintiffs with an invaluable head start on potential litigation. This allows plaintiffs to better evaluate the strengths and weaknesses of their case before filing. Further, it provides plaintiffs with advance knowledge of the kinds of documents generated by a potential defendant, allowing a plaintiff to hone discovery requests better and prepare for depositions before litigation begins.
• FOIA requests allow plaintiffs to avoid the relevancy requirements of discovery. While discovery rules are broader than the requirement of relevance for an evidentiary admission, they still require that the information sought be “reasonably calculated to lead to admissible evidence.” Fed. R. Civ. P. 26(b). As a result, courts frequently will limit information requests during discovery. However, a requester does not have to provide any justification for a FOIA request, meaning a plaintiff can request documents that may seem entirely unrelated to its case and will be entitled to receive those documents from the government, unless they fall within a FOIA exemption.
• Closely related to the previous point, courts have held that the processing of FOIA requests is a process that is outside of litigation, and thus cannot be limited simply because the information sought is related to ongoing litigation. American Bank v. City of Menasha, 627 F.3d 261 (7th Cir. 2010). Thus, even if a court determines that information is not subject to formal discovery in a particular case, the court has no power to stop a plaintiff from attempting to obtain the information through a FOIA request.
• Information made available by the government in response to a FOIA request necessarily will become part of the public domain. By contrast, courts can issue a protective order to ensure that information obtained during discovery relating to a trade secret or other confidential information is not disclosed to the public. Fed. R. Civ. P. 26(c)(1)(g). This means that even if a court forces a defendant to disclose information to its opponent, the defendant can still protect the information from public disclosure. However, FOIA has no protective order mechanism. Once information is disclosed to a requester, that requester may freely disseminate the information as it sees fit. Moreover, any other requesters are entitled to the information as well.

Ultimately, these advantages demonstrate just how useful FOIA can be to a plaintiff in a product liability case. Further, they make clear how important it is for companies to take steps to protect the information they submit to the government and ensure that sensitive information is not generally released to the public or used against them in later litigation.

FCC v. AT&T

As plaintiffs increasingly use FOIA to gain access to information, and corporate submitters have learned how important it is to protect the information they provide to the government, businesses have tried to find various ways to apply the FOIA exemptions to the information they submit. However, a unanimous Supreme Court recently made it clear in Federal Communications Commission v. AT&T Inc., No. 09-1279 (U.S. Mar. 1, 2011), that Exemption 4 is the only viable path a corporate submitter can take when seeking to protect from public release information it previously submitted to the government.

In FCC v. AT&T, the latter sought to use Exemption 7(C), which protects law enforcement records that could constitute an unwarranted invasion of personal privacy, to preclude a competitor from receiving information about an FCC investigation of AT&T. The company argued that not only did the information in question fall within Exemption 7(C) as information compiled by law enforcement, but also that AT&T had “personal” privacy rights as a corporation that were entitled to protection. The Third Circuit agreed with AT&T and extended Exemption 7(C) to corporations. FCC v. AT&T, 582 F.3d 490 (3rd Cir. 2009). However, the Supreme Court rejected this argument, holding that “personal privacy,” as used in the FOIA, was limited to actual persons and did not extend to corporations. As a result, while the names of individual staff members mentioned in the investigation documents had to be redacted under 7(C), the documents in general had to be disclosed.

Through FCC v. AT&T, the Supreme Court now has made clear that businesses may not use Exemption 7(C) in order to protect information that they have provided to the Government. Admittedly, this had been a novel argument by AT&T, and the Court's decision does not drastically alter the way in which companies previously have protected, and will continue to protect, information from disclosure under FOIA. Yet, the decision reaffirms that any information a corporate submitter wishes to keep confidential must fall within FOIA's Exemption 4 if it is to be protected from subsequent public disclosure.

The Limitations of Exemption 4

While Exemption 4 has been used extensively to protect company data submitted to the government, not all information that companies submit to the government is protected. Exemption 4 applies only to matters that are “trade secrets and commercial or financial information obtained from a person and [that are] privileged and confidential.” Demonstrating to an agency or court that information fits within this exemption can be quite difficult at times and requires close familiarity with FOIA law.

