Ayuda, Inc. v. Federal Trade Commission

UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLUMBIA

AYUDA, INC., et al., :
:
Plaintiffs, : Civil Action No.: 13-1266 (RC)
:
v. : Re Document No.: 16, 20
:
FEDERAL TRADE COMMISSION, :
:
Defendant. :

MEMORANDUM OPINION

GRANTING IN PART AND DENYING IN PART DEFENDANT’S MOTION FOR SUMMARY
JUDGMENT; AND DENYING PLAINTIFFS’ MOTION FOR PARTIAL SUMMARY JUDGMENT

I. INTRODUCTION

Ayuda, Inc., Catholic Charities of the Archdiocese of Washington, D.C., Catholic Legal

Immigration Network, Inc., and Legal Aid Justice Center (collectively, “Plaintiffs”) bring this

action under the Freedom of Information Act (“FOIA”), 5 U.S.C. § 552 et seq., against the

Federal Trade Commission (“FTC”) seeking information from the FTC’s Consumer Sentinel

database, which is an online repository containing millions of consumer complaints about

alleged illegal business activity. The FTC moves for summary judgment on all four of Plaintiffs’

FOIA causes of action, as well as for dismissal based on failure to exhaust administrative

remedies as to Plaintiffs’ request for information contained in the “Company Address, Zip Code

Extension” data field. Plaintiffs cross-move for partial summary judgment on the FOIA claims

in Counts I, II, and III as to the release of Consumer Sentinel database complaints that were

received by the FTC through its telephone complaint line. Upon consideration of the parties’

motions, the memoranda in support thereof and opposition thereto, and the evidentiary record
submitted by both parties to supplement their summary judgment filings, the Court will grant in

part and deny in part the FTC’s motion, and deny Plaintiffs’ motion.

II. BACKGROUND

A. The FTC and the Consumer Sentinel Database

The FTC is the federal agency with principal responsibility for protecting consumers

from deceptive and unfair trade practices. See Stearns II Decl. ¶ 3. The agency’s responsibilities

include enforcing the FTC Act, the federal antitrust laws, and dozens of other federal statutes.

See id. This litigation arose following three FOIA requests from Plaintiffs, a collection of non-

profit entities, 1 to the FTC seeking the release of information contained in the agency’s

Consumer Sentinel database, which is a secure online repository containing roughly twenty

million consumer complaints about alleged illegal business activity. See id. ¶ 4. The Consumer

Sentinel database is maintained by a contractor, Lockheed Martin, see Rushen Decl. ¶ 2, and it is

composed of three separate databases: (1) identity theft complaints; (2) complaints regarding the

Do Not Call Registry; and (3) complaints regarding fraud and other consumer issues. See

Stearns Decl. ¶ 4. There are two types of data fields within the Consumer Sentinel database:

“free-form” fields, in which there is no limit on the type of information that can be entered; and

“non-free-form” fields, in which the type of information is limited by pre-set options. See id. ¶

11.

1
Ayuda, Inc. is a non-profit agency that advocates for low-income immigrants
through direct legal, social, and language services. See Am. Compl. ¶ 2. Catholic Charities of
the Archdiocese of Washington, D.C. is a non-profit entity that provides social and legal
services, including legal services for low-income and vulnerable immigrants within D.C. and
Maryland. See id. ¶ 3. Catholic Legal Immigration Network, Inc. is a non-profit agency that
provides administrative support and services to a network of non-profit entities that provide legal
services to low-income and vulnerable immigrants throughout the country. See id. ¶ 4. Legal
Aid Justice Center is a non-profit entity that provides legal representation for low-income
individuals in Virginia. See id. ¶ 5.

2
 Complaints enter the Consumer Sentinel database in several different ways. Of note for

purposes of this case, complaints are either submitted directly by consumers through the FTC’s

website, entered by an FTC operator in response to calls from consumers on the FTC’s telephone

complaint line, or transferred from independent online services provided by other governmental

and private entities, including the Canadian Anti-Fraud Centre and the Econsumer.gov website.

See id. ¶¶ 4, 18-19; James II Decl. ¶¶ 2-3. In 2013, approximately 60% of complaints filed

directly with the FTC were submitted by consumers contacting the FTC’s telephone complaint

line and speaking with an operator, who then transcribes the information into the database. See

James II Decl. ¶¶ 2-4. The remaining 40% of complaints submitted directly to the FTC were

entered by consumers through a link on the agency’s website. See id. ¶ 3

B. FOIA Request No. 2013-00680

On March 27, 2013, the FTC received a FOIA request, Request No. 2013-00680, from an

attorney representing Plaintiffs. See Stearns Decl. ¶ 5 & Ex. A. This request sought “a copy of

all complaints that are recorded in the Consumer Sentinel database,” with “only the information”

contained in seventeen specified free-form and non-free-form data fields:

Table 1
Fields Sought in Request No. 2013-00680
• Reference Number • Company Address, Line 1
• Created Date • Company Address, Line 2
• Complaint Source • Company Address, City
• Complaint Date • Company Address, State Code
• Consumer Address, City • Company Address, Country Code
• Consumer Address, State Name • Company Address, ZIP Code
• Consumer Address, Country Name • Complaint Info Product Service Description
• Company Name • Complaint Info Law Violation Description
• Complaint Info Statute Description
Source: Stearns Decl. ¶ 5 & Ex. A

The FTC’s FOIA Unit originally granted the request on May 2, 2013, see Admin. Record, Am.

Compl., ECF No. 11, Ex. E (“AR”) at 12, but two weeks later the agency reversed its position

3
and denied the request. See id. at 14. The agency explained that it denied the request because

(1) the data might reveal patterns of FTC procedures that would divulge the agency’s

deliberative process; (2) the data would reveal “FTC codes” used in the Consumer Sentinel

database; and (3) certain FOIA exemptions may apply to the information in the complaints. See

id.

Regarding the third point, the FTC explained that it had determined that a number of the

requested free-form data fields contain, or might contain, information that could, standing alone

or in combination with other information, identify the consumer who submitted the complaint or

another individual mentioned in the complaint, such as the alleged wrongdoer. See Stearns Decl.

¶¶ 11-12. The FTC therefore concluded that these data fields must be reviewed manually to

avoid disclosure of personal identifying information, and the agency estimated that this review

would take more than 8,000 hours to complete given the size of the Consumer Sentinel database.

See id. ¶¶ 11, 22. Separately, the FTC’s contractor estimated that it would cost $3,982.40 to

export data for the requested fields that the agency had not rejected. See id. ¶ 9 & Ex. C; Rushen

Decl. ¶ 6. On June 10, 2013, the FTC denied Request No. 2013-00680 when counsel for

Plaintiffs did not pre-pay the estimated processing cost. See Stearns Decl. ¶ 25 & Ex. F.

C. FOIA Request No. 2013-00949

On May 24, 2013, the FTC received a second request, Request No. 2013-00949, from

another attorney representing Plaintiffs. See id. ¶ 26 & Ex. G. In addition to the seventeen data

fields in the first request, the second request sought sixteen more fields across the three

Consumer Sentinel subdatabases:

4
 Table 2
Additional Fields Sought in Request No. 2013-00949
• Complaint Comments • Other Information Requested Entity to
• Phone in Registry? Stop Calling
• Company State • Other Information Comments
• Company Phone, Area Code • Entered Date
• Company Phone, Number • Theft Activity First Occurred Date
• Other Information Product Service • Theft Incident Theft Type Description
Description • Theft Incident SubType Description
• Other Information Existing Business • Associated Institution Institution Name
Relationship • Suspect Alias, Company Name
• Other Information Pre-Recorded Message
Source: Stearns Dec. ¶ 26 & Ex. G

The FOIA Unit determined that processing Request No. 2013-00949 would entail an “even

greater burden” than the first request because it sought “comment” fields in addition to the free-

form data fields included in the original request. See id. ¶ 28. Accordingly, the FTC denied the

request after informing Plaintiffs’ counsel that complying would be overly burdensome. See id.

¶¶ 29-31 & Exs. H, I.

D. First Appeal: Request Nos. 2013-00680 and 2013-00949

On July 10, 2013, counsel for Plaintiffs appealed the denial of Request Nos. 2013-00680

and 2013-00949. See Am. Compl., Ex. A. A month later, FTC Acting General Counsel David

Shonka granted in part and denied in part the appeal. See Stearns Decl. ¶ 34 & Ex. J.

Specifically, Mr. Shonka granted Plaintiffs’ request for the data fields “that do not elicit free-

form responses, excluding any zip code fields,” but he denied the request as to the remaining

free-form fields because they actually or potentially contain information exempt from disclosure

under FOIA Exemption 6, and a review to segregate the exempt material would place an

inordinate burden on the agency’s resources. See id.

Mr. Shonka remanded the case to the FOIA Unit to identify and process the requests for

the data fields for which the appeal was granted. See id. ¶ 35 & Ex. J. On remand, the FOIA

Unit reviewed the requests and identified for processing the data fields that did not elicit free-

5
form responses. See id. ¶¶ 36-38. The FOIA Unit, however, determined that the following free-

form data and zip code fields should not be produced under Mr. Shonka’s decision:

Table 3
Fraud and Other Consumer
Do Not Call Database Identity Theft Database
Database
• Consumer Address, City • Consumer Address, City • Consumer Address, City
• Company Name • Company Name • Associated Institution
• Company Address, Line 1 • Company Phone, Area Code Institution Name
• Company Address, Line 2 • Company Phone, Number • Suspect Alias, Company
• Company Address, City • Other Information Comments Name
• Company Address, Zip Code
• Complaint Comments
Source: Stearns Decl. ¶ 38

The FTC then sent the fields that could be produced to the contractor for a cost estimate, and the

contractor quoted a fee of $8,581.95 “to develop the custom scripts, extract from reporting

[database], format, validate and complete this FOIA” request. 2 See id. ¶ 39 & Ex. K; Rushen

Decl. ¶ 10. Lockheed Martin arrived at this estimate by predicting sixty-five hours of labor at

$132.03 per hour, which is the “Information Systems Analyst III” labor category rate established

under the FTC’s agreement with the contractor. See Stearns Decl. ¶ 39.

On September 9, 2013, the FTC provided Plaintiffs’ counsel with the contractor’s

estimate for processing the remaining portions of Request Nos. 2013-00680 and 2013-00949,

and the agency advised counsel that an advanced payment of the full amount was required within

ten days or the requests would be closed. See id. ¶ 40 & Ex. L. In response, counsel asked that

“[FTC] Staff not commence the search and production of the requested data until a resolution has

been reached concerning some, or all, of the Contested Fields,” and he stated that Plaintiffs

intended to appeal the cost estimate. See id. ¶¶ 41-42 & Ex. M. On September 23, the agency

closed both requests because it did not receive timely payment. See id. ¶ 43 & Ex. N.

2
Plaintiffs object to the FTC’s evidence regarding this cost estimate, as well as the
quote provided on September 18, 2013, which is discussed below. For the reasons explained in
Part IV.F.1, the Court rejects Plaintiffs’ objection.

