Civil Beat Law Center for the Public Interest, Inc . v. Centers for Disease Control & Prevention

FOR PUBLICATION
UNITED STATES COURT OF APPEALS
FOR THE NINTH CIRCUIT
C IVIL B EAT LAW C ENTER FOR THE
P UBLIC INTEREST, INC .,
Plaintiff-Appellant,
v.
C ENTERS FOR D ISEASE C ONTROL &
P REVENTION,
Defendant-Appellee.
No. 16-16960
D.C. No.
1:16-cv-00008-
JMS-KSC
OPINION
Appeal from the United States District Court
for the District of Hawai’i
J. Michael Seabright, Chief District Judge, Presiding
Argued and Submitted October 9, 2018
Honolulu, Hawai’i
Filed July 10, 2019
Before: Kim McLane Wardlaw, Marsha S. Berzon,
and Johnnie B. Rawlinson, Circuit Judges.
Opinion by Judge Berzon

-- 1 of 26 --

2 C IVIL B EAT LAW C TR . V. CDC
SUMMARY*
Freedom of Information Act
In a case involving disclosures under the Freedom of
Information Act (“FOIA”), the panel dismissed as moot that
part of the appeal pertaining to the disclosure of the specific
regulatory violations and vacated those portions of the
district court’s order; affirmed the district court’s grant of
summary judgment as to the withholding under FOIA
Exemption 6 of the identity and contact information of
certain Centers for Disease Control & Prevention (“CDC”)
employees; reversed the district court’s grant of summary
judgment to the CDC on a Public Health Security and
Bioterrorism Preparedness and Response Act of 2002
(“BPRA”) public endangerment exemption; and remanded
to the district court for further proceedings.
Plaintiff sought disclosure under FOIA of two
documents from the CDC concerning its inspection of the
University of Hawaii’s biolab. CDC provided redacted
versions of the requested records.
FOIA Exemption 6 allows agencies to withhold
personnel and medical files that would constitute an
unwarranted invasion of privacy. FOIA Exemption 3
applies to any material that is specifically exempted from
disclosure by statute. BPRA exempts certain federal
agencies from disclosing specified types of information
* This summary constitutes no part of the opinion of the court.
It has been prepared by court staff for the convenience of the reader.

-- 2 of 26 --

C IVIL B EAT LAW C TR . V. CDC 3
regarding biological agents and toxins in response to a FOIA
request.
Concerning Exemption 3, the panel held as an initial
matter that BPRA was a qualifying statute under Exemption
3. The CDC relied on two enumerated BPRA exemptions to
justify the redactions in the requested information: the site-
specific exemption and the public endangerment exemption.
The panel held that it did not have jurisdiction to address the
CDC’s redactions of the specific regulatory violations found
at the biolab, that were justified under BPRA’s site-specific
exemption, because plaintiff’s claims are moot. Turning to
the BPRA public endangerment exemption, the panel held
that Congress intended the public endangerment
determination to be made on a case-by-case basis. The panel
further held that on the current record, the CDC did not
justify its complete withholding of identity and location
information, and the district court erred in granting summary
judgment to the agency. The panel also held that plaintiff
was not entitled to judgment as a matter of law on its cross-
motion for summary judgment. The panel remanded for
further proceedings on this issue.
Concerning Exemption 6, the panel held that the CDC
satisfied its burden of establishing a nontrivial privacy
interest, and plaintiff provided no reason why disclosure of
CDC employees’ identities and contact information would
further the public interest. The panel concluded, therefore,
that the CDC’s withholding of this information under
Exemption 6 was proper.

-- 3 of 26 --

4 C IVIL B EAT LAW C TR . V. CDC
COUNSEL
R. Brian Black (argued), Civil Beat Law Center for the
Public Interest Inc., Honolulu, Hawaii, for Plaintiff-
Appellant.
Anne Murphy (argued) and Matthew Collette, Appellate
Staff; Kenji M. Price, United States Attorney; Civil
Division, United States Department of Justice, Washington,
D.C.; for Defendant-Appellee.
OPINION
BERZON, Circuit Judge:
Anonymous letters containing deadly anthrax spores
were mailed to several media companies and congressional
offices in September 2001. Five individuals were killed;
seventeen others were sickened. U.S. Dep’t of Justice,
Amerithrax Investigative Summary 1–3 (2010),
https://www.justice.gov/archive/amerithrax/docs/amx-inves
tigative-summary.pdf. In the wake of these attacks, Congress
moved “to improve the ability of the United States to
prevent, prepare for, and respond to bioterrorism and other
public health emergencies.” H.R. Rep. No. 107-481, at 1
(2002) (Conf. Rep.), reprinted at 2002 U.S.C.C.A.N. 464,
464. The resulting legislation is the Public Health Security
and Bioterrorism Preparedness and Response Act of 2002
(BPRA), Pub. L. No. 107-188, 116 Stat. 594 (codified as
amended at scattered sections of 7, 18, 21, 29, 38, 42, and 47
U.S.C.).
Title II of BPRA is directed at improving the safety and
security of dangerous biological agents and toxins located