When applying Exemption 4, courts and agencies have generally taken a very narrow interpretation of “trade secret.” This interpretation limits “trade secrets” to information used for the making, preparing, compounding or processing of trade commodities that are the end product of either innovation or substantial effort. Pub. Citizen Health Research Group v. FDA, 704 F.2d 1280 (D.C. Cir. 1983). As such, this portion of the exemption applies only “to information relating to the 'productive process' itself.” Ctr. for Auto Safety v. Nat'l Highway Traffic Safety Admin., 244 F.3d 144, 150-51 (D.C. Cir. 2001). General information regarding business practices, revenues, and even pricing will not necessarily fall within this element of the exemption.

As a result of this narrow interpretation, it is often difficult for companies to demonstrate that information is a “trade secret.” Instead, they must show that the information they want to protect is confidential commercial or financial information. In order to meet this burden, they must generally prove that the disclosure of the information would cause the company competitive harm. See Nat'l Parks & Conservation Ass'n v. Morton, 498 F.2d 765 (D.C. Cir. 1974).

Courts and agencies closely construe what constitutes competitive harm. Vague and conclusory claims that information would constitute a competitive harm are not enough. See Gov. Accountability Project v. United States Dep't of Health and Human Services, 691 F. Supp. 2d 170, 175-176. (D.D.C. 2010). For instance, courts have found that pricing data and clinical study results are not categorically protected without a showing of how the release of such data could cause harm. Id., Raher v. BOP, 749 F.Supp.2d 1148 (D. Or. 2010). Submitters must show that actual competition exists in their industry and that that there is a likelihood of a substantial competitive injury. CNA Fin. Corp. v. Donovan, 830 F.2d 1132, 1152 (D.C. Cir.1987).

Moreover, particularly when submission of the information is mandatory, the mere fact that the information may be unfavorable or embarrassing is not enough to constitute a competitive harm. See United Technologies Corp. v. DOD, 601 F.3d 557 (D.D.C. 2010). Thus, information that could realistically cause substantial harm to a submitter will not be protected unless the information would provide the submitter's competition with some type of confidential insight into the workings of the company.

How to Protect Information Going Forward

Preventing information submitted to the government from becoming public can be difficult and requires forethought by the submitter. Among the most important things that a corporate submitter can do to protect information is take steps from the outset to monitor, label and track the information it provides to the government. Accordingly, businesses should take the following steps going forward:

• Know what information is being provided to the government. While admittedly difficult given the amount of information that companies often must provide to the government, the most helpful thing a business can do is keep records of the information it submits. Not only does this allow the corporate submitter to know what information could potentially become public, but it also ensures that the submitter will be much better prepared to defend against an FOIA request when the request involves potentially confidential information.
• Label documents as confidential and create proprietary legends. A key element of protecting information submitted to the government is appropriately labeling information as proprietary and confidential. This can consist of either labeling an entire document as confidential or by creating a proprietary legend that will inform the government of specific information within a document that is confidential and should be redacted. While such labeling will not necessarily bind the government, it puts the government on notice that the submitter believes the information is confidential and creates an impression of confidentiality that will likely result in the agency providing the submitter with notice before it releases the information.
• Track what information is being requested so that competitors and plaintiffs do not gain an advantage. In addition to monitoring what information goes out to the government, companies are well advised to monitor the information that is requested about them. As noted above, agencies not only keep logs of FOIA requests, but are also required to provide notice to companies when potentially proprietary data has been requested. Submitters that take these notices seriously can better ensure that confidential information stays confidential.
• Keep internal information closely held. Besides monitoring and tracking what information has been provide to the government, businesses also should monitor what information is distributed within the company, as well as to third parties such as subcontractors and partners. The more closely information is guarded by a company, the greater the likelihood that an agency or court will find that this information is confidential and that its disclosure could cause competitive harm. Conversely, the more people that have access to information, the more likely that this information has been made public, either intentionally or mistakenly, and the less likely that the government will deem it to be confidential.
• Ensure there is a strong record at the agency level. Once a company's documents are requested, one of the most important steps it can take to protect the information it submitted is to create a strong legal and factual record before the agency. Submitters should provide the agency with detailed evidentiary support that the submitted information is confidential and that its release will cause competitive harm. This type of documented support both increases the chances that the agency will rule in the submitter's favor and ensures that a strong evidentiary record exists, if a court later reviews an agency's decision to release or withhold information.