6
 E. FOIA Request No. 2013-01305

On August 26, 2013, Plaintiffs’ counsel filed a third FOIA request, Request No. 2013-

01305, which sought the following eight fields for all complaints in the Consumer Sentinel

database:

Table 4
Fields Sought in Request No. 2013-01305
• Complaint Info Law Violation Code • Company Address, State Name
• Complaint Info Statute Code • Company Address, Country Name
• Consumer Address, Zip Code • Company Email
• Company Address, Line 3 • CompanyWebsite
Source: Stearns Decl. ¶ 44 & Ex. O

This request, like the first two requests, did not include the “Company Address, Zip Code

Extension” field. See id. Again, the FTC determined that it would produce only the data fields

that did not elicit free-form responses. See id. ¶ 45 & Ex. Q. The FTC also requested another

estimate from the contractor for processing the remaining fields in Request No. 2013-01305, see

id. ¶¶ 46-47 & Ex. R, and the contractor provided a quote of $8,581.95. See id. ¶ 48 & Ex. S;

Rushen Decl. ¶ 12. On September 18, 2013, the FOIA Unit provided Plaintiffs’ counsel with the

estimate for processing the granted portions of the request, see Stearns Decl. ¶ 49 & Ex. T, and

on September 30, the agency closed the request when Plaintiffs did not pay on time. See id. ¶ 50

& Ex. U.

F. Second Appeal: Request Nos. 2013-00680; 2013-0949; and 2013-01305

On October 23, 2013, Plaintiffs appealed the FTC’s resolution of the remanded portions

of Request Nos. 2013-00680 and 2013-0949, as well as the agency’s response to Request No.

2013-01305. See id. ¶ 51. Mr. Shonka denied the appeal a month later. See id. ¶ 52 & Ex. V.

Following the appeal, however, the FTC determined that several additional fields should be

produced: the “Company Phone, Area Code” and “Company Address, Zip Code” fields in the

7
fraud database and the Do Not Call database; and the “Associated Institution Phone, Area Code”

and “Associated Institution Address, Zip Code” fields in the identity theft database. See id. ¶ 54.

In the end, after considering Plaintiffs’ three requests and two appeals, the FTC maintained that

the following fields contain exempt information, the manual review for which would be unduly

burdensome:

Table 5
Fraud and Other Consumer
Do Not Call Database Identity Theft Database
Database
• Consumer Address, City • Consumer Address, City • Consumer Address, City
• Company Address, Zip Code • Company Address, Zip Code • Consumer Address, Zip Code
• Company Name • Company Name • Associated Institution Institution
• Company Address, Line 1 • Company Phone, Number Name
• Company Address, Line 2 • Other information Comments • Associated Institution Address,
• Company Address, Line 3 Line 1
• Company Address, City • Associated Institution Address,
• Company Phone, Number Line 2
• Complaint Comments • Associated Institution Address,
• Company Email City
• Company Website • Associated Institution Phone,
Number
• Suspect Alias, Company Name
• Associated Institution Email
• Associated Institution Web URL
Source: Stearns Decl. ¶ 53

* * *

On December 2, 2013, Plaintiffs filed an amended complaint challenging the FTC’s

responses to the three FOIA requests described above. Specifically, Plaintiffs allege through

Counts I, II, and III that the FTC wrongfully withheld information in the following fields, which

Plaintiffs categorize as the “Company Information Fields” (Count I), the “Complainant

Geographic Information Field” (Count II), and the “Comment Fields” (Count III):

Table 6 3

3
As the FTC points out, Plaintiffs’ list of the fields for which the FTC denied
access is incomplete. See Def.’s Mem. Supp. Mot. Summ. J. at 27 n.1 (citing Am. Compl. ¶ 42).
The complete list is available at Table 5, supra. But as Plaintiffs explain, “the legal issues
involved relate to the substantive information contained in the eleven fields/categories listed in

8
 Complaint Category Requested Fields FTC Decision
Company Name Denied
Company Address, Line 3 Denied
Company Information Company Address, Zip Code Denied
Fields 4
(Count I) Company Address, Zip Code Extension Denied
Company Email Denied
CompanyWebsite Denied
Complainant Geographic
Information Field Consumer Address, Zip Code Denied
(Count II)
Comment Fields Other Information Comments Denied
(Count III) Complaint Info Comments Denied
Source: Am. Compl. ¶ 42

Finally, Plaintiffs allege in Count IV that the FTC violated FOIA by refusing to provide

information necessary for determining the reasonableness of the contractor’s fee estimates for

processing the granted portions of the FOIA requests.

III. LEGAL FRAMEWORK

A. Legal Standard in FOIA Cases

“FOIA cases typically and appropriately are decided on motions for summary judgment.”

Defenders of Wildlife v. U.S. Border Patrol, 623 F. Supp. 2d 83, 87 (D.D.C. 2009) (citing

Bigwood v. U.S. Agency for Int’l Dev., 484 F. Supp. 2d 68, 73 (D.D.C. 2007)). Under Rule 56 of

the Federal Rules of Civil Procedure, summary judgment must be granted when evidence shows

“that there is no genuine dispute as to any material fact and the movant is entitled to judgment as

a matter of law.” Fed. R. Civ. P. 56; Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 247 (1986).

In the FOIA context, a district court reviewing a motion for summary judgment conducts a de

[Table 6, supra] regardless of how many technical ‘fields’ within the databases contain that
substance.” Pls.’ Mem. Opp’n Def.’s Mot. Summ. J. at 6 n.3. The Court therefore refers to the
fields and categories described by Plaintiffs for purposes of this Memorandum Opinion.
4
The FTC disputes that Plaintiffs properly requested and exhausted their
administrative remedies as to the “Company Address, Zip Code Extension” field. See Answer
Am. Compl. ¶¶ 42, 44.

9
novo review of the record, and the responding federal agency bears the burden of proving that it

has complied with its obligations under FOIA. See 5 U.S.C. § 552(a)(4)(B); see also In Def. of

Animals v. Nat’l Insts. of Health, 543 F. Supp. 2d 83, 92-93 (D.D.C. 2008) (citing Assassination

Archives & Research Ctr. v. CIA, 334 F.3d 55, 57 (D.C. Cir. 2003)). The district court must

analyze all underlying facts and inferences in the light most favorable to the FOIA requester.

See Willis v. DOJ, 581 F. Supp. 2d 57, 65 (D.D.C. 2008) (citing Moore v. Aspin, 916 F. Supp.

32, 35 (D.D.C. 1996)). Accordingly, summary judgment for an agency is appropriate only if the

agency proves that it has “fully discharged its [FOIA] obligations[.]” Moore, 916 F. Supp. at 35

(citing Miller v. U.S. Dep’t of State, 779 F.2d 1378, 1382 (8th Cir. 1985)).

A court may award summary judgment in a FOIA case based solely upon the information

provided in agency affidavits or declarations if they describe “the justifications for nondisclosure

with reasonably specific detail, demonstrate that the information withheld logically falls within

the claimed exemption, and are not controverted by either contrary evidence in the record nor by

evidence of agency bad faith.” Military Audit Project v. Casey, 656 F.2d 724, 738 (D.C. Cir.

1981). Such affidavits or declarations “are accorded a presumption of good faith, which cannot

be rebutted by ‘purely speculative claims about the existence and discoverability of other

documents.’” SafeCard Servs., Inc. v. SEC, 926 F.2d 1197, 1200 (D.C. Cir. 1991) (quoting

Ground Saucer Watch, Inc. v. CIA, 692 F.2d 770, 771 (D.C. Cir. 1981)).

Finally, although FOIA cases typically are decided through summary judgment, courts in

this Circuit analyze failure to exhaust administrative remedies motions under Rule 12(b)(6). See

Hidalgo v. FBI, 344 F.3d 1256, 1260 (D.C. Cir. 2003) (vacating grant of summary judgment and

remanding FOIA case “with instructions to the district court to dismiss the complaint under

[Rule] 12(b)(6) … for failure to exhaust administrative remedies”); accord Acosta v. FBI, 946 F.

10
Supp. 2d 47, 49 (D.D.C. 2013); Tereshchuk v. U.S. Bureau of Prisons, 851 F. Supp. 2d 157, 161-

62 (D.D.C. 2012); Banks v. Lappin, 539 F. Supp. 2d 228, 234-35 (D.D.C. 2008).

B. FOIA’s Purpose and Exemptions

The statute known as FOIA is a revision of the public disclosure section of the

Administrative Procedure Act. See Conservation Force v. Jewell, No. 12-CV-1665, 2014 WL

4327949, at *4 (D.D.C. Sept. 2, 2014). Congress “broadly conceived” FOIA “to permit access to

official information long shielded unnecessarily from public view and [] to create a judicially

enforceable public right to secure such information from possibly unwilling official hands.”

EPA v. Mink, 410 U.S. 73, 80 (1973). To that end, “FOIA requires every federal agency, upon

request, to make ‘promptly available to any person’ any ‘records’ so long as the request

‘reasonably describes such records.’” Assassination Archives, 334 F.3d at 57 (quoting 5 U.S.C.

§ 552(a)(3)). Consistent with this statutory mandate, federal courts have jurisdiction to order the

production of records that an agency improperly withheld in violation of FOIA. See 5 U.S.C. §

552(a)(4)(B); DOJ v. Reporters Comm. for Freedom of the Press, 489 U.S. 749, 755 (1989).

FOIA, however, also “recognizes limitations that compete with the general interest in

disclosure, and that, in appropriate cases, can overcome it.” Nat’l Archives & Records Admin. v.

Favish, 541 U.S. 157, 172 (2004). “Thus, while ‘disclosure, not secrecy, is the dominant

objective of FOIA,’ there are [nine] exemptions from the statute’s broad reach[.]” U.S. Dep’t of

Def. v. FLRA, 510 U.S. 487, 494 (1994) (quoting Dep’t of Air Force v. Rose, 425 U.S. 352, 361

(1976)); see also 5 U.S.C. § 552(b)(1)-(9) (listing nine FOIA exemptions). “These exemptions

stem from Congress’s recognition that the release of certain information may harm legitimate

governmental or private interests.” Summers v. DOJ, 140 F.3d 1077, 1080 (D.C. Cir. 1998).

11
 Finally, courts must bear in mind that FOIA mandates a “strong presumption in favor of

disclosure,” U.S. Dep’t of State v. Ray, 502 U.S. 164, 173 (1991), and consistent with that

presumption, the nine statutorily exempt categories of documents must be “narrowly construed.”

Rose, 425 U.S. at 361. As such, the “‘burden is on the agency’ to show that the requested

material” need not be produced because a particular FOIA exemption protects the material from

disclosure. Petroleum Info. Corp. v. U.S. Dep’t of Interior, 976 F.2d 1429, 1433 (D.C. Cir.

1992) (quoting 5 U.S.C. § 552(a)(4)(B)). “Ultimately, an agency’s justification for invoking a

FOIA exemption is sufficient if it appears ‘logical’ or ‘plausible.’” Wolf v. CIA, 473 F.3d 370,

374-75 (D.C. Cir. 2007) (quoting Gardels v. CIA, 689 F.2d 1100, 1105 (D.C. Cir. 1982)).