-- 4 of 26 --

C IVIL B EAT LAW C TR . V. CDC 5
throughout the United States. Toward this goal, BPRA
directed the federal Department of Health and Human
Services (HHS) to “establish and maintain a list of each
biological agent and each toxin that has the potential to pose
a severe threat to public health and safety,” 42 U.S.C.
§ 262a(a)(1)(A), and to create a system for “registration with
[HHS] of the possession, use, and transfer of listed agents
and toxins,” id. § 262a(d)(1). Registered entities must
comply with “appropriate safeguard[s] [established by HHS]
. . . for persons possessing, using, or transferring a listed
agent or toxin.” Id. § 262a(e)(1).
In addition to these safeguards, BPRA exempts certain
federal agencies from disclosing specified types of
information regarding biological agents and toxins in
response to a Freedom of Information Act (FOIA) request.
See id. § 262a(h)(1). Relying on this exemption, the Centers
for Disease Control and Prevention (CDC) withheld
information from a FOIA response pertaining to a biological
research laboratory (“biolab”) located at the University of
Hawai’i. Much of the withheld information was already
publicly available. The primary question before us is
whether the CDC properly refused to disclose the requested
information.
I
The University of Hawai’i at Mānoa (UH) maintains a
biolab that is “the only facility of its kind for researchers in
the entire State.” UH publicizes the biolab’s location at “the
Biosciences Building” on “the Kaka‘ako campus, near
downtown Honolulu.” Facilities, Dep’t Tropical Med., Med.
Microbiology & Pharmacology, http://manoa.hawaii.edu/tr
opicalmedicine/?page_id=925 (last updated June 20, 2014).
According to the UH website, researchers at the UH biolab
study a number of highly dangerous biotoxins, including

-- 5 of 26 --

6 C IVIL B EAT LAW C TR . V. CDC
botulinum neurotoxins, the Ebola virus, Tetrodotoxin,
Brucella abortus, Brucella melitensis, Brucella suis,
Burkholderia pseudomallei, Burkholderia pseudomallei, the
Nipah virus, Ralstonia solanacearum, and Xanthomonas
oryzae.
News reports in 2014 revealed that the CDC had
uncovered “widespread regulatory noncompliance” at the
UH biolab, relating to UH’s failure to meet certain standards
for biotoxin safety and security. In response to these reports,
Civil Beat Law Center, a government watchdog group in
Hawai’i, filed a FOIA request with the CDC seeking two
documents: (1) a May 2014 CDC inspection report detailing
the regulatory violations found at the UH biolab; and (2) a
May 2014 letter from the CDC demanding that UH “show
cause” for why the UH biolab’s registration to possess, use,
and transfer biological agents and toxins should not be
suspended or revoked. The CDC denied both requests,
maintaining that the records sought were “specifically
exempted from disclosure by 42 U.S.C. § 262a(h)(1)(C) and
(E).” Civil Beat requested reconsideration, which the CDC
also denied.
Seeking to compel disclosure of the two disputed
documents, Civil Beat filed suit under FOIA. The parties
filed cross-motions for summary judgment, with the CDC
continuing to assert that no disclosure at all of the requested
documents was required.
A few weeks later, the CDC changed positions. In
response to Civil Beat’s motion for summary judgment, the
CDC included redacted versions of the requested records.
The redactions in the newly disclosed documents fell into
three categories:

-- 6 of 26 --

C IVIL B EAT LAW C TR . V. CDC 7
The first two categories of redactions were based on
exemptions found in BPRA. First, the CDC redacted
information concerning the specific regulatory violations
found at UH, asserting that “public disclosure of the redacted
information . . . would endanger public health or safety
because it could assist unauthorized individuals to obtain
illegal access to listed agents.” See 42 U.S.C.
§ 262a(h)(1)(E) (“No Federal agency . . . shall disclose . . .
[a]ny portion of an evaluation or report of an inspection . . .
that identifies the listed agent or toxin possessed by a
specific registered person or that discloses the identity or
location of a specific registered person if the agency
determines that public disclosure of the information would
endanger public health or safety.”). Second, the CDC
redacted all references to UH, its employees, and the
laboratory, because revealing any of that information “would
inform individuals with nefarious intentions of site-specific
weaknesses in the safeguards and/or security measures
employed by the particular registered entity at a particular
location.” See 42 U.S.C. § 262a(h)(1)(C) (“No Federal
agency . . . shall disclose . . . [a]ny portion of a record that
discloses the site-specific or transfer-specific safeguard and
security measures used by a registered person to prevent
unauthorized access to listed agents and toxins.”).
Third, the CDC redacted “[t]he names and telephone
numbers of individual [Division of Select Agents and
Toxins] staff members” who conducted the UH inspection,
based on “the sensitive nature of the select agent information
that these staff members possess and process.” These
redactions were based on FOIA Exemption 6, covering
“personnel and medical files and similar files the disclosure
of which would constitute a clearly unwarranted invasion of
personal privacy.” 5 U.S.C. § 552(b)(6).