Conclusion

In FCC v. AT&T, the Supreme Court did not drastically alter the landscape of FOIA and disclosure. The Court made clear, however, that businesses that wish to protect information submitted to the government had better be ready to demonstrate that the information falls under FOIA Exemption 4. Therefore, businesses should take proactive steps to ensure that they are prepared to make such demonstration when the need arises.

Kurt Hamrock, a member of this newsletter's Board of Editors, is a litigation partner in the Washington, DC, office of McKenna Long & Aldridge LLP. He can be contacted at [email protected]. Patrick Stanton, a 2011 summer associate at the firm, assisted with the article.

In today's world of federal regulation, businesses constantly submit documents and information to the government. Whether it is financial information to the SEC, testing data to the FDA, pricing and inspection data to agencies contracting with businesses for goods and services, or the results of internal investigations to any one of a number of federal investigative agencies, businesses supply the government with information that can provide an intimate look into their inner workings.

Such information can be extremely valuable in product liability litigation, and indeed often can determine the outcome of a case. The more information a litigant has, the stronger its case will likely be. Consequently, plaintiffs are constantly looking for ways to obtain information both directly from corporate defendants and indirectly from other sources. Conversely, the better a business can control a plaintiff's access to information, the greater its opportunity to control and limit the scope of litigation. As such, companies must carefully consider what information they submit to the government and how they can limit what portion of that information is later released to the public. This has become increasingly difficult as the use by private litigants of the federal Freedom of Information Act has expanded and access to government documents has become increasingly easy. Further, a recent Supreme Court decision has reinforced the need for businesses to tread carefully in this potentially dangerous battleground.

The Freedom of Information Act

First enacted in 1966, the Freedom of Information Act (FOIA), 5 U.S.C. ' 552, generally gives any person or private entity the right to obtain federal agency records. This allows any person to request copies of agency records, typically through an agency's FOIA office. This process provides individuals with access not only to government-generated records, but also to myriad records and documents that companies submit to the government, either voluntarily or under compulsion. Getting access to such documents has become easier in recent years, as agencies put such information online and the current administration directs agencies to presume that documents should be disclosed in response to FOIA requests.

Despite the ease with which FOIA provides the general public with access to information, it is not without limits. For example, FOIA does not require the government to create new records for the requester. More importantly, FOIA's general presumption in favor of release is limited by nine disclosure exemptions. The government may decline to release records or portions of records, for example, that contain classified information (Exemption 1), personnel and medical files (Exemption 6), or information compiled for law enforcement that reasonably could constitute an unwarranted invasion of privacy (Exemption 7(C)).

Exemption 4 is the most important for businesses that submit information to the government. This exemption protects “trade secrets and commercial or financial information obtained from a person and [that is] privileged or confidential.” Exemption 4 is the one that companies use most commonly to limit public access to the documents they have submitted to the government.

The FOIA commits the application of these exemptions to the discretion of agency officials. However, companies that submit documents to the government can play a significant role in whether those records ultimately become public. Under FOIA regulations, government agencies must notify the original document submitter before releasing potentially proprietary information. Once notified, the submitter can then request that the agency withhold the document in its entirety or at least redact portions of the document prior to release. The agency then determines whether to grant the request of the submitter or release the information. If the agency decides to withhold the information, the original requester may then file a suit in federal district court to compel disclosure. Conversely, if the agency decides to disclose the information, the submitter of the documents may file a “reverse FOIA” lawsuit challenging the agency's disclosure decision.

Using FOIA in Product Liability Cases

Because of the large amounts of information that can be obtained and the ease with which FOIA makes this information available, product liability plaintiffs have increasingly turned to FOIA requests to supplement traditional discovery and obtain information to support their claims. Obtaining information through a FOIA request is a particularly attractive option because it offers low-cost access to documents without the restrictions or limitations imposed by courts during the discovery process. This in turn provides plaintiffs with several distinct advantages.