IV. ANALYSIS

Now before the Court are the FTC’s motion for summary judgment and Plaintiffs’ cross-

motion for partial summary judgment. The FTC argues that it correctly denied Plaintiffs’

requests as to the free-form data fields in Counts I, II, and III under FOIA Exemptions 6 and

7(C) because those fields actually or potentially contain personal identifying information

protected by the exemptions, and the manual review needed to redact this information would be

unduly burdensome given the volume of records in the Consumer Sentinel database. 5 See Def.’s

Mem. Supp. Mot. Summ. J., ECF No. 16, at 14. In addition, the agency argues that it properly

excluded under Exemption 3 complaints that were provided by the Canadian Anti-Fraud Centre

5
As Plaintiffs note, see, e.g., Pls.’ Mem. Opp’n Def.’s Mot. Summ. J. at 43, the
FTC asserts exemptions in this litigation not raised during the administrative process. Though
this is correct, an “agency is nonetheless entitled to refine its position” by asserting new FOIA
exemptions before the Court. Cuban v. SEC, 744 F. Supp. 2d 60, 90 (D.D.C. 2010); see also
Gula v. Meese, 699 F. Supp. 956, 959 n.2 (D.D.C. 1988) (“[T]he defendant in a FOIA case may
assert new exemptions at the federal district court level stage not previously asserted at the
administrative level, even if the circumstances have not changed in the interim.”) (citing Jordan
v. DOJ, 591 F.2d 753, 779 (D.C. Cir. 1978)).

12
or derived through the Ecommerce.gov website. See id. Next, the FTC seeks summary

judgment on Count IV on the basis that the cost estimates provided by the contractor were

reasonable. See id. And finally, the FTC moves to dismiss Plaintiffs’ request for information

contained in the “Company Address, Zip Code Extension” data field based on failure to exhaust

administrative remedies. See id. Plaintiffs, on the other hand, move for partial summary

judgment as to the release of complaints received by the FTC through its telephone complaint

line, as opposed to those complaints submitted directly by consumers on the FTC’s website. See

Pls.’ Mem. Supp. Part. Mot. Summ. J., ECF No. 20, at 1.

For the reasons discussed below, the Court grants in part and denies in part the FTC’s

motion, and denies in full Plaintiffs’ motion. Specifically, the Court denies the FTC’s motion to

dismiss the claim in Count I regarding the “Company Address, Zip Code Extension” field, on the

basis of failure to exhaust administrative remedies. Next, the Court grants summary judgment

for the FTC as to Counts I and III because those counts seek free-form data fields that potentially

contain personal identifying information that must be withheld under FOIA Exemptions 6 and

7(C), and the manual review required to segregate such exempt information would be unduly

burdensome. The Court, however, denies the FTC’s request for summary judgment on Count II

because the agency fails to offer evidence establishing a privacy interest in the five-digit zip code

data.

In addition, the Court grants summary judgment for the FTC as to the Canadian Anti-

Fraud Centre and Ecommerce.gov complaints because those complaints must be segregated and

withheld under FOIA Exemption 3, and the Court also grants summary judgment for the FTC on

Count IV because there is no genuine dispute of material fact that the agency’s cost estimates

13
were reasonable. Finally, the Court denies Plaintiffs’ motion for summary judgment as to the

complaints received through the FTC’s telephone complaint line.

A. Failure to Exhaust: “Company Address, Zip Code Extension” Field

The FTC moves to dismiss the claim in Count I with respect to the “Company Address,

Zip Code Extension” data field on the basis that none of Plaintiffs’ three FOIA requests included

this field. See Def.’s Mem. Supp. Mot. Summ. J. at 26. “Exhaustion of administrative remedies

is generally required before seeking judicial review ‘so that the agency has an opportunity to

exercise its discretion and expertise on the matter and to make a factual record to support its

decision.’” Wilbur v. CIA, 355 F.3d 675, 677 (D.C. Cir. 2004) (quoting Oglesby v. U.S. Dep’t of

the Army, 920 F.2d 57, 61 (D.C. Cir. 1990)). As the D.C. Circuit has explained, although

exhaustion of a FOIA request “is not jurisdictional because the FOIA does not unequivocally

make it so,” Hidalgo v. FBI, 344 F.3d 1256, 1258 (D.C. Cir. 2003) (citing I.A.M. Nat’l Pension

Fund Ben. Plan C. v. Stockton TRI Indus., 727 F.2d 1204, 1208 (D.C. Cir. 1984)), failure to

exhaust still “precludes judicial review if ‘the purposes of exhaustion’ and the ‘particular

administrative scheme’ support such a bar,” id. at 1258-59 (quoting Oglesby, 920 F.2d at 61).

It is undisputed that Plaintiffs did not include the “Company Address, Zip Code

Extension” data field in the three FOIA requests at issue. See Pls.’ Resp. Def.’s Stmt. of Facts ¶¶

6, 16, 22, 34. Instead, Plaintiffs’ first administrative appeal, which was filed after the FTC

refused to grant Plaintiffs’ first two FOIA requests, specifically listed the “Company Address,

Zip Code Extension” field as one of the fields they were appealing, despite its not being included

in the original requests. See Am. Compl., Ex. A; Pls.’ Mem. Opp’n Def.’s Mot. Summ. J., ECF

No. 19, at 32. Curiously, in response to this appeal, the FTC pointed out that it would not

consider several of the new fields raised by Plaintiffs because those fields were not included

14
within the scope of the FOIA requests, but the FTC’s list did not include the “Company Address,

Zip Code Extension” field that Plaintiffs also had mentioned for the first time on appeal. See

Am. Compl., Ex. B at 2 n.2. The FTC, moreover, concluded at the end of the response letter that

it was “excluding any zip code fields” from processing under Exemption 6. See id. at 5

(emphasis added).

Based on the FTC’s response letter, it appears that when evaluating whether Exemption 6

prevented disclosure, the agency may have considered the “Company Address, Zip Code

Extension” field along with the other consumer and company zip code fields requested by

Plaintiffs. Yet even if the agency did not consider this new field, it certainly was given an

opportunity to do so when Plaintiffs raised the issue in their administrative appeal. Thus, though

Plaintiffs technically failed to make a proper FOIA request and exhaust administrative remedies,

their error “presents no risk of undermining the purposes and policies underlying the exhaustion

requirement, namely, to prevent premature interference with agency processes, to give the parties

and the courts benefit of the agency’s experience and expertise and to compile an adequate

record for review.” Wilbur, 355 F.3d at 677. This is because by raising the question in the

appeal along with the other requested zip code fields, Plaintiffs afforded the FTC sufficient

opportunity to evaluate the “Company Address, Zip Code Extension” field — an opportunity, in

fact, it appears the FTC took given the language of the response letter.

In addition, the Court notes the futility and inefficiency of requiring Plaintiffs to restart

the FOIA process from the beginning as to this one field. First, the Court agrees with Plaintiffs’

prediction that the FTC very likely will deny this request once it is formally made. Indeed, given

the agency’s denial of the five-digit zip code information, which is less specific in identifying a

location than the four-digit zip code extension information, it would be illogical for the agency to

15
conclude otherwise. Second, after the FTC’s inevitable denial, it would be inefficient for the

Court to preside over a separate lawsuit regarding this single field when the parties already are

litigating the instant case that involves the same set of facts. Instead, the more efficient path is

for the Court to resolve all the Consumer Sentinel database disputes between Plaintiffs and the

FTC at once. Cf. Barouch v. DOJ, 962 F. Supp. 2d 30, 51 (D.D.C. 2013) (finding that plaintiff

“constructively exhausted” administrative remedies in part because “[i]t would be anomalous to

review plaintiff’s challenges to [the agency’s] withholdings of documents that were identified …

in the spring of 2012 and that were processed by [the agency], but to decline review on

exhaustion grounds the determinations of other agencies to which [agency] sent some of the

documents it identified at the same time”). Accordingly, because exhaustion is a prudential

consideration rather than a jurisdictional prerequisite, the Court concludes that, under these

circumstances, it will not dismiss the claim regarding the “Company Address, Zip Code

Extension” field for failure to exhaust. 6

6
Having denied the FTC’s failure to exhaust argument as to the “Company
Address, Zip Code Extension” field in Count I, the Court notes that this issue remains
outstanding because neither party addressed the merits of withholding zip code extensions in
their summary judgment briefing. Plaintiffs in particular focus their opposition memorandum
exclusively on the propriety of releasing five-digit zip codes, and they even go so far as to
disavow any interest in receiving the four-digit extensions. See, e.g., Pls.’ Mem. Opp’n Def.’s
Mot. Summ. J. at 35 (“In this case, of course, Plaintiffs are only seeking complainants’ five-digit
zip code[.]”). Part of Plaintiffs’ argument, in fact, rests on distinguishing five-digit zip codes
from the four-digit extensions based on Havemann v. Colvin, 537 F. App’x 142 (4th Cir. 2013),
where the Fourth Circuit approved of the Social Security Administration’s decision to produce
the five-digit zip codes but withhold the full nine-digit zip codes. By focusing their analysis only
on five-digit zip codes, Plaintiffs appear to acknowledge that the FTC could properly withhold
the four-digit extensions under Exemptions 6 and 7(C)) given that the extensions provide far
more specificity about an individual’s location. Nonetheless, given the lack of evidence and
arguments from both sides, the Court cannot resolve the question at this time.

16
 B. Counts I, II, and III: Denial of Requests for Free-Form Fields Under Exemption 6

In Counts I, II, and III, Plaintiffs contend that the FTC violated FOIA by denying their

requests for specific free-form data fields, which Plaintiffs categorize as the “Company

Information Fields” (Count I), the “Complainant Geographic Information Field” (Count II), and

the “Comment Fields” (Count III). See Am. Compl. ¶¶ 42, 46-88; see also Tbl. 6, supra. In

response, the FTC argues that it correctly withheld the information in each of these fields under

FOIA Exemption 6, and as such, the agency seeks summary judgment in its favor on these

counts. For the reasons explained below, the Court agrees with the FTC that the data fields

sought in Counts I and III potentially contain information protected under Exemption 6; the

Court finds, however, that the FTC has failed to establish that Exemption 6 covers the zip code

information sought in Count II.

1. Exemption 6 Framework

FOIA Exemption 6 protects from disclosure “personnel and medical files and similar files

the disclosure of which would constitute a clearly unwarranted invasion of personal privacy.” 5

U.S.C. § 552(b)(6). The Supreme Court has interpreted the term “similar files” broadly so as “to

cover detailed Government records on an individual which can be identified as applying to that

individual.” U.S. Dep’t of State v. Wash. Post Co., 456 U.S. 595, 602 (1982) (citation and

quotation marks omitted). “The information in the file ‘need not be intimate’ for the file to

satisfy the standard, and the threshold for determining whether information applies to a particular

individual is minimal.” Milton v. DOJ, 783 F. Supp. 2d 55, 58 (D.D.C. 2011) (quoting N.Y.

Times Co. v. NASA, 920 F.2d 1002, 1006 (D.C. Cir. 1990)).

Once this threshold determination is met, a court next inquires whether disclosure would

compromise a “substantial” privacy interest because FOIA requires the release of information

17
“[i]f no significant privacy interest is implicated.” See Multi Ag Media LLC v. U.S. Dep’t of

Agric., 515 F.3d 1224, 1229 (D.C. Cir. 2008) (citing Nat’l Ass’n of Retired Fed. Emps. v.

Horner, 879 F.2d 873, 874 (D.C. Cir. 1989)). This standard, however, “means less than it might

seem,” as a substantial privacy interest is “anything greater than a de minimis privacy interest.”

Id. at 1229-30. If a substantial privacy interest exists, a court next tests whether release of such

information would constitute a “clearly unwarranted invasion of personal privacy,” Wash. Post

Co. v. U.S. Dep’t of Health & Human Servs., 690 F.2d 252, 260 (D.C. Cir. 1982), by balancing

“the privacy interest that would be compromised by disclosure against any public interest in the

requested information.” Multi Ag Media, 515 F.3d at 1228.