-- 7 of 26 --

8 C IVIL B EAT LAW C TR . V. CDC
Unsatisfied, Civil Beat opposed all three categories of
redactions. It also argued, in the alternative, that if the
district court determined that the BPRA exemptions were
possibly applicable, the district court should conduct in
camera review of the unredacted documents to determine
whether the redactions were in fact proper.
The district court granted the CDC’s summary judgment
motion in nearly all respects. Civil Beat Law Ctr. for the Pub.
Interest, Inc. v. CDC, 204 F. Supp. 3d 1132, 1134 (D. Haw.
2016). The court held the redactions justified under BPRA
appropriate, and the withholding of the names and contact
information of CDC employees proper under FOIA
Exemption 6. Id. at 1144–48. Civil Beat timely appealed.
II
Congress enacted FOIA “to pierce the veil of
administrative secrecy and to open agency action to the light
of public scrutiny.” U.S. Dep’t of State v. Ray, 502 U.S. 164,
173 (1991) (quoting Dep’t of Air Force v. Rose, 425 U.S.
352, 361 (1976)). Providing information to the public under
FOIA, it was hoped, would “ensure an informed citizenry,
vital to the functioning of a democratic society, needed to
check against corruption and to hold the governors
accountable to the governed.” NLRB v. Robbins Tire &
Rubber Co., 437 U.S. 214, 242 (1978).
Toward this goal, FOIA “requires federal agencies to
make Government records available to the public, subject to
nine exemptions for specific categories of material.” Milner
v. Dep’t of Navy, 562 U.S. 562, 564 (2011). “These
exemptions are ‘explicitly made exclusive,’ and must be
‘narrowly construed.’” Id. at 565 (citations omitted) (first
quoting EPA v. Mink, 410 U.S. 73, 79 (1973); then quoting
FBI v. Abramson, 456 U.S. 615, 630 (1982)). Given FOIA’s

-- 8 of 26 --

C IVIL B EAT LAW C TR . V. CDC 9
overarching purpose, “the strong presumption in favor of
disclosure places the burden on the agency to justify the
withholding of any requested documents.” Ray, 502 U.S. at
173.
This case concerns two FOIA exemptions, Exemption 3
and Exemption 6. Exemption 3 applies to any material that
is “specifically exempted from disclosure by statute” if, as
relevant here, the statute “establishes particular criteria for
withholding or refers to particular types of matters to be
withheld.” 5 U.S.C. § 552(b)(3)(A)(ii). Exemption 6 allows
agencies to withhold “personnel and medical files and
similar files the disclosure of which would constitute a
clearly unwarranted invasion of personal privacy.” Id.
§ 552(b)(6). We consider each exemption in turn.
A
Exemption 3 does not itself provide the standards for an
exemption from disclosure but instead incorporates other
applicable statutory exemptions. See id. § 552(b)(3)(A)(ii).
We use a two-step inquiry in considering whether
withholding under Exemption 3 is proper. “First, we
determine whether the withholding statute meets the
requirements of Exemption 3. Then, we determine whether
the requested information falls within the scope of the
withholding statute.” Carlson v. U.S. Postal Serv., 504 F.3d
1123, 1127 (9th Cir. 2007).
The parties here agree, correctly, that BPRA is a
qualifying statute under Exemption 3. BPRA exempts
certain federal agencies, including the CDC, from disclosing
certain categories of information relating to biological

-- 9 of 26 --

10 C IVIL B EAT LAW C TR . V. CDC
agents and toxins. See 42 U.S.C. § 262a(h)(1).1 Thus, the
statute “clearly identif[ies] the types of material to be
1 BPRA exempts five categories of information from disclosure:
(A) Any registration or transfer documentation
submitted under [42 U.S.C. § 262a(b) and (c)] for
the possession, use, or transfer of a listed agent or
toxin; or information derived therefrom to the
extent that it identifies the listed agent or toxin
possessed, used, or transferred by a specific
registered person or discloses the identity or
location of a specific registered person.
(B) The national database developed pursuant to
[42 U.S.C. § 262a(d)], or any other compilation of
the registration or transfer information submitted
under [42 U.S.C. § 262a(b) and (c)] to the extent
that such compilation discloses site-specific
registration or transfer information.
(C) Any portion of a record that discloses the site-
specific or transfer-specific safeguard and
security measures used by a registered person to
prevent unauthorized access to listed agents and
toxins.
(D) Any notification of a release of a listed agent or
toxin submitted under [42 U.S.C. 262a(b) and
(c)], or any notification of theft or loss submitted
under such subsections.
(E) Any portion of an evaluation or report of an
inspection of a specific registered person
conducted under [42 U.S.C. 262a(f)] that
identifies the listed agent or toxin possessed by a
specific registered person or that discloses the
identity or location of a specific registered person
if the agency determines that public disclosure of

-- 10 of 26 --

C IVIL B EAT LAW C TR . V. CDC 11
withheld under their scope as required by 5 U.S.C.
§ 552(b)(3), and therefore qualif[ies] as” an Exemption 3
statute. Minier v. CIA, 88 F.3d 796, 801 (9th Cir. 1996).
As to “whether the requested information falls within the
scope of the withholding statute,” Carlson, 504 F.3d at 1127,
the CDC relied on two of the enumerated BPRA exemptions
to justify the redactions in the requested information. First,
the CDC redacted all references to the specific regulatory
violations found at UH, relying on the exemption for “[a]ny
portion of a record that discloses the site-specific or transfer-
specific safeguard and security measures used by a
registered person to prevent unauthorized access to listed
agents and toxins.” 42 U.S.C. § 262a(h)(1)(C). We refer to
this first exemption as the “site-specific exemption.”
Second, the CDC redacted all references to UH and to the
specific lab at issue, reasoning that this information fell
under the exemption for “[a]ny portion of an evaluation or
report of an inspection of a specific registered person . . . that
discloses the identity or location of a specific registered
person if the agency determines that public disclosure of the
information would endanger public health or safety.” Id.
§ 262a(h)(1)(E). We refer to this second exemption as the
“public endangerment exemption.”
1
We begin with the CDC’s redactions of the specific
regulatory violations found at the UH biolab, justified under
BPRA’s site-specific exemption. For the reasons discussed
the information would endanger public health or
safety.
42 U.S.C. § 262a(h)(1).