• Plaintiffs do not have to wait until the start of litigation to begin discovery. Instead, information is available through FOIA at any time, providing plaintiffs with an invaluable head start on potential litigation. This allows plaintiffs to better evaluate the strengths and weaknesses of their case before filing. Further, it provides plaintiffs with advance knowledge of the kinds of documents generated by a potential defendant, allowing a plaintiff to hone discovery requests better and prepare for depositions before litigation begins.
• FOIA requests allow plaintiffs to avoid the relevancy requirements of discovery. While discovery rules are broader than the requirement of relevance for an evidentiary admission, they still require that the information sought be “reasonably calculated to lead to admissible evidence.” Fed. R. Civ. P. 26(b). As a result, courts frequently will limit information requests during discovery. However, a requester does not have to provide any justification for a FOIA request, meaning a plaintiff can request documents that may seem entirely unrelated to its case and will be entitled to receive those documents from the government, unless they fall within a FOIA exemption.
• Closely related to the previous point, courts have held that the processing of FOIA requests is a process that is outside of litigation, and thus cannot be limited simply because the information sought is related to ongoing litigation. American Bank v. City of Menasha , 627 F.3d 261 (7th Cir. 2010). Thus, even if a court determines that information is not subject to formal discovery in a particular case, the court has no power to stop a plaintiff from attempting to obtain the information through a FOIA request.
• Information made available by the government in response to a FOIA request necessarily will become part of the public domain. By contrast, courts can issue a protective order to ensure that information obtained during discovery relating to a trade secret or other confidential information is not disclosed to the public. Fed. R. Civ. P. 26(c)(1)(g). This means that even if a court forces a defendant to disclose information to its opponent, the defendant can still protect the information from public disclosure. However, FOIA has no protective order mechanism. Once information is disclosed to a requester, that requester may freely disseminate the information as it sees fit. Moreover, any other requesters are entitled to the information as well.

Ultimately, these advantages demonstrate just how useful FOIA can be to a plaintiff in a product liability case. Further, they make clear how important it is for companies to take steps to protect the information they submit to the government and ensure that sensitive information is not generally released to the public or used against them in later litigation.

FCC v. AT&T

As plaintiffs increasingly use FOIA to gain access to information, and corporate submitters have learned how important it is to protect the information they provide to the government, businesses have tried to find various ways to apply the FOIA exemptions to the information they submit. However, a unanimous Supreme Court recently made it clear in Federal Communications Commission v. AT&T Inc., No. 09-1279 (U.S. Mar. 1, 2011), that Exemption 4 is the only viable path a corporate submitter can take when seeking to protect from public release information it previously submitted to the government.

In FCC v. AT&T, the latter sought to use Exemption 7(C), which protects law enforcement records that could constitute an unwarranted invasion of personal privacy, to preclude a competitor from receiving information about an FCC investigation of AT&T. The company argued that not only did the information in question fall within Exemption 7(C) as information compiled by law enforcement, but also that AT&T had “personal” privacy rights as a corporation that were entitled to protection. The Third Circuit agreed with AT&T and extended Exemption 7(C) to corporations. FCC v. AT&T, 582 F.3d 490 (3rd Cir. 2009). However, the Supreme Court rejected this argument, holding that “personal privacy,” as used in the FOIA, was limited to actual persons and did not extend to corporations. As a result, while the names of individual staff members mentioned in the investigation documents had to be redacted under 7(C), the documents in general had to be disclosed.

Through FCC v. AT&T, the Supreme Court now has made clear that businesses may not use Exemption 7(C) in order to protect information that they have provided to the Government. Admittedly, this had been a novel argument by AT&T, and the Court's decision does not drastically alter the way in which companies previously have protected, and will continue to protect, information from disclosure under FOIA. Yet, the decision reaffirms that any information a corporate submitter wishes to keep confidential must fall within FOIA's Exemption 4 if it is to be protected from subsequent public disclosure.

The Limitations of Exemption 4

While Exemption 4 has been used extensively to protect company data submitted to the government, not all information that companies submit to the government is protected. Exemption 4 applies only to matters that are “trade secrets and commercial or financial information obtained from a person and [that are] privileged and confidential.” Demonstrating to an agency or court that information fits within this exemption can be quite difficult at times and requires close familiarity with FOIA law.

When applying Exemption 4, courts and agencies have generally taken a very narrow interpretation of “trade secret.” This interpretation limits “trade secrets” to information used for the making, preparing, compounding or processing of trade commodities that are the end product of either innovation or substantial effort. Pub. Citizen Health Research Group v. FDA , 704 F.2d 1280 (D.C. Cir. 1983). As such, this portion of the exemption applies only “to information relating to the 'productive process' itself.” Ctr. for Auto Safety v. Nat ' l Highway Traffic Safety Admin. , 244 F.3d 144, 150-51 (D.C. Cir. 2001). General information regarding business practices, revenues, and even pricing will not necessarily fall within this element of the exemption.

