Last month, the Department of Justice Office of Information Policy issued new guidance on the definition of confidential information under Exemption 4 of the Freedom of Information Act. This new guidance addresses the meaning of “confidential” in light of the Supreme Court’s decision in Food Mktg. Inst. v. Argus Leader Media, 139 S. Ct. 2356 (2019). While not determinative, this DOJ Guidance offers contractors critical insight into how agencies will respond in the first instance to FOIA requests for information that may be subject to Exemption 4. This exemption protects “trade secrets and commercial or financial information obtained from a person [that is] privileged or confidential.” 5 U.S.C. § 552(b)(4).
As covered in this space earlier this year, in Food Marketing Institute, the Supreme Court jettisoned 40 years of established FOIA case law on how agencies defined confidential under Exemption 4. It rejected the well-established “competitive harm” test from National Parks & Conservation Association v. Morton, 498 F.2d 765 (D.C. Cir. 1974) based on the lack of support in the statutory language. In its place, it adopted a “plain language” interpretation of confidential, finding two potential definitions: (1) information “customarily kept private, or at least closely held,” by the submitting party; and (2) information disclosed when the receiving party provides “some assurance that it will remain secret.” The Supreme Court held that the first condition was mandatory but expressly left open whether confidential information could lose that status if provided to the government “without assurances that the government will keep it private.” As a result, contractors and agencies alike were left without clear guidance as to whether, or when, a government “assurance” may be required.
DOJ Guidance on Exemption 4
The DOJ Guidance tries to fill this void and provide answers to the significant open questions for FOIA officers on the front lines of defining the boundaries of Exemption 4. First, it notes that “[i]n light of th[e] current legal uncertainty,” agencies should consider both prongs of the Food Marketing Institute test “as a matter of sound administrative practice.” Thus, it instructs agencies to consider both the submitter’s treatment of the information and assurances of confidentiality by the government.
- Treatment of Information: According to the DOJ Guidance, agencies can often determine whether submitters keep certain information private based on the agency’s own knowledge of the submitter’s practices or from the records themselves. It also suggests that agencies can reach out submitters for more information about its practices (which is generally the point of the submitter notification process).
- Assurances of Confidentiality: Significantly, the DOJ Guidance recognizes that such assurances “can be either explicit or implicit.” Agencies can find “explicit assurances” in direct communications with the agency, in general notices on the agency website, or in regulations or statutes. On the other hand, the explicit notices can have the opposite effect, informing the submitter that it will not keep the information confidential. Implied assurances can be inferred based on the “generic circumstances” considering the government’s treatment of similar information and its broader treatment of information related to the program or initiative to which the information relates.
In addition, the DOJ Guidance includes a step-by-step guide for FOIA officers navigating the post-Food Marketing Institute landscape, which we have converted into this flowchart:
But even the DOJ Guidance leaves key questions unanswered, such as what “countervailing factors” would be sufficient at Step 3 of the analysis to make Exemption 4 applicable. That said, it is likely that agencies will heavily rely on the DOJ Guidance when responding to FOIA requests that implicate Exemption 4, and the early indications are that (1) government assurances of confidentiality and (2) government indications of public disclosure will be frequently contested issues in offensive and reverse-FOIA disputes in the future.
Takeaways for Government Contractors
Contractors must start documenting their disclosure practices before receiving a submitter notification letter, so that they can quickly and effectively respond to an agency’s inquires and support any claims of confidentiality. This includes developing evidentiary support showing they keep the information at issue private and that they only provide the information to the government with some type of assurance of confidentiality.
Lay the Groundwork For Proving Confidentiality. Although the DOJ Guidance does not detail the specific information agencies want to see about the submitter’s practices, it is likely agencies will expect contractors to provide at least some of the following:
- Company policies prohibiting disclosure;
- Use of contracts requiring confidentiality or nondisclosure provisions;
- Document markings indicating information is confidential or exempt from FOIA;
- Documented history of opposing disclosure in discovery;
- Periodic employee training addressing the need for information privacy; and
- Declarations describing how records were subject to limited disclosure within the organization.
Lay The Groundwork for Proving “Assurance of Confidentiality.” To establish express assurances, contractors should save any direct communications with the government and print out any notices on the agency website that might assure confidentiality.
If there are no express assurances, contractors should document their expectation that the government will maintain the confidentiality of the information. Contractors should consider updating their standard protective legends on documents provided to the government with language confirming the contractor’s understanding that information is being provided under an assurance of confidentiality. These legends should go beyond merely stating that the information is exempt from disclosure under FOIA, but state that the government assured confidentiality under the Trade Secrets Act (18 U.S.C. § 1905), applicable contractual provisions (e.g., data rights clauses), protective orders, or otherwise.
Watch for Case law Developments. In the coming months, we expect the courts to hand down the first decisions meaningfully grappling with the contours of the FMI test.