-- 11 of 26 --

12 C IVIL B EAT LAW C TR . V. CDC
below, we do not have jurisdiction to address these
redactions.
While this appeal was pending, the CDC discovered that
it had, in response to a separate 2015 FOIA request,
disclosed a version of the CDC’s May 2014 letter to UH that
included—without redactions—the regulatory violations
found at UH. Accordingly, the CDC provided Civil Beat
with both the unredacted May 2014 letter and a version of
the inspection report with those regulatory violations
revealed. The CDC contends that this disclosure mooted
Civil Beat’s challenge to the CDC’s redactions of regulatory
violations under § 262a(h)(1)(C). We agree.
Generally, “after the agency produces all non-exempt
documents . . . , the specific FOIA claim is moot because the
injury has been remedied.” Hajro v. U.S. Citizenship &
Immigration Servs., 811 F.3d 1086, 1103 (9th Cir. 2016); see
also Papa v. United States, 281 F.3d 1004, 1013 (9th Cir.
2002). An exception exists, however, when a FOIA
requester alleges “that an agency policy or practice will
impair the party’s lawful access to information in the future.”
Hajro, 811 F.3d at 1103 (quoting Payne Enters., Inc. v.
United States, 837 F.2d 486, 491 (D.C. Cir. 1988)). That
exception has no application here.
Civil Beat’s complaint sought relief only for the FOIA
request at issue—that is, a request for the two specific
documents the CDC had refused to provide. Because the
CDC has now produced versions of the documents revealing
one category of the information Civil Beat sought—the
regulatory violations uncovered at the UH biolab—Civil
Beat’s claim is moot as to that information. See id.; Papa,
281 F.3d at 1013.

-- 12 of 26 --

C IVIL B EAT LAW C TR . V. CDC 13
Civil Beat’s contention that the CDC has not
“abandoned” its interpretation of BPRA does not, on its own,
give rise to a pattern-or-practice claim. To establish such a
claim, a plaintiff must show that “the plaintiff himself has a
sufficient likelihood of future harm by the policy or
practice.” Hajro, 811 F.3d at 1103. A plaintiff’s allegations
that he regularly files FOIA requests with a certain agency
but that agency consistently fails to respond to those requests
in a timely fashion would, for example, support a pattern-or-
practice claim. See id. at 1104. Here, however, apart from
vague allusions in Civil Beat’s briefs to “the next Law
Center request for inspection results,” nothing in the record
suggests that Civil Beat will be affected by the CDC’s
invocation of the site-specific BPRA exemption to FOIA.
“Past exposure to illegal conduct does not in itself show a
present case or controversy regarding injunctive relief . . . if
unaccompanied by any continuing, present adverse effects.”
O’Shea v. Littleton, 414 U.S. 488, 495–96 (1974). Civil
Beat’s claim as to the site-specific exemption is therefore
moot.
Because this mootness “result[ed] from the unilateral
action of the party who prevailed in the lower court,” we
vacate the district court’s decision pertaining to the
redactions CDC justified on the site-specific exemption.
U.S. Bancorp Mortg. Co. v. Bonner Mall P’ship, 513 U.S.
18, 23 (1994); see also United States v. Munsingwear, Inc.,
340 U.S. 36, 39 (1950); All. for the Wild Rockies v. U.S.
Forest Serv., 907 F.3d 1105, 1121 (9th Cir. 2018).2
2 We decline Civil Beat’s invitation to declare that the district court’s
opinion has “no persuasive authority” as to the mooted issues. “No
matter what we conclude, the opinion of the district court will not be
ripped from Federal Supplement [3]d. It will still be available and will

-- 13 of 26 --

14 C IVIL B EAT LAW C TR . V. CDC
2
We turn to the second BPRA exemption at issue—the
public endangerment exemption, under which an agency
may withhold “[a]ny portion of an evaluation or report of an
inspection of a specific registered person . . . that discloses
the identity or location of a specific registered person if the
agency determines that public disclosure of the information
would endanger public health or safety.” 42 U.S.C.
§ 262a(h)(1)(E).3 Relying on this exemption, the CDC
withheld all references to the registered entity—that is, the
University of Hawai’i at Mānoa—as well as the names of
UH’s employees and the location of the specific biolab at
issue.
(a) At this juncture, these redactions seem rather trivial.
It is now publicly known that the biolab is located at the
University of Hawai’i at Mānoa and that researchers use the
biolab to study several biological agents and toxins. The
CDC nonetheless contends that public health and safety
would be endangered were it to publish any information
concerning the “identity or location” of the registered entity
in conjunction with the regulatory violations already
disclosed.
The district court agreed, reasoning that “there is no
exception in [BPRA] allowing the CDC to produce exempt
still be citable for its persuasive weight.” NASD Dispute Resolution, Inc.
v. Judicial Council, 488 F.3d 1065, 1069 (9th Cir. 2007).
3 BPRA refers to “registered persons,” which includes “person[s]
other than . . . individual[s],” as permissible registrants with HHS.
42 U.S.C. § 262a(e)(6)(B); see also 42 C.F.R. § 73.7(a) (discussing
registration for “an individual or entity”). Because the “registered
person” at issue here is a university, we use the term “registered entity.”