As a result of this narrow interpretation, it is often difficult for companies to demonstrate that information is a “trade secret.” Instead, they must show that the information they want to protect is confidential commercial or financial information. In order to meet this burden, they must generally prove that the disclosure of the information would cause the company competitive harm. See Nat'l Parks & Conservation Ass'n v. Morton , 498 F.2d 765 (D.C. Cir. 1974).

Courts and agencies closely construe what constitutes competitive harm. Vague and conclusory claims that information would constitute a competitive harm are not enough. See Gov. Accountability Project v. United States Dep't of Health and Human Services , 691 F. Supp. 2d 170, 175-176. (D.D.C. 2010). For instance, courts have found that pricing data and clinical study results are not categorically protected without a showing of how the release of such data could cause harm. Id ., Raher v. BOP , 749 F.Supp.2d 1148 (D. Or. 2010). Submitters must show that actual competition exists in their industry and that that there is a likelihood of a substantial competitive injury. CNA Fin. Corp. v. Donovan , 830 F.2d 1132, 1152 (D.C. Cir.1987).

Moreover, particularly when submission of the information is mandatory, the mere fact that the information may be unfavorable or embarrassing is not enough to constitute a competitive harm. See United Technologies Corp. v. DOD , 601 F.3d 557 (D.D.C. 2010). Thus, information that could realistically cause substantial harm to a submitter will not be protected unless the information would provide the submitter's competition with some type of confidential insight into the workings of the company.

How to Protect Information Going Forward

Preventing information submitted to the government from becoming public can be difficult and requires forethought by the submitter. Among the most important things that a corporate submitter can do to protect information is take steps from the outset to monitor, label and track the information it provides to the government. Accordingly, businesses should take the following steps going forward:

• Know what information is being provided to the government. While admittedly difficult given the amount of information that companies often must provide to the government, the most helpful thing a business can do is keep records of the information it submits. Not only does this allow the corporate submitter to know what information could potentially become public, but it also ensures that the submitter will be much better prepared to defend against an FOIA request when the request involves potentially confidential information.
• Label documents as confidential and create proprietary legends. A key element of protecting information submitted to the government is appropriately labeling information as proprietary and confidential. This can consist of either labeling an entire document as confidential or by creating a proprietary legend that will inform the government of specific information within a document that is confidential and should be redacted. While such labeling will not necessarily bind the government, it puts the government on notice that the submitter believes the information is confidential and creates an impression of confidentiality that will likely result in the agency providing the submitter with notice before it releases the information.
• Track what information is being requested so that competitors and plaintiffs do not gain an advantage. In addition to monitoring what information goes out to the government, companies are well advised to monitor the information that is requested about them. As noted above, agencies not only keep logs of FOIA requests, but are also required to provide notice to companies when potentially proprietary data has been requested. Submitters that take these notices seriously can better ensure that confidential information stays confidential.
• Keep internal information closely held. Besides monitoring and tracking what information has been provide to the government, businesses also should monitor what information is distributed within the company, as well as to third parties such as subcontractors and partners. The more closely information is guarded by a company, the greater the likelihood that an agency or court will find that this information is confidential and that its disclosure could cause competitive harm. Conversely, the more people that have access to information, the more likely that this information has been made public, either intentionally or mistakenly, and the less likely that the government will deem it to be confidential.
• Ensure there is a strong record at the agency level. Once a company's documents are requested, one of the most important steps it can take to protect the information it submitted is to create a strong legal and factual record before the agency. Submitters should provide the agency with detailed evidentiary support that the submitted information is confidential and that its release will cause competitive harm. This type of documented support both increases the chances that the agency will rule in the submitter's favor and ensures that a strong evidentiary record exists, if a court later reviews an agency's decision to release or withhold information.

Conclusion

In FCC v. AT&T, the Supreme Court did not drastically alter the landscape of FOIA and disclosure. The Court made clear, however, that businesses that wish to protect information submitted to the government had better be ready to demonstrate that the information falls under FOIA Exemption 4. Therefore, businesses should take proactive steps to ensure that they are prepared to make such demonstration when the need arises.

Kurt Hamrock, a member of this newsletter's Board of Editors, is a litigation partner in the Washington, DC, office of McKenna Long & Aldridge LLP. He can be contacted at [email protected]. Patrick Stanton, a 2011 summer associate at the firm, assisted with the article.