2. Count I: Company Information Fields

The FTC argues that the Company Information Fields actually or potentially contain

personal identifying information, the disclosure of which would constitute an unwarranted

invasion of privacy under Exemption 6. See Def.’s Mem. Supp. Mot. Summ. J. at 27.

Specifically, the FTC contends that personal information can be entered in the Count I free-form

data fields through two scenarios: first, a consumer may mistakenly insert information about

himself in fields that are intended for details about the alleged wrongdoer; or second, a consumer

may intentionally provide information about an alleged individual wrongdoer, as opposed to a

corporation or other business wrongdoer, when describing an incident. See Stearns Decl. ¶ 12.

In response, Plaintiffs argue that the FTC fails to demonstrate that personal information is

inserted in these fields with any statistical frequency such that it is more than mere speculation.

See Pls.’ Mem. Opp’n Def.’s Mot. Summ. J. at 18. Plaintiffs also suggest that there is no privacy

interest in “personal information about an alleged wrongdoer” because the FTC released the

names of individuals appearing in the “Company Name” field in response to prior FOIA

18
requests. See id. at 19. The FTC contends that this argument confuses the privacy interests of

individuals accused of wrongdoing in their personal capacity with individuals accused of

wrongdoing while acting in a business capacity, and the FTC only seeks to protect information

regarding individuals in the former category. See Def.’s Reply Supp. Mot. Summ. J., ECF No.

26, at 17-18. As such, the agency attests that it does not redact the names of company

representatives or people otherwise acting through a business, thereby conceding that there is no

need to manually review complaints for personal identifying information about individuals

clearly acting in a business capacity. See Stearns II Decl. ¶¶ 10-14; see also Wash. Post Co. v.

U.S. Dep’t of Agric., 943 F. Supp. 31, 35 (D.D.C. 1996) (explaining that unlike information

about individuals acting in their personal capacity, there is “no expectation of privacy” in the

names of persons engaged in business). The Court therefore focuses its analysis on only those

individuals who are accused of wrongdoing in their personal capacity.

The FTC’s original declaration in support of its motion for summary judgment provided

just one example of a consumer mistakenly inserting her “own name, address, area code, phone

number, and email address in the fields reserved for the subject of the complaint” — that is, the

fields in which information about the wrongdoer should go. See Stearns Decl. ¶ 28. At the same

time, the FTC also offered evidence of three other complaints in which a consumer inserted

personal information about an individual wrongdoer in the Company Information Fields. See id.

Through a second declaration, however, the FTC provides additional evidence regarding a

supplementary review of more complaints in the Consumer Sentinel database, and this review

revealed a very real possibility of personal identifying information appearing in the Company

Information Fields.

19
 To cull the millions of complaints in the Consumer Sentinel database down to a

reviewable sample, the FTC first searched the fraud database for complaints containing a

“Gmail” address in the “Company Email Field.” See Stearns II Decl. ¶ 16. The agency selected

“Gmail” addresses because individuals, rather than business entities, typically use these email

addresses, so finding such an address in the Company Email Field logically suggests that an

individual is being accused of wrongful conduct in his or her personal capacity. See id. The

FTC’s search returned more than 350,000 complaints with a “Gmail” address, and the agency

reviewed a sample of 600 of those complaints, which revealed that 82%, or 497 of 600

complaints, contained personal identifying information, such as names and addresses, in one or

more of the free-form data entry fields sought through Count I. See id. ¶¶ 16-18. Furthermore,

89 of the 600 complaints that the FTC reviewed in this sample originated from the FTC’s call

center, and of those 89 complaints, 78 contained personal identifying information in one or more

of the Company Information Fields. See id. ¶ 19.

The agency also ran a similar search in the Consumer Sentinel database’s identity theft

database for complaints in which a “Gmail” address appears in the “Associated Institution

Email” field, which returned 970 complaints. See id. ¶ 21. The agency’s review of a date-

limited subset of 151 complaints revealed that 78% of the complaints contained personal

identifying information about private individuals in one or more of the data fields in Count I.

See id. ¶¶ 21-22. Extrapolating the results from the identity theft database and fraud database

searches to the original set of 350,000 “Gmail” complaints indicates that hundreds of thousands

of records may exist in which personal identifying information was intentionally placed in

Company Information Fields because the alleged wrongdoer was described as acting in his or her

personal capacity.

20
 In addition, the FTC provides evidence that consumers are mistakenly entering their own

personal information into various Company Information Fields. For example, 59 of the 151

identity theft database complaints from the sample described above included information in the

“Associated Institution Email” field that matched the complaining consumer’s email address,

which suggests that these consumers entered their personal information in the wrong fields. See

id. ¶ 23. In 33 other complaints, the consumer’s area code and telephone number matched the

“Associated Institution” area code and telephone number, and in 23 complaints, the consumer’s

street address, city, state, and zip code all matched the “Associated Institution” address. See id.

Finally, numerous consumers also listed their personal email address and name in the

“Associated Institution Contact Person” or “Associated Institution Institution Name” fields,

rather than information about the subject of the complaint. See id.

To justify withholding documents under Exemption 6, the FTC must show that the threat

to privacy is “real rather than speculative.” Elec. Privacy Info. Ctr. v. Dep’t of Homeland Sec.,

384 F. Supp. 2d 100, 116 (D.D.C. 2005) (citing U.S. Dep’t of Air Force v. Rose, 425 U.S. 352,

380 n.19 (1976)). An agency can meet its burden by providing affidavits or declarations that

“describe the justifications for nondisclosure with reasonably specific detail, demonstrate that the

information withheld logically falls within the claimed exemption, and are not controverted by

either contrary evidence in the record nor by evidence of agency bad faith.” Larson v. U.S.

Dep’t of State, 565 F.3d 857, 862 (D.C. Cir. 2009) (quoting Miller v. Casey, 730 F.2d 773, 776

(D.C. Cir. 1984)). Here, the Court is satisfied that — based on the evidence provided by the

FTC, the lack of allegations of bad faith, and the lack of contradictory evidence provided by

Plaintiffs — the agency has demonstrated a real, and not merely speculative, possibility of

personal identifying information in the form of names, addresses, telephone numbers, and email

21
addresses existing in the Company Information Fields. The next step, then, involves identifying

whether there exists a privacy interest in withholding this information, and whether, when

balanced against the public benefits of disclosure, release of the personal identifying information

would create a “clearly unwarranted invasion of personal privacy.” See Reed v. NLRB, 927 F.2d

1249, 1251 (D.C. Cir. 1991).

In construing Exemption 6, the D.C. Circuit has explained that “the disclosure of names

and addresses is not inherently and always a significant threat to the privacy of those listed;

whether it is a significant or a de minimis threat depends upon the characteristic(s) revealed by

virtue of being on the particular list, and the consequences likely to ensue.” Nat’l Ass’n of

Retired Fed. Emps. v. Horner, 879 F.2d 873, 877 (D.C. Cir. 1989); see also U.S. Dep’t of State v.

Ray, 502 U.S. 164, 176 n.12 (1991) (noting that disclosure of a list of names and other personal

identifying information is not “inherently and always a significant threat to the privacy of the

individuals on the list”). But at the same time, the D.C Circuit has recognized that “the privacy

interest of an individual in avoiding the unlimited disclosure of his or her name and address is

significant.” Horner, 879 F.2d at 875. In its motion for summary judgment, the FTC argues that

individuals possess a substantial privacy interest in their personal identifying information not

being released because these individuals most likely fall into one of two categories: either they

are victims of a fraudulent scheme or crime, or they are accused of committing or participating in

a fraudulent scheme or crime. See Def.’s Reply Supp. Mot. Summ. J. at 17.

First, the Court agrees that consumers who are victims, and consequently also are

whistleblowers and witnesses, face potential backlash if identified in the form of embarrassment,

becoming a “mark” for similar schemes in the future, and retribution from the alleged wrongdoer

— all of which constitute unwanted privacy intrusions that extend beyond merely having a name

22
and address published. See U.S. Dep’t of State v. Wash. Post Co., 456 U.S. 595, 599 (1982)

(FOIA’s legislative history shows that “Congress’[s] primary purpose in enacting Exemption 6

was to protect individuals from the injury and embarrassment that can result from the

unnecessary disclosure of personal information”); Horner, 879 F.2d at 878 (“Disclosure does

not, literally by itself, constitute a harm; it is the requester’s (or another’s) reaction to the

disclosure that can sting. This is only more obvious where disclosure of the information invades

someone’s privacy not because it is embarrassing but because it invites unwanted intrusions.”);

see also Lahr v. NTSB, 569 F.3d 964, 976 (9th Cir. 2009) (explaining that “protection from …

unwanted contact [by third parties] facilitated by disclosure of a connection to government

operations and investigations is a cognizable privacy interest under Exemptions 6”).

Second, those individuals accused of wrongdoing also have a substantial privacy interest

in their names and addresses not being disclosed. The Consumer Sentinel database contains

allegations of illegal conduct, and there is no filter for weeding out the legitimate complaints

from those completely lacking in a factual or legal basis. Yet, by having one’s personal

information included in a complaint, that person is both accused of an illegal activity and

associated with a federal agency’s crime enforcement effort. Cf. Fund for Constitutional Gov’t

v. Nat’l Archives & Records Serv., 485 F. Supp. 1, 6 (D.D.C. 1978) (“An individual does not lose

his right to privacy simply because he has been investigated and subsequently not charged with

any offense. Indeed, such an individual may require even greater protection, especially where …

the mere connection of an individual’s name with a well-known investigation may be both

embarrassing and damaging.”). If an individual is identified through his or her personal

information, the release of such information may result in economic and physical danger to the

accused, as well as potential embarrassment and harassment. See Island Film, S.A. v. Dep’t of

23
Treasury, 869 F. Supp. 2d 123, 136 (D.D.C. 2012) (noting that “whether individuals have a

privacy interest in their names and addresses under Exemption 6 depends on the context and

anticipated consequences of disclosure”) (citing Morley v. CIA, 508 F.3d 1108, 1128 (D.C. Cir.

2007)).

Though unintentionally, Plaintiffs demonstrate the potential for abusing personal

identifying information because one of their four “public” benefits for releasing information in

the Count I data fields is to convert the Consumer Sentinel database into a consumer review tool

akin to “Yelp.com.” 7 Specifically, Plaintiffs suggest that “[d]isclosure of the Company

Information Fields would permit the public (including the Plaintiffs) to quickly and efficiently

review complaints that have been submitted about entities with which they, or their clients, may

do business in order to form an educated opinion concerning those entities’ business practices.”

Pls.’ Mem. Opp’n Def.’s Mot. Summ. J. at 25 (citing Am. Compl. ¶ 56). This proposed benefit,

however, demonstrates the very privacy interest at stake if personal identifying information

about an accused individual wrongdoer is released — namely that people will use this

information to identify the individual and then make judgments and alter their behavior in regard

to the accused based on unverified complaints held by a federal agency. This benefit, moreover,

7
Yelp.com is a website that enables consumers to rate and review businesses and
services, and potential consumers then can read that information before making a purchasing
decision. Plaintiffs’ suggestion that they lack “any interest in using the data obtained to try to
identify complainants” is irrelevant. See Pls.’ Mem. Opp’n Def.’s Mot. Summ. J. at 36. FOIA
itself states that records, if not exempt, must be made “promptly available to any person,” 5
U.S.C. § 552(a)(3) (emphasis added), and the Supreme Court has repeatedly recognized that
FOIA is “clearly intended … to give any member of the public as much right to disclosure as one
with a special interest” in a particular document. U.S. Dep’t of Def. v. FLRA, 510 U.S. 487, 495-
97 (1994) (citations omitted). Thus, “except in certain cases involving claims of privilege, ‘the
identity of the requesting party has no bearing on the merits of his or her FOIA request.’” Id.
(quoting Reporters Comm., 489 U.S. at 771). “Once records are released, nothing in FOIA
prevents the requester from disclosing the information to anyone else. The statute contains no
provisions requiring confidentiality agreements or similar conditions.” Swan v. SEC, 96 F.3d
498, 500 (D.C. Cir. 1996).