-- 14 of 26 --

C IVIL B EAT LAW C TR . V. CDC 15
information that has already entered the public domain
through other means.” Civil Beat Law Ctr., 204 F. Supp. 3d
at 1145. Because the CDC “has never ‘officially
acknowledged’ or made any documented disclosure of the
redacted information,” the district court concluded, “the
CDC has satisfied its burden for redacting any references to
the University of Hawai’i in the Documents.” Id. In reaching
this conclusion, the district court relied on cases establishing
a principle termed the “official-acknowledgment doctrine.”
That doctrine has no application here.
Under the official acknowledgment doctrine, “[i]f the
government has officially acknowledged information, a
FOIA plaintiff may compel disclosure of that information
even over an agency’s otherwise valid exemption claim.”
ACLU v. U.S. Dep’t of Def., 628 F.3d 612, 620 (D.C. Cir.
2011); see also Pickard v. Dep’t of Justice, 653 F.3d 782,
786 (9th Cir. 2011). “For information to qualify as ‘officially
acknowledged,’ it must satisfy three criteria: (1) the
information requested must be as specific as the information
previously released; (2) the information requested must
match the information previously disclosed; and (3) the
information requested must already have been made public
through an official and documented disclosure.” ACLU,
628 F.3d at 620–21. The public availability of the requested
information does not, on its own, trigger application of the
official-acknowledgment doctrine. “[I]nstead, the specific
information sought by the plaintiff must already be in the
public domain by official disclosure.” Id. at 621 (quoting
Wolf v. CIA, 473 F.3d 370, 378 (D.C. Cir. 2007)).
The official-acknowledgment doctrine, however, applies
only as to waiver to an “otherwise valid” assertion of a FOIA
exemption. ACLU, 628 F.3d at 620. In that context, official
acknowledgement functions as a waiver—that is, the

-- 15 of 26 --

16 C IVIL B EAT LAW C TR . V. CDC
government, by officially acknowledging information it
could otherwise have withheld, waives its right to withhold
it. See Wolf, 473 F.3d at 379 (referring to the doctrine as the
“official acknowledgment waiver”). Here, Civil Beat
contests the availability of a FOIA exemption at step one—
that is, it asserts the CDC was not permitted to rely on
BPRA’s exemption for information that “endanger[s] public
health or safety.” 42 U.S.C. § 262a(h)(1)(E). If Civil Beat is
correct that the CDC never had the right to withhold the
requested information in the first place, no waiver concept is
pertinent, and the official-acknowledgment doctrine has no
application.
(b) Our question, then, is simply whether the CDC has
met its burden of showing that the public endangerment
exemption applies. That is, we must determine whether the
CDC correctly “determine[d] that public disclosure of the
information would endanger public health or safety.”
42 U.S.C. § 262a(h)(1)(E).4
4 The CDC argues that we should accord deference to the agency’s
interpretation of the statute, but our case law is to the contrary. We have
explicitly rejected the applicability of “a more deferential, administrative
law standard of review” in determining the scope of an Exemption 3
statute. Carlson, 504 F.3d at 1126–27; see also Lessner v. U.S. Dep’t of
Commerce, 827 F.2d 1333, 1335 (9th Cir. 1987); Long v. IRS, 742 F.2d
1173, 1178 n.12 (9th Cir. 1984). But see Tax Analysts v. IRS, 117 F.3d
607, 613 (D.C. Cir. 1997); Aronson v. IRS, 973 F.2d 962, 965 (1st Cir.
1992). By contrast, we do “accord substantial weight to an agency’s
declarations regarding the application of a FOIA exemption.”
Shannahan v. IRS, 672 F.3d 1142, 1148 (9th Cir. 2012). Still, even if we
were to apply a deferential standard, we would reject the CDC’s
interpretation, for the reasons stated in the text.
We reject the CDC’s contention that special deference is accorded
to agencies in determining the scope of a FOIA exemption relating to

-- 16 of 26 --

C IVIL B EAT LAW C TR . V. CDC 17
The CDC’s essential contention in its briefing to us is
that disclosure of a registered entity’s identity or location
will always endanger public health or safety. That
categorical position cannot be squared with BPRA’s text,
structure, and legislative history. Instead, BPRA requires
that the CDC justify the applicability of the exemption on a
case-by-case basis.
The statute clearly contemplates that, in some
circumstances, disclosure of an identity or location would
not endanger public health or safety. Otherwise, the
qualification that the exemption apply only “if the agency
determines that public disclosure of the information would
endanger public health or safety,” 42 U.S.C.
§ 262a(h)(1)(E), would be meaningless.
Our noncategorical understanding of the public
endangerment exemption is reinforced by the history of the
statute’s enactment. “[W]here ‘the language is ambiguous or
is capable of more than one reasonable interpretation, we
“consult the legislative history, to the extent that it is of
value, to aid in [the] interpretation.”’” United States v. Lyle,
742 F.3d 434, 436 (9th Cir. 2014) (alteration in original)
(quoting United States v. Thompson, 728 F.3d 1011, 1015
(9th Cir. 2013)).
The original version of BPRA, as passed by the House
of Representatives, categorically barred agencies from
disclosing an identity or location of a registered entity. That
national security. As in other FOIA cases, we determine for ourselves
the scope of national security FOIA exemptions but give deference to the
agency’s factual assertions. See Hamdan v. U.S. Dep’t of Justice,
797 F.3d 759, 769 (9th Cir. 2015).

-- 17 of 26 --

18 C IVIL B EAT LAW C TR . V. CDC
version provided that “[a]ny information in the possession of
any Federal agency that identifies a person, or the
geographic location of a person, who is registered pursuant
to regulations under this section . . . shall not be disclosed
under section 552(a) of title 5, United States Code.” H.R.
3448, 107th Cong., § 201(a)(1) (as passed by House, Dec.
12, 2001).5 The version of BPRA ultimately enacted,
however, was less restrictive, allowing for the disclosure of
an identity or location unless that disclosure “would
endanger public health or safety.” 42 U.S.C.
§ 262a(h)(1)(E).
Notably, BPRA’s legislative history speaks directly to
the role of public availability in making a public
endangerment determination. While introducing the
conference report for BPRA, Representative Billy Tauzin,
the chief architect of BPRA, discussed the public
endangerment exemption at length. He noted that the
purpose of the exemption was to “protect site-specific
information on inspection reports, provided that the agency
determines public disclosure would endanger public health
and safety.” 148 Cong. Rec. H2846 (May 22, 2002)
(statement of Rep. Tauzin). “By adding this additional
requirement for inspection documents,” Representative
Tauzin explained, “we are striving to ensure a fair balance
between public accountability and security.” Id. He provided
an example:
When a registered person is publicly known
to be working with select agents, public
disclosure of an inspection report is less
5 This language did not change after the Senate passed an amended
version of the bill. See H.R. 3448, 107th Cong., § 201(a)(1) (as passed
by Senate, Dec. 20, 2001).

-- 18 of 26 --

C IVIL B EAT LAW C TR . V. CDC 19
likely to endanger public health or safety
(provided that security-specific information
is redacted), and may improve it by ensuring
public accountability. But when the activities
of a registered person are not publicly known,
revealing the identity and location of a
registered person would more likely
endanger public health or safety. The
agencies will need to consider such matters
on a case-by-case basis.
Id. (emphasis added).
The CDC’s position in its brief—that it may always
redact the identity or location of a registered entity, even if
the identity or location are publicly known—borders on the
categorical exemption Congress considered and rejected.6
6 At oral argument, the CDC suggested for the first time that
disclosure could be permissible if the requested “evaluation or report of
an inspection” reported a clean bill of health for the registered entity. See
Oral Argument at 21:09–22:10, Civil Beat Law Ctr. for the Pub. Interest,
Inc. v. Ctrs. for Disease Control & Prevention, No. 16-16960 (9th Cir.
Oct. 9, 2018), https://www.ca9.uscourts.gov/media/view_video.php?pk
_vid=0000014323. But the public endangerment concern regarding
disclosure of identity and location of individuals working with toxins
presumably is that knowing where the toxins are and who is working
with them could make it easier to find, take, and use the toxins for
nefarious purposes. That concern does not correlate with whether a
particular laboratory violates rather than follows applicable safety and
use regulations.
Moreover, as this litigation shows, the public interest in
accountability is at its peak when the requested record does contain
regulatory deficiencies. Given that the stated purpose of the exemption
was “to ensure a fair balance between public accountability and
security,” 148 Cong. Rec. H2846 (May 22, 2002) (statement of Rep.
Tauzin), it would make little sense for Congress to prohibit disclosure in

-- 19 of 26 --

20 C IVIL B EAT LAW C TR . V. CDC
Moreover, the CDC offers no explanation for how its
position can be reconciled with Representative Tauzin’s
instruction that “public disclosure of an inspection report is
less likely to endanger public health or safety” when the
requested information is “publicly known” and, to the
contrary, “may improve [public health and safety] by
ensuring public accountability.” 148 Cong. Rec. H2846
(May 22, 2002) (statement of Rep. Tauzin).
In sum, Congress intended the public endangerment
determination to be “consider[ed] . . . on a case-by-case
basis.” Id. That principle applies to publicly available
information as well as to information not known to the
public.
(c) The case-by-case approach under the BPRA public
endangerment exemption is consistent with our general
FOIA requirement that, “[t]o justify withholding, the
government must provide tailored reasons in response to a
FOIA request. It may not respond with boilerplate or
conclusory statements.” Shannahan, 672 F.3d at 1148. Here,
the CDC offered only cursory statements explaining how
public health and safety would be endangered by FOIA
disclosure. These “boilerplate” and “conclusory” statements
did not establish that the CDC conducted an adequate case-
by-case inquiry in reaching its public endangerment
determination.
For example, in a letter responding to Civil Beat’s FOIA
request, the CDC wrote, “While it is clear that you already
know the specific site and the registered person related to
the one circumstance in which the public is best able to hold a registered
entity accountable and allow it categorically where the accountability
interest is minimal.