24
clearly is not the type recognized under FOIA Exemption 6. Cf. Lurie v. U.S. Dep’t of Army, 970

F. Supp. 19, 35 (D.D.C. 1997) (“As with FOIA generally, the fundamental question in evaluating

the public interest [under Exemption 6] is whether disclosure would provide a view of the

agency’s activities, thereby revealing what our ‘government is up to.’” (quoting DOJ v.

Reporters Comm. for Freedom of the Press, 489 U.S. 749, 773 (1989)).

Similarly, Plaintiffs also propose that “[d]isclosure of the Company Information Fields

would permit members of the public (e.g., corporations) to quickly and efficiently review

complaints that have been submitted about themselves to help identify potential advertising,

marketing, or privacy practices which may be perceived by others as failing to comply with legal

requirements.” Pls.’ Mem. Opp’n Def.’s Mot. Summ. J. at 25-26 (citing Am. Compl. ¶ 57).

Again, the Court must reject this proposed benefit because, like with the first goal of creating a

private consumer review tool, “the only relevant public interest in the FOIA balancing analysis

[under Exemption 6 is] the extent to which disclosure of the information sought would ‘she[d]

light on an agency’s performance of its statutory duties’ or otherwise let citizens know ‘what

their government is up to.’” 8 U.S. Dep’t of Def. v. FLRA, 510 U.S. 487, 497 (1994) (quoting

Reporters Comm., 489 U.S. at 773). Neither of these purposes sheds any light on the FTC’s

performance, but rather they only serve purely private interests disassociated from monitoring

8
The FTC aptly describes the problems and risks associated with Plaintiffs’
misplaced argument that these are recognizable public interests under Exemption 6:
Plaintiffs’ idea that members of the public and businesses could use complaints in
the Consumer Sentinel as a proxy for a company’s reputation [] is even farther
from a cognizable public interest. That idea would shed no light at all on what the
agency is up to, while at the same time it would encourage gaming the database
by entering false complaints — unverified, that could not be challenged or
removed — against competitors or to punish businesses where a consumer had a
bad experience. The Consumer Sentinel cannot be both an effective law-
enforcement database and a consumer review site.

Def.’s Reply Supp. Mot. Summ. J. at 19 n.12.

25
the agency’s functioning. Cf. Nat’l Archives & Records Admin. v. Favish, 541 U.S. 157, 172

(2004) (“[T]he citizen must show that the public interest sought to be advanced is a significant

one, an interest more specific than having the information for its own sake.”).

The Court also rejects Plaintiffs’ argument that consumers who submit complaints

through the FTC’s website have a reduced expectation of privacy in general. See Pls.’ Mem.

Opp’n Def.’s Mot. Summ. J. at 23-24. The FTC’s online privacy policy states that any

information submitted in connection with a consumer complaint may be provided to “businesses

or individuals in response to … [FOIA] Requests.” As the FTC explains, however, consumers

are not required to click on, read, or agree to the privacy policy in order to file a complaint. See

Tribble Decl. ¶ 15. In addition, individuals accused of misconduct in a complaint never see the

privacy policy in the first place. Yet, even if all parties involved actually read and consented to

the policy, the policy itself represents only a warning, not a waiver of FOIA privacy rights. As

this Court has explained in the context of a similarly phrased privacy clause, parties do “not

waive their privacy rights merely by acknowledging that the information they were providing

could be subject to release” under FOIA. 9 Hill v. U.S. Dep’t of Agric., 77 F. Supp. 2d 6, 8

(D.D.C. 1999). Here, the FTC’s privacy policy “does not say that the government will not

attempt to protect privacy rights by asserting them, and indeed the government is expected to do

so.” Id.; see also Lakin Law Firm, PC v. FTC, 352 F.3d 1122, 1125 (7th Cir. 2003) (stating that

“a warning [on the FTC’s website] that FOIA disclosure ‘may be required by law’ cannot be

construed as a waiver by the consumer of the privacy rights protected by the FOIA”).

9
In Hill, the loan application form stated that “[a]ll information supplied to
Farmers Home Administration (FmHA) by you or your agents in connection with your loan
application may be released to interested third parties, including competitors, without your
knowledge or consent under [FOIA].” Hill, 77 F. Supp. 2d at 8 (alteration in original). The
language therefore is similar to that employed by the FTC here.

26
 Next, Plaintiffs offer two additional reasons for releasing the data fields sought in the

complaint, but neither alleged public benefit appears to require the release of personal identifying

information about the victim or the alleged individual wrongdoer. First, Plaintiffs propose that

[d]isclosure of the Company Information Fields would permit the public
(including the Plaintiffs) to monitor the effectiveness of the FTC’s consumer
protection efforts by comparing the FTC’s enforcement initiatives to the volume
and nature of consumer complaints involving the specific entities against which
the FTC brought enforcement action and those entities against which the FTC did
not bring enforcement action.

Pls.’ Mem. Opp’n Def.’s Mot. Summ. J. at 25 (citing Am. Compl. ¶ 53). The Supreme Court,

however, has expressed that a “public interest is not furthered ‘by disclosure of information

about private citizens that is accumulated in various governmental files but that reveals little or

nothing about an agency’s own conduct.’” People for the Am. Way v. Nat’l Park Serv., 503 F.

Supp. 2d 284, 304 (D.D.C. 2007) (quoting Reporters Comm., 489 U.S. at 773). As such, the law

mandates that a nexus exists between the records being sought and the legitimate FOIA public

interest allegedly being furthered. See Barnard v. Dep’t of Homeland Sec., 598 F. Supp. 2d 1, 13

(D.D.C. 2009) (explaining that when “the nexus between the information sought and the asserted

public interest is lacking, the asserted public interests will not outweigh legitimate privacy

interests” (citations omitted)); Seized Prop. Recovery, Corp. v. U.S. Customs & Border Prot.,

502 F. Supp. 2d 50, 59 (D.D.C. 2007) (explaining that “[t]here must be a nexus between the

information that is sought under FOIA and the ability of the public to gain an understanding

about the agency’s operations” (internal citation and quotation marks omitted)).

Here, Plaintiffs provide no explanation for why personal identifying information about

the individuals who file complaints or who are the subjects of complaints while acting in their

personal capacity is required to achieve this goal, rather than simply relying on the non-sensitive

information from the other data fields that the FTC has agreed to release. See Voinche v. FBI,

27
940 F. Supp. 323, 330 (D.D.C. 1996) (finding that Exemption 6 protects from disclosure names

of “private citizens who wrote to government officials” because there was “no reason to believe

that the public will obtain a better understanding of the workings of various agencies by learning

the[ir] identities”). In fact, Plaintiffs’ stated benefit focuses exclusively on “the specific entities

against which the FTC brought enforcement action and those entities against which the FTC did

not bring enforcement action.” Pls.’ Mem. Opp’n Def.’s Mot. Summ. J. at 25 (citing Am.

Compl. ¶ 53) (emphasis added). Given that the Court is grappling with the privacy interests of

individuals accused in their personal capacity, the nexus between the personal identifying

information and the offered public benefit is highly dubious.

A similar analysis compels the Court to arrive at the same conclusion when evaluating

Plaintiffs’ final proposed benefit, which is that

[d]isclosure of the Company Information Fields would permit the public
(including the Plaintiffs) to verify the statistical conclusions published by the FTC
concerning the number and type of complaints filed by consumers relating to
businesses that operate in specific industries…. The public has a particular
interest in verifying the FTC’s statistics across the range of complaint categories
because those statistics are used to gauge the appropriateness of the FTC’s
allocation of resources and, over time, the effectiveness of the FTC’s enforcement
actions.

Pls.’ Mem. Opp’n Def.’s Mot. Summ. J. at 25 (citing Am. Compl. ¶ 54). Though it is generally

true that “matters of substantive law enforcement policy … are properly the subject of public

concern,” Reporters Comm., 489 U.S. at 766 n.18, a nexus still must exist between the

information sought and the public interest to be served. See Barnard, 598 F. Supp. 2d at 13;

Seized Prop. Recovery, 502 F. Supp. 2d at 59. It is not apparent how Plaintiffs’ purpose is

furthered through the release of personal identifying information about the victims or subjects of

complaints given the broad set of information the FTC already has agreed to produce. And once

again, Plaintiffs describe the public benefit as needing information about “complaints filed by

28
consumers relating to businesses that operate in specific industries,” not information about

individuals alleged to be acting in their personal capacity. Pls.’ Mem. Opp’n Def.’s Mot. Summ.

J. at 25 (citing Am. Compl. ¶ 54) (emphasis added). As such, the Court “need not linger over the

balance; something, even a modest privacy interest, outweighs nothing every time.” Horner, 879

F.2d at 879.

But even assuming that personal identifying information somehow furthered Plaintiffs’

third and fourth suggested benefits, the Court must conclude that those benefits do not outweigh

the substantial privacy interest of protecting victims and individuals accused of wrongdoing from

abuse, harassment, and embarrassment given the very real risk of their being identified and the

tenuous connection between their personal information and Plaintiffs’ stated policy goals.

Accordingly, the Court concludes that Exemption 6 applies to the personal identifying

information in the Company Information Fields, and that information therefore must be withheld

under FOIA. See, e.g., Lakin Law Firm, PC v. FTC, 352 F.3d 1122, 1125 (7th Cir. 2003)

(finding that names of individuals who complained to the FTC about billing scams were properly

withheld under Exemption 6 because that information revealed little about the agency’s inner

workings); Gov’t Accountability Project v. U.S. Dep’t of State, 699 F. Supp. 2d 97, 106 (D.D.C.

2010) (finding that names and email addresses were properly withheld under Exemption 6 when

there was a “clear privacy interest” in avoiding disclosure, and such disclosure served no public

purpose).

3. Count II: Complainant Geographic Information Field

In Count II, Plaintiffs allege that the FTC violated FOIA by withholding information in

the Complainant Geographic Information Field, which encompasses a consumer’s five-digit zip

code entered in the “Consumer Address, Zip Code” data field. The FTC, on the other hand,

29
argues that the five-digit zip codes constitute personal identifying information that invokes the

same substantial privacy interests under Exemption 6 as the information in the Company

Information Fields. See Def.’s Mem. Supp. Mot. Summ. J. at 33.

An agency cannot withhold information under Exemption 6 based on the “mere

possibilit[y]” that the release of such information will invade an individual’s privacy interest.