-- 20 of 26 --

C IVIL B EAT LAW C TR . V. CDC 21
your request, release of further details would hinder the
prevention of unauthorized access to listed agents and
toxins.” No explanation of this conclusion was provided, and
the redactions appear to include the information already
known. Likewise, in an affidavit filed with the district court,
the CDC provided a one-sentence statement:
The fact that Plaintiff may know the identity
and/or location of the registered person does
not render as non-exempt the redacted
information protected by FOIA Exemption 3
and 42 U.S.C. § 262a(h)(1)(C) and/or (E);
nor does it excuse the CDC from its duty not
to disclose information protected by
42 U.S.C. § 262a(h)(1).
That’s it. Nothing further was said to explain why the CDC
redacted the already-known identity and location
information.
The most detailed explanation the CDC offered is
another affidavit, which asserts that “the release of specific
locations (e.g., rooms in a building) where [agents and toxins
are] stored or worked with . . . will increase the risk of
unauthorized access to [agents and toxins] by increasing the
chances that [agents and toxins] will be found when
otherwise lost-in-the-crowd of the larger campus of the
entity.” This explanation may have been plausible, were
more explanation provided, as to redaction of “specific
locations (e.g., rooms in a building).” But, again, the CDC
redacted all references to identity or location, even though
the identity (the University of Hawai’i at Mānoa) and
general location (the on-campus biolab) are both publicly
known. Nothing was said to explain how those broad
redactions protected public health and safety.

-- 21 of 26 --

22 C IVIL B EAT LAW C TR . V. CDC
In sum, the CDC was not entitled to rely on the official-
acknowledgment doctrine, and on the current record, it did
not otherwise justify its complete withholding of identity and
location information. The district court therefore erred in
granting summary judgment to the agency.
(d) Civil Beat cross-moved for summary judgment in its
favor and has appealed the denial of its motion. “[S]ummary
judgment in favor of the FOIA plaintiff is appropriate” only
“[w]hen an agency seeks to protect material which, even on
the agency’s version of the facts, falls outside the proffered
exemption.” Petroleum Info. Corp. v. U.S. Dep’t of Interior,
976 F.2d 1429, 1433 (D.C. Cir. 1992). On the present record,
we cannot conclude that the Civil Beat is entitled to
judgment as a matter of law. See Fed. R. Civ. P. 56(a). For
example, as we have just observed, the record does not
negate the possibility that some of the more detailed redacted
identity and location information is not publicly known and
could, if disclosed, endanger public safety. Further record
development could illuminate this point.
We therefore remand to the district court for further
proceedings consistent with the principles outlined here. See
Animal Legal Def. Fund v. U.S. Food & Drug Admin.,
836 F.3d 987, 990 (9th Cir. 2016) (en banc) (per curiam).
We emphasize that the CDC will be able justify withholding
some of the identity and location information only if it
“provide[s] tailored reasons,” not “boilerplate or conclusory
statements,” for doing so. Shannahan, 672 F.3d at 1148.
B
In addition to information concerning the identity and
location of the UH biolab, Civil Beat also sought the
disclosure of parts of the requested documents that revealed
the names and contact information of the CDC employees

-- 22 of 26 --

C IVIL B EAT LAW C TR . V. CDC 23
who conducted the 2014 inspection. The CDC maintains that
this information comes within FOIA Exemption 6, which
provides that FOIA “does not apply to . . . personnel and
medical files and similar files the disclosure of which would
constitute a clearly unwarranted invasion of personal
privacy.” 5 U.S.C. § 552(b)(6).
To determine whether disclosure would result in a
“clearly unwarranted invasion of personal privacy,” we
“must balance the public interest in disclosure against the
interest Congress intended the [e]xemption to protect.” U.S.
Dep’t of Def. v. Fed. Labor Relations Auth., 510 U.S. 487,
495 (1994) (alteration in original) (quoting U.S. Dep’t of
Justice v. Reporters Comm. for Freedom of Press, 489 U.S.
749, 776 (1989)).
Balancing these interests involves two steps. “First, we
evaluate the personal privacy interest at stake to ensure ‘that
disclosure implicates a personal privacy interest that is
nontrivial or . . . more than [] de minimis.’” Cameranesi v.
U.S. Dep’t of Def., 856 F.3d 626, 637 (9th Cir. 2017)
(alterations in original) (quoting Yonemoto v. Dep’t of
Veterans Affairs, 686 F.3d 681, 693 (9th Cir. 2012),
overruled on other grounds by Animal Legal Def. Fund,
836 F.3d 987). “Disclosures that would subject individuals
to possible embarrassment, harassment, or the risk of
mistreatment”—including disclosures of an individual’s
identity—“constitute nontrivial intrusions into privacy under
Exemption 6.” Cameranesi, 856 F.3d at 638.
Second, “the requester ‘must show that the public
interest sought to be advanced is a significant one and that
the information [sought] is likely to advance that interest.’”
Id. at 637 (alteration in original) (quoting Lane v. Dep’t of
Interior, 523 F.3d 1128, 1137 (9th Cir. 2008)). For this
second step, “the only relevant ‘public interest in disclosure’

-- 23 of 26 --

24 C IVIL B EAT LAW C TR . V. CDC
to be weighed in this balance is the extent to which
disclosure would serve the ‘core purpose of the FOIA,’
which is ‘contribut[ing] significantly to public
understanding of the operations or activities of the
government.’” Fed. Labor Relations Auth., 510 U.S. at 495
(alteration in original) (emphases omitted) (quoting
Reporters Comm., 489 U.S. at 775).
Civil Beat argues that the CDC’s employees will not be
subject to embarrassment or harassment because their
identities are already publicly available. As Civil Beat points
out, the CDC maintains a public directory of the employees
in the Division of Select Agents and Toxins, the office
responsible for inspections, and identifies those employees
as “inspectors.” We disagree.
Whether disclosure of an individual’s identity may result
in embarrassment, harassment, or risk of mistreatment
depends on context. We have previously recognized, for
example, that “[government] agents retain an interest in
keeping private their involvement in investigations of
especially controversial events.” Lahr v. Nat’l Transp.
Safety Bd., 569 F.3d 964, 977 (9th Cir. 2009); see also Forest
Serv. Emps. for Envtl. Ethics v. U.S. Forest Serv., 524 F.3d
1021, 1026 (9th Cir. 2008). Here, providing the identities of
CDC employees in a public directory is somewhat different
from disclosing the identities of the specific CDC employees
who have knowledge of particular vulnerabilities involving
dangerous biological agents and toxins at a single biolab,
vulnerabilities that have garnered attention from the press
and the public. The CDC notes that, as a result of the
inspection, the employees “have knowledge of . . . highly
sensitive, national security records.” That knowledge, the
CDC explains, may result in the employees “being targeted
by a person with nefarious intentions.”

-- 24 of 26 --

C IVIL B EAT LAW C TR . V. CDC 25
Nor do we agree with Civil Beat that the privacy interests
offered by the CDC are “impermissibly speculative.” “[T]he
invasion of a personal privacy interest may be ‘clearly
unwarranted’ even when the invasion of privacy is far from
a certainty.” Prudential Locations LLC v. U.S. Dep’t of
Hous. & Urban Dev., 739 F.3d 424, 432 (9th Cir. 2013) (per
curiam), abrogated on other grounds by Animal Legal Def.
Fund, 836 F.3d 987. “We have never held that an agency
must document that harassment or mistreatment have
happened in the past or will certainly happen in the future;
rather, the agency must merely establish that disclosure
would result in a ‘potential for harassment.’” Cameranesi,
856 F.3d at 642 (quoting Forest Serv. Emps., 524 F.3d
at 1026). Here, the CDC has provided a detailed affidavit
explaining how the disclosure of its employees’ identities
and contact information could potentially result in an
invasion of privacy.
The threshold for meeting the first prong of the
Exemption 6 inquiry is low—only a “nontrivial or . . . more
than [] de minimis” privacy interest need be shown. Id. at
637 (alterations in original) (quoting Yonemoto, 686 F.3d at
693). With specific knowledge that particular CDC
employees were involved in the UH biolab inspection, a
nefarious person interested in the specific toxins handled at
the UH biolab could choose to focus on those CDC
employees—who would have knowledge of the layout and
security measures at that lab—for harassment or threats.
This additional location-specific risk is sufficient—albeit
barely, in light of the public availability of the names of CDC
employees in the Division of Select Agents and Toxins—to
meet the low, “nontrivial” privacy interest threshold. On this
record, the CDC has satisfied its burden of establishing a
nontrivial privacy interest.

-- 25 of 26 --

26 C IVIL B EAT LAW C TR . V. CDC
As to whether disclosure would “‘appreciably further’
the public’s right to monitor the agency’s action,” Forest
Serv. Emps., 524 F.3d at 1027 (quoting Fed. Labor Relations
Auth., 510 U.S. at 497), Civil Beat has provided no reason
why disclosure of the CDC employees’ identities and contact
information would further this interest. Nor can we conceive
of such a reason. As far as we can determine on this record,
any errors in handling the toxic materials were made by the
UH biolab and discovered by the CDC employees. The CDC
employees have not been accused of any lack of diligence,
and knowing their identity would provide no additional
information about how the inspection was carried out.
Withholding the identities and contact information of the
CDC employees under Exemption 6 was therefore proper.
III
We dismiss as moot that part of the appeal pertaining to
the disclosure of the specific regulatory violations and vacate
those portions of the district court’s order. We affirm the
district court’s grant of summary judgment as to the
withholding under Exemption 6 of the identity and contact
information of CDC employees involved in the UH biolab
inspection. Finally, we reverse the district court’s grant of
summary judgment to the CDC on the BPRA public
endangerment exemption and remand to the district court for
further proceedings consistent with this opinion.
DISMISSED in part, VACATED in part,
AFFIRMED in part, REVERSED in part, and
REMANDED.

-- 26 of 26 --