See U.S. Dep’t of Air Force v. Rose, 425 U.S. 352, 378, 381 n.19 (1976) (“The legislative history

is clear that Exemption 6 was directed at threats to privacy interest more palpable than mere

possibilities.”). As the FTC notes, Plaintiffs are receiving many pieces of information about a

particular complaint, and that information, when combined with a consumer’s zip code and the

accused’s own records, might theoretically enable the accused to identify the consumer. See

Def.’s Reply Supp. Mot. Summ. J. at 16. The agency, however, provides no evidence to support

this argument. See, e.g., Def.’s Mem. Supp. Mot. Summ. J. at 33-34 (citing no record evidence

to support summary judgment as to Count II); Def.’s Reply Supp. Mot. Summ. J. at 16 (same).

As the party seeking summary judgment, the FTC bears the initial burden of identifying evidence

that demonstrates the absence of any genuine issue of material fact. See Celotex Corp. v. Catrett,

477 U.S. 317, 323 (1986). Because the agency provides no evidence suggesting that disclosure

of the five-digit zip code actually or potentially affects the likelihood that the complainant will

be identified, the Court cannot conclude that such information implicates a substantial privacy

interest. The Court therefore denies the FTC’s motion for summary judgment as to Count II.

4. Count III: Comment Fields

In response to the FTC’s motion for summary judgment on Count III, Plaintiffs argue that

the Comment Fields do not contain personal identifying information that implicates Exemption

6. The FTC attests, however, that the fields potentially contain exempt information because

30
“[c]onsumers use these fields to explain their story and often include their own or others’

personal information,” including “complaints … in which consumers have entered in the

comment field their own name, address, telephone number, and email address, similar

information for family members or for individuals who are the subject of their complaint, or

other personal information such as their occupation and place of work.” See Stearns Decl. ¶ 28.

For example, based on a random sample of 500 consumer complaints and a larger non-random

sample of 12,620 complaints, “the FTC identified between 12% and 25% of complaints in which

some form of [personal identifying information] may have been accidentally included within the

Comment Fields.” Am. Compl. ¶ 79.

The agency also reviewed a sample set of 600 complaints in the fraud database that

contain “Gmail” addresses, and this examination resulted in 308 redactions of personal

identifying information in the “Complaint Comments” field. See Stearns II Decl. ¶ 18. Further,

a similar review of 151 complaints in the identity theft database required 57 redactions in that

same field. See id. ¶ 22. Though some of this information, such as social security and credit

card numbers, can be automatically redacted by the FTC, see Tribble Decl. ¶ 13, no automated

process exists for capturing all similar information because consumers may transcribe the

sensitive numbers in varying and unpredictable patterns, and other free-form personal identifying

information, such as names and addresses, simply never lends itself to a predictable format that

might allow automated redacting. See id. ¶ 14; Stearns II Decl. ¶ 32 (explaining that credit card

and social security numbers are automatically redacted in the comment fields only if they appear

in a certain format, and other categories of personal identifying information in the comment

fields always require manual review due to unpredictable formatting); see also 5 U.S.C. §

31
552(a)(4)(B) (“[A] court shall accord substantial weight to an affidavit of an agency concerning

the agency’s determination as to technical feasibility under … subsection (b).”).

Having found that the Comment Fields may contain personal identifying information, the

Court further concludes that this information is effectively similar to that found in the Company

Information Fields such that it implicates the same substantial privacy interest because it

likewise can be used to identify the victim or the accused. Thus, applying the same balancing of

interests performed in the context of the Company Information Fields, the Court again finds that

this information must be withheld under Exemption 6.

C. Counts I, II, and III: Denial of Requests for Free-Form Fields Under Exemption 7(C)

The FTC also seeks to withhold the data fields identified in Counts I, II, and III under

FOIA Exemption 7(C), which protects from disclosure information in law enforcement records

that “could reasonably be expected to constitute an unwarranted invasion of personal privacy.” 10

5 U.S.C. § 552(b)(7)(C). Though Exemptions 6 and 7(C) both require agencies and reviewing

courts to undertake the same weighing of interests, the balance under Exemption 7(C) “tilts more

strongly toward nondisclosure” because its “privacy language is broader than the comparable

language in Exemption 6[.]” DOJ v. Reporters Comm. for the Freedom of Press, 489 U.S. 749,

756 (1989). The Supreme Court has explained that these phrasing differences reflect Congress’s

choice to provide “greater protection” to law enforcement materials than to “personnel, medical,

and other similar files.” See id. Thus, the D.C. Circuit consistently has held that Exemption

7(C) “establishes a lower bar for withholding material [than Exemption 6].” ACLU v. DOJ, 655

F.3d 1, 6 (D.C. Cir. 2011); see also Beck v. DOJ, 997 F.2d 1489, 1491 (D.C. Cir. 1993).

10
Just as with Exemption 6, the FTC provides no evidence suggesting that the
consumer zip codes at issue in Count II qualify for protection under Exemption 7(C). The Court
therefore again must deny the FTC judgment on that issue.

32
 1. Law Enforcement Records

“To show that … documents were compiled for law enforcement purposes, the [agency]

need only establish a rational nexus between [an] investigation and one of the agency’s law

enforcement duties and a connection between an individual or incident and a possible security

risk or violation of federal law.” Blackwell v. FBI, 646 F.3d 37, 40 (D.C. Cir. 2011) (internal

citations and quotation marks omitted); see also Petrucelli v. DOJ, No. CV 11-1780, 2014 WL

2919285, at *13 (D.D.C. June 27, 2014) (same). Here, the FTC attests that records in the

Consumer Sentinel database are collected and maintained in furtherance of its responsibility to

“prevent persons, partnerships, or corporations … from using unfair methods of competition in

or affecting commerce and unfair or deceptive acts or practices in or affecting commerce.”

Stearns Decl. ¶ 15 (citing 15 U.S.C. § 45(b)); Stearns II Decl. ¶ 4 (“The FTC solicits consumer

complaints of fraud, identity theft, unfair business practices, and Do-Not-Call List violations to

aid in its law enforcement mission.”).

In particular, the FTC explains that the database is used to assist the agency in identifying

subjects for investigations, as well as for tracking the overall number of complaints and the

percentage of law enforcement actions the agency takes targeting the subjects of those

complaints. See Stearns II Decl. ¶ 7. Indeed, it is uncontested that “[c]onsumer complaints

stored in the Consumer Sentinel database have spawned numerous FTC investigations and

enforcement proceedings.” Id. And as further evidence, the FTC shares information compiled in

the database with domestic and international law enforcement partners to enhance and coordinate

interagency investigations. See id. ¶ 4. For these reasons, the Court finds that a sufficient nexus

exists between the Consumer Sentinel database and the FTC’s law enforcement activities such

that the records qualify for purposes of Exemption 7(C).

33
 2. Privacy Interests and Balancing

The D.C. Circuit has explained that “[b]ecause Exemption 7(C) provides protection for a

somewhat broader range of privacy interests than Exemption 6, privacy interests cognizable

under Exemption 6 are cognizable under Exemption 7(C).” See Stern v. FBI, 737 F.2d 84, 91

(D.C. Cir. 1984). Thus, having found that privacy interests exist in Counts I and III under

Exemption 6, the Court quickly can conclude that the same interests arise under Exemption 7(C).

Indeed, Exemption 7(C) “takes particular note of the strong interest of individuals, whether they

be suspects, witnesses, or investigators, in not being associated unwarrantedly with alleged

criminal activity.” Dunkelberger v. DOJ, 906 F.2d 779, 781 (D.C. Cir. 1990) (internal quotation

marks omitted); see also Fischer v. DOJ, 596 F. Supp. 2d 34, 47 (D.D.C. 2009) (“The D.C.

Circuit has consistently held that Exemption 7(C) protects the privacy interests of all persons

mentioned in law enforcement records, including investigators, suspects, witnesses, and

informants.”). Accordingly, the privacy interests implicated under Exemption 7(C) in this case

are substantial.

The fields from which Plaintiffs seek information in Counts I and III may contain

personal identifying information about consumers who are victims of an alleged crime, which

also makes those consumers witnesses and informants. These individuals therefore possess the

exact type of substantial privacy interest that Exemption 7(C) aims to protect. See Piper v. DOJ,

374 F. Supp. 2d 73, 78-79 (D.D.C. 2005) (“[I]ndividuals who provide information to the law

enforcement authorities … have a privacy interest and their identities have traditionally been

protected from disclosure by Exemption 7(C).”); Brown v. EPA, 384 F. Supp. 2d 271, 277

(D.D.C. 2005) (stating that “Exemption 7(C) affords broad privacy rights to witnesses and

informants in criminal investigations” (internal citation and quotation marks omitted)).

34
 Those individuals who are identified as alleged wrongdoers likewise possess a substantial

privacy interest in their personal identifying information. As the D.C. Circuit has explained,

“individuals have a strong interest in not being associated unwarrantedly with alleged criminal

activity,” and given that the Consumer Sentinel database contains unsubstantiated and

unscreened allegations, there is no way of knowing whether the wrongdoer is correctly or

incorrectly being attached to such unseemly conduct. See Stern, 737 F.2d at 91-92; see also Bast

v. DOJ, 665 F.2d 1251, 1254 (D.C. Cir. 1981) (explaining that Exemption 7(C) “recognize[s] the

stigma potentially associated with law enforcement investigations and affords broader privacy

rights to suspects, witnesses, and investigators”); Salas v. Office of Inspector Gen., 577 F. Supp.

2d 105, 111 (D.D.C. 2008) (“Exemption 7(C) recognizes that the stigma of being associated with

any law enforcement investigation affords broad privacy rights to those who are connected in

any way with such an investigation unless a significant public interest exists for disclosure.”).

The Court therefore finds that not only are the same privacy interests implicated by the data

fields in Counts I and III as under Exemption 6, those interests actually are even stronger in the

context of Exemption 7(C).

Finally, because it is the interest of the general public, and not that of the private litigant,

that the Court must consider, “the only public interest relevant for purposes of Exemption 7(C) is

one that focuses on ‘the citizens’ right to be informed about what their government is up to.’”

Davis v. DOJ, 968 F.2d 1276, 1282 (D.C. Cir. 1992) (quoting DOJ v. Reporters Comm. for

Freedom of the Press, 489 U.S. 749, 773 (1989)). And given that Exemption 7(C)’s equilibrium

is not “tilted emphatically in favor of disclosure” like under Exemption 6, see Bast, 665 F.2d at

1254, the Court concludes that, for similar considerations as were discussed above in the context

of Exemption 6, the privacy interests at stake easily outweigh the limited public benefits of

35
disclosure offered by Plaintiffs. The Court therefore finds that Exemption 7(C) also requires

withholding the personal identifying information in the data fields sought through Counts I and

III.

D. The FTC Is Not Required to Segregate Exempt Information Given the Burden of

Manual Review and Goal of Protecting Privacy Interests

At this point, the Court has concluded that the data fields sought through Counts I and III

potentially contain personal identifying information that is exempt from disclosure under FOIA

Exemptions 6 and 7(C). Next, FOIA requires that “[a]ny reasonably segregable portion of a

record shall be provided to any person requesting such record after deletion of the portions which

are exempt under this subsection.” 5 U.S.C. § 552(b)(9). An agency, however, need not

segregate exempt information if the non-exempt portion is “inextricably intertwined with exempt

portions.” Mead Data Cent., Inc. v. U.S. Dep’t of Air Force, 566 F.2d 242, 260 (D.C. Cir. 1977).

At the same time, the agency is not required to comply with a request that is “so broad as to

impose an unreasonable burden upon the agency,” such as one that “require[s] the agency to

locate, review, redact, and arrange for inspection a vast quantity of material.” Am. Fed’n of

Gov’t Emps., Local 2782 v. U.S. Dep’t of Commerce, 907 F.2d 203, 209 (D.C. Cir. 1990).

As the D.C. Circuit has explained, when an agency claims that complying with a request

is unreasonable, it bears the burden to “provide [a] sufficient explanation as to why such a search

would be unreasonably burdensome.” Nation Magazine v. U.S. Customs Serv., 71 F.3d 885, 892

(D.C. Cir. 1995); Pub. Citizen, Inc. v. U.S. Dep’t of Educ., 292 F. Supp. 2d 1, 6 (D.D.C. 2003).

To make this determination, a court may rely on agency affidavits or declarations that show with

reasonable specificity why documents withheld pursuant to a valid exemption cannot be further

segregated. See Armstrong v. Exec. Office of the President, 97 F.3d 575, 578 (D.C. Cir. 1996);

36
see also Thompson v. Exec. Office for U.S. Attorneys, 587 F. Supp. 2d 202, 207-08 (D.D.C.

2008) (explaining that when considering “whether nonexempt information could have been

segregated from exempt information and released,” courts may rely on an agency affidavit if it

“provides a sufficient description of the documents and a sufficient explanation of the basis for

withholding”). Ultimately, the agency is entitled to the presumption that it complied with the

requirement to segregate non-exempt materials. See Hodge v. FBI, 703 F.3d 575, 582 (D.C. Cir.

2013) (citing Sussman v. U.S. Marshals Serv., 494 F.3d 1106, 1117 (D.C. Cir. 2007)).

Though some personal identifying information can be automatically redacted, such as

certain social security and credit card numbers assuming they are in the proper formats, it is

uncontested that the remaining information requires a manual review to redact the material

protected by Exemptions 6 and 7(C). See id. ¶ 34 & Ex. J; Tribble Decl. ¶¶ 13-14; Stearns II

Decl. ¶ 32. The FTC estimates that completing the manual redaction process for the withheld

data fields across all twenty million Consumer Sentinel database complaints would take more

than 8,000 hours. 11 See Stearns Decl. ¶ 22. Plaintiffs do not object to the FTC’s estimate about

the amount of labor needed to perform this manual review, see Pls.’ Resp. Def.’s Stmt. Facts ¶

12, nor do Plaintiffs provide an argument suggesting that the estimated 8,000 hours of labor does

not constitute an undue burden on the agency. Cf. Vietnam Veterans of Am. Conn. Greater

Hartford Chapter 120 v. U.S. Dep’t of Homeland Sec., No. 3:10CV1972, 2014 WL 1284970, at

*4-5 (D. Conn. Mar. 31, 2014) (finding that plaintiff’s FOIA request posed an unreasonable

burden on the agency to review and redact personal identifying information from approximately

11
The FTC does not provide a separate estimate for reviewing only the data in
Counts I and III, given that the Court has denied the agency’s motion as to the zip code field in
Count II. The Court, however, finds no reason to expect that removing the need to review the
single Count II data field would materially affect the agency’s burden in responding to Plaintiffs’
requests.

37
26,000 records because doing so would take an estimated twenty-seven years); Hainey v. U.S.

Dep’t of Interior, 925 F. Supp. 2d 34, 45 (D.D.C. 2013) (granting summary judgment for the

agency when responding to FOIA request would “require a search of every email sent or

received by 25 different employees throughout a two-year time period,” and the agency also

“would need to individually review each potentially responsive email to confirm its

releasability”).

Accordingly, based on the FTC’s “explanation as to why such a search would be

unreasonably burdensome,” Nation Magazine, 71 F.3d at 892, and absent any contrary argument

on Plaintiffs’ part, the Court must conclude that performing a manual review of the Consumer

Sentinel database complaints for exempt personal identifying information would impose an

unreasonable burden on the FTC well beyond what FOIA requires from an agency. Such a

conclusion, however, only begs the question of whether the Court should find that manual review

is required in the first place.

Resolving this question requires a different burden and segregation analysis than is

ordinarily performed in a FOIA case. Typically, courts discuss the agency’s burden and the

feasibility of segregating exemption information in the context of the agency’s ability to identify

the universe of records relevant to a request, see, e.g., Defenders of Wildlife v. U.S. Border

Patrol, 623 F. Supp. 2d 83, 91 (D.D.C. 2009) (analyzing the adequacy of the agency’s search for

relevant records), the physical difficulty of segregating exempt information within the relevant

records, see, e.g., Int’l Counsel Bureau v. U.S. Dep’t of Def., 864 F. Supp. 2d 101, 106–107

(D.D.C. 2012) (ordering in camera review of videos to determine potential segregability), or the

challenge of determining whether the exempt information is so intertwined with non-exempt

information that removing the exempt information leaves nothing of value left in the record, see,

38
e.g., Mays v. DEA, 234 F.3d 1324, 1327 (D.C. Cir. 2000) (approving of withholding entire grand

jury transcript because “the excision of exempt information would … produce an edited

document with little informational value”).

Here, the FTC does not argue that it cannot search for and retrieve the Consumer Sentinel

database records, that it cannot physically segregate exempt information, or that making

redactions would result in records with no remaining informational value. Instead, the agency’s

argument for non-disclosure focuses only on the burden of manually identifying and redacting

the exempt information across the already retrieved twenty million responsive records within the

Consumer Sentinel database. See Stearns Decl. ¶¶ 20-22. Thus, based on the unique facts of this

case, the question before the Court becomes whether the FTC can withhold the entire universe of

information contained in the data fields when only a small percentage of that information is

exempt but redacting the exempt information requires an unreasonably burdensome manual

review.

If Plaintiffs sought a smaller, more manageable universe of records and not the twenty

million complaints in the Consumer Sentinel database, the solution might be simple: the Court

could order the FTC to expend a reasonable amount of resources to identify and redact the

exempt personal information from each complaint. The facts and equities of this case, however,

compel the Court to conclude that the FTC properly withheld the entire universe of information

given the burden of removing the subset of exempt information. Specifically, the FTC is

attempting to protect the privacy interests of third-party citizens by preventing the disclosure of

their personal identifying information, including some citizens who had no control over the FTC

possessing their information in the first place. This is not a situation in which an agency seeks to

protect its own potentially confidential information — such as agency information covered by

39
the deliberative process privilege — by withholding a substantially broader set of information

that does not contain privileged information. Indeed, if that was the case, the Court might

require the FTC to decide between performing the burdensome manual review or producing its

privileged information unredacted, rather than allowing the blanket withholding of information

that otherwise would serve a legitimate public interest. 12 But here, because the agency aims to

protect the private information of citizens by withholding the data fields at issue, and because the

manual review needed for redacting such information is unreasonably burdensome, the Court

concludes that the FTC properly withheld the data fields under Exemptions 6 and 7(C).

E. Plaintiffs’ Motion for Partial Summary Judgment: Segregating Complaints Submitted

through the FTC’s Telephone Line

Plaintiffs move for partial summary judgment with respect to the Consumer Sentinel

database complaints that were received by the FTC through its telephone complaint line and then

memorialized by the telephone operator. See generally Pls.’ Mem. Supp. Part. Mot. Summ. J. In

doing so, Plaintiffs argue that because the phone operators are trained to enter information in the

correct data fields and to avoid inserting “sensitive” consumer information, there is no plausible

reason to believe that a privacy interest is implicated by the over-the-phone complaints such that

manual review is required. See id. at 3. In response, the FTC argues that even if the operators

never make mistakes, consumers still give personal identifying information about other private

individuals, such as witnesses and the accused, when they complain to the FTC, and the

operators correctly enter this information into the Company Information Fields and Comments

Fields. See Def.’s Reply Supp. Mot. Summ. J. at 3. As such, the agency maintains that like with

12
Of course, if the agency’s own information involved other hypothetical interests,
such as national security interests, the Court would face a different inquiry.

40
complaints filed through the FTC’s website, manual review is required to redact the exempt

information.

The FTC provides evidence that within the sample of 600 complaints with a “Gmail”

address in the “Company Email” field, 89 complaints originated through a telephone call to the

agency, and 78 of those complaints (88%) contained personal identifying information in the

fields Plaintiffs seek through Counts I and III, such as the “Company” fields, fields labeled for

“Associated Institution” or “Suspect Alias,” and the “Comment” fields. See Stearns II Decl. ¶

19; Tribble Decl. ¶ 9. Such information does not occur because the operators make mistakes, but

rather because consumers intentionally report misconduct involving individuals in their personal

capacity, just as consumers do when submitting complaints on the FTC’s website. See Tribble

Decl. ¶ 9. Indeed, the Consumer Sentinel database does not separate complaints about

individuals from complaints about companies, so telephone operators must enter all complaints

into the fields labeled for alleged corporate wrongdoers. See id.

In addition, Plaintiffs’ focus on the lack of “sensitive” information, such as social

security or credit card numbers, in the Comments Fields is misplaced because Exemptions 6 and

7(C) impose no requirement that the information be especially sensitive or private. See Pls.’

Mem. Opp’n Def.’s Mot. Summ. J. at 41-42. Rather, the only question is whether a privacy

interest is at stake, and as the Court explained above, the personal identifying information

contained in certain data fields implicates such privacy interests. Thus, though it is true that FTC

operators are trained not to enter “sensitive” information, see Tribble Decl. ¶ 9, that fact alone is

irrelevant for purposes of this discussion. Instead, the Court finds that complaints received

through the FTC’s telephone line may contain personal identifying information about alleged

individual wrongdoers to the same degree as complaints filed on the FTC’s website. The Court

41
therefore denies Plaintiffs’ motion for summary judgment as to Counts I and III. Finally, the

Court already has held that the FTC failed to demonstrate that the five-digit zip codes in Count II

must be withheld, so it need not address the issue again here.

F. Withholding Complaints from Foreign Sources under Exemption 3

The FTC invokes FOIA Exemption 3, in conjunction with Section 21(f) of the FTC Act,

see 15 U.S.C. § 57b-2(f)(2)(A)(i) & (ii), to categorically withhold entire complaints provided by

the Canadian Anti-Fraud Centre or furnished through the Ecommerce.gov website. See Def.’s

Mem. Supp. Mot. Summ. J. at 37. FOIA Exemption 3 permits agencies to withhold documents

pursuant to nondisclosure provisions contained in other federal statutes. See 5 U.S.C. §

552(b)(3). The federal statute must require that the information be withheld from the public in

such a way as to leave no discretion on the issue, or it must establish particular criteria for

withholding or refer to specific types of matters to be withheld. See id. “In deciding Exemption

3 applicability, ‘the sole issue for decision is the existence of a relevant statute and the inclusion

of withheld material within that statute’s coverage.’” Carter, Fullerton & Hayes, LLC v. FTC,

637 F. Supp. 2d 1, 10 (D.D.C. 2009) (quoting Goland v. CIA, 607 F.2d 339, 350 (D.C. Cir.

1978)). In addition, the FTC attests, and Plaintiffs do not dispute, that the Canadian Anti-Fraud

Centre and Ecommerce.gov complaints can be segregated from other Consumer Sentinel

database complaints without an unreasonable burden by using custom search filters. See Stearns

Decl. ¶ 20.

Section 21(f), Subsection (i) of the FTC Act provides that the agency is not required to

disclose under FOIA “any material obtained from a foreign law enforcement agency or other

foreign government agency, if the foreign law enforcement agency or other foreign government

agency has requested confidential treatment, or has precluded such disclosure under other use

42
limitations, as a condition of providing the material.” 15 U.S.C. § 57b-2(f)(2)(A)(i). Here, the

FTC seeks to categorically withhold complaints that were provided by the Canadian Anti-Fraud

Centre, which is a Canadian law enforcement agency. See Stearns Decl. ¶ 18. The FTC permits

the Canadian Anti-Fraud Centre to access existing complaints and to submit new complaints into

the database pursuant to the “Consumer Sentinel Network Confidentiality and Data Security

Agreement.” See id.

This confidentiality agreement provides that “[a]ll parties participating in the information

exchange system do so with the understanding that all Consumer Sentinel [database]

information, including all information available on the Consumer Sentinel [database]’s restricted

website, will be kept confidential.” Stearns II Decl., Ex. B. ¶ 5. In addition, under the agreement

the FTC agrees that

[e]xcept as authorized by law, … the information contained in the Consumer
Sentinel [database] will not be released to anyone other than participating
agencies and other entities as delineated in this agreement, and to employees of
and consultants and contractors of such entities and of the FTC with a need to
know such information.

Id. ¶ 7. Plaintiffs, relying on the “except as authorized by law” language, argue that the

agreement does not require the FTC to keep information confidential in all circumstances.

Though perhaps true, Plaintiffs’ argument fails because Subsection (i) does not require

mandatory confidentiality in all circumstances; instead, the statute permits withholding records

whenever the foreign agency “has requested confidential treatment.” 15 U.S.C. § 57b-

2(f)(2)(A)(i). Thus, given the unambiguous language of the agreement, the Court finds that the

Canadian Anti-Fraud Centre indeed has requested such treatment. Accordingly, the Court grants

summary judgment for the FTC on the basis that consumer complaints provided by the Canadian

Anti-Fraud Centre must be withheld under Exemption 3.

43
 The FTC also argues that complaints in the Consumer Sentinel database which were

derived through the Ecommerce.gov website are protected from disclosure under Exemption 3

and Section 21(f) of the FTC Act. See Def.’s Mem. Supp. Mot. Summ. J. at 38. Specifically,

Section 21(f), Subsection (iii) provides that in response to a FOIA request, the FTC is not

required to disclose “any material reflecting a consumer complaint submitted to a Commission

reporting mechanism sponsored in part by foreign law enforcement agencies or other foreign

government agencies.” 15 U.S.C. § 57b-2(f)(2)(A)(iii). In response, Plaintiffs concede that

Ecommerce.gov is a joint international effort for gathering consumer complaints, and as such,

those complaints must be withheld under Exemption 3. See Pls.’ Mem. Opp’n Def.’s Mot.

Summ. J. at 42. Accordingly, the Court grants summary judgment for the FTC on this issue.

G. Count IV: Reasonableness of Cost Estimates for Processing FOIA Requests

During the course of Plaintiffs’ three FOIA requests, the FTC provided four cost

estimates for processing information contained in the granted data fields across the twenty

million complaints in the Consumer Sentinel database:

Table 7
Number of Fields Estimated Estimated
Date of Estimate Source
Requested Time Cost
Rushen Decl. ¶ 6; Stearns Decl.
April 25, 2013 17 data fields 32 hours $3,982.40
¶ 9 & Ex. C
May 6, 2013 33 data fields Unknown $4,978 AR at 12-14
Rushen Decl. ¶ 10; Stearns
September 9, 2013 20 data fields 65 hours $8,581.95
Decl., Ex. K; AR at 195
Rushen Decl. ¶¶ 11-12; Stearns
September 18, 2013 11 data fields 65 hours $8,581.95
Decl., Exs. R, S; AR at 211

In Count IV, Plaintiffs contend that the agency’s estimates appear disproportionate to the effort

necessary to locate and process the data, see Am. Compl. ¶ 95, and they suggest that the

estimates are facially unreasonable because there is no correlation between the price quote and

the quantity of information being processed. See Pls.’ Mem. Opp’n Def.’s Mot. Summ. J. at 46-

44
47. The FTC moves for summary judgment on the basis that its cost estimates were reasonable

given the scope of Plaintiffs’ requests. See Def.’s Mem. Supp. Mot. Summ. J. at 39-41.

1. Plaintiffs’ Evidentiary Objection

Before reaching the merits of the FTC’s motion, the Court must address Plaintiffs’

evidentiary objection to the declarations provided by the FTC in defense of its cost estimates.

See Pls.’ Mem. Opp’n Def.’s Mot. Summ. J. at 48. Rule 56 allows a party opposing summary

judgment to “object that the material cited to support or dispute a fact cannot be presented in a

form that would be admissible in evidence.” Fed. R. Civ. P. 56(c)(2); Ali v. D.C. Gov’t, 810 F.

Supp. 2d 78, 83 (D.D.C. 2011). At the summary judgment stage, a party is not required to

produce evidence in a form that is admissible, but rather the evidence must be capable of being

converted into admissible evidence at trial. See Gleklen v. Democratic Cong. Campaign Comm.,

Inc., 199 F.3d 1365, 1369 (D.C. Cir. 2000); see also Richards v. Option One Mortg., No. 08 Civ.

0007, 2009 WL 2751831, at *1 n.3 (D.D.C. 2009) (explaining that hearsay statements may be

converted into admissible evidence if a witness with personal knowledge can testify to them at

trial). Thus, hearsay “counts for nothing” when used to support or oppose a motion for summary

judgment, unless it satisfies the evidentiary standard of Rule 56. See Gleklen, 199 F.3d at 1369.

Here, Plaintiffs object to the FTC’s use of the Stearns and Rushen declarations as

evidence to demonstrate the reasonableness of the September 9 and September 18, 2013, cost

estimates from Lockheed Martin. See Pls.’ Mem. Opp’n Def.’s Mot. Summ. J. at 48.

Specifically, Plaintiffs argue that the FTC only attached to the declarations emails in which a

different FTC employee reports to the declarant about his communication with the contractor, as

opposed attaching an email showing the employee’s direct communication with the contractor

45
itself. See Rushen Decl. ¶¶ 10-12 (citing Stearns Decl., Exs. K, R, S). Plaintiffs therefore assert

that the declarations rely on hearsay as the basis of their information.

In Barnard v. U.S. Department of Homeland Security, the plaintiff made a similar

argument for excluding certain statements as inadmissible hearsay because the declarants were

told information, rather than obtaining the information from their own review of relevant

documents. See 598 F. Supp. 2d 1, 19 (D.D.C. 2009). The Court rejected this argument because

“FOIA declarants may include statements in their declarations based on information they have

obtained in the course of their official duties.” Id. (citations omitted); see also, e.g., Thompson v.

Exec. Office for U.S. Attorneys, 587 F. Supp. 2d 202, 208 n.4 (D.D.C. 2008) (finding declaration

admissible when it was based on an individual’s “review of [the defendant-agency’s] official

files and records, [her] own personal knowledge, and the information [she] acquired in

performing her official duties”); Hornes v. Exec. Office for U.S. Attorneys, No. 04-2190, 2007

WL 1322088 at *4 (D.D.C. May 4, 2007) (“[The declarant’s] statements are based on his

personal knowledge, his review of [the agency’s] official files and records and information that

he acquired in performing [his] official duties…. Declarations provided by similarly situated

officials have long been recognized as acceptable in FOIA cases.” (internal citation and

quotation marks omitted)).

Stearns and Rushen clearly attest that the statements in the declarations are based on

personal knowledge acquired through the performance of their official duties with the FTC. See

Stearns Decl. ¶ 2; Rushen Decl. ¶ 1. Indeed, the internal FTC correspondences regarding the

contractor’s cost estimates, which are attached to the Stearns declaration, demonstrate as much.

See Stearns Decl., Exs. K, R, S. Accordingly, the Court denies Plaintiffs’ hearsay objection

because the declarations satisfy the requirements of FOIA and Rule 56.

46
 2. Reasonableness of the Cost Estimate

Generally, a FOIA requester must pay reasonable costs for the search, review, and

duplication of the records it seeks. See 5 U.S.C. § 552(4)(A)(ii)(I); Judicial Watch, Inc. v. U.S.

Dep’t of Transp., No. CIV. 02-566, 2005 WL 1606915, at *3 (D.D.C. July 7, 2005). “A

plaintiff’s bare allegation that a fee assessment is unreasonable, however, is insufficient to avoid

summary judgment.” Hall & Assocs. v. EPA, No. CV 13-830, 2014 WL 400677, at *4 (D.D.C.

Feb. 4, 2014) (citing Nat’l Treas. Empl. Union v. Griffin, 811 F.2d 644, 650 (D.C. Cir. 1987)).

Instead, a plaintiff must offer “specific analysis” to demonstrate that the requested fees are

unreasonable. Rosenberg v. U.S. Dep’t of Immigration & Customs Enforcement, 954 F. Supp. 2d

1, 12 (D.D.C. 2013).

Plaintiffs attempt to demonstrate the unreasonableness of the cost estimates through the

lack of correlation between the number of fields to be processed in response to a specific request

and the estimated cost of producing the data. See Pls.’ Mem. Opp’n Def.’s Mot. Summ. J. at 47.

As Table 7, supra, illustrates, it is true that a decrease in the number of fields requested did not

always result in a corresponding decrease in the estimated processing cost. For example, the

contractor provided the same estimate for the September 9 request that involved twenty data

fields as it did for the September 18 request that included eleven data fields. See Tbl. 7, supra.

Plaintiffs, however, provide no explanation suggesting why the processing cost must

directly correlate with the quantity of data fields to be produced. Though such a relationship

may appear plausible, it is just as likely that other factors remain in play which prevent a direct

correlation between the number of data fields and the processing cost. But even more fatally,

Plaintiffs offer no evidence to support their theory, and it is well established that a lawyer’s

argument does not substitute for admissible evidence in opposition to a summary judgment

47
motion. See Tom Sawyer Prods., Inc. v. Progressive Partners Achieving Solutions, Inc., 550 F.

Supp. 2d 23, 29 (D.D.C. 2008). Thus, not only do Plaintiffs fail to offer “specific analysis … to

demonstrate [that] the requested fees are unreasonable,” Rosenberg, 954 F. Supp. 2d at 12, they

provide no admissible evidence rebutting the FTC’s motion for summary judgment. See Johnson

v. Digital Equip. Corp., 836 F. Supp. 14, 15 (D.D.C. 1993) (explaining that speculation or bald

allegations in the absence of actual evidence is insufficient to defeat a summary judgment

motion); see also Int’l Distrb. Corp. v. Am. Dist. Tel. Co., 569 F.2d 136, 139 (D.C. Cir. 1977)

(“[A] party may not avoid summary judgment by mere allegations unsupported by affidavit.”).

Accordingly, the Court grants summary judgment for the FTC on Count IV. 13

V. CONCLUSION

For the foregoing reasons, the FTC’s motion is GRANTED IN PART AND DENIED

IN PART, and Plaintiffs’ motion is DENIED. An order consistent with this Memorandum

Opinion is separately and contemporaneously issued.

Dated: September 30, 2014 RUDOLPH CONTRERAS
United States District Judge

13
The FTC notes that Plaintiffs challenge cost estimates that were not subject to the
administrative appeals process. See Def.’s Reply Supp. Mot. Summ. J. at 22 n.16. But because
the Court finds that Plaintiffs have not demonstrated the unreasonableness of any quote, the
FTC’s argument is moot.

48