UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLUMBIA

PUBLIC CITIZEN HEALTH RESEARCH GROUP et al.,

Plaintiffs, Civil Action No. 19-166 (TJK) v.

PATRICK PIZZELLA1 et al.,

Defendants.

STATE OF NEW JERSEY et al.,

Plaintiffs,

v. Civil Action Nos. 19-621 (TJK)

PATRICK PIZZELLA et al.,

Defendants.

MEMORANDUM OPINION

To improve the collection of work-related injury data, the Occupational Safety and

Health Administration, a component of the Department of Labor, requires qualifying employers

to record work-related injuries and illnesses on three standardized forms. At first, OSHA only

occasionally collected these forms from employers, either during on-site inspections or as part of

broader industry surveys. But in May 2016, OSHA issued a new rule requiring employers to

submit them electronically each year.

1 Under Federal Rule of Civil Procedure 25(d), Patrick Pizzella is automatically substituted as a defendant for R. Alexander Acosta. But before the first filing deadline, OSHA announced that employers would be required

only to submit one of the three forms, and it began a rulemaking to formalize this change. And

on January 25, 2019, OSHA issued a final rule titled “Tracking of Workplace Injuries and

Illnesses.” The rule rescinded portions of the 2016 rule, reverting to occasional collection of two

of the forms and continuing the annual, electronic collection of the third.

In response, two sets of plaintiffs, one a group of public health organizations and the

other a series of states, filed related lawsuits, claiming that OSHA’s rulemaking violated the

Administrative Procedure Act because it is arbitrary and capricious. Plaintiffs in both cases

moved for summary judgment. Defendants moved to dismiss the public health organizations’

suit for lack of subject-matter jurisdiction and cross-moved for summary judgment in the suit

brought by the states. For the reasons explained below, the Court will grant Defendants’ motion

to dismiss the public health organizations’ suit for lack of subject-matter jurisdiction because

those plaintiffs have not suffered the required injury to support standing, and grant Defendants’

cross-motion for summary judgment in the states’ suit because the rule is neither arbitrary nor

capricious.

Background

A. Statutory and Regulatory Background

1. The OSH Act

The Occupational Safety and Health Act,

et seq. (the “OSH Act”)

authorizes the Secretary of Labor to promulgate regulations that require employers to “make,

keep and preserve, and make available to the Secretary,” occupational health records.

§ 657(c)(1); see also id. § 657(c)(2) (authorizing the Secretary to issue regulations requiring

employers to “maintain accurate records of, and to make periodic reports on, work-related

deaths, injuries and illnesses”). The Act also provides that, “the Secretary . . . shall develop and

2 maintain an effective program of collection, compilation, and analysis of occupational safety and

health statistics.” Id. § 673(a).

Under this authority, the Occupational Safety and Health Administration (“OSHA”)

requires employers with more than 10 employees to complete three forms documenting

workplace injury and illness. First, Form 300, “Log of Work-Related Injuries and Illnesses,” is

an annual incident log that contains basic information about each incident. Form 301, “Injury

and Illness Incident Report,” provides more narrative details for each incident. Finally, Form

300A, “Summary of Work-Related Injuries and Illnesses,” is an annual summary of all logged

incidents. See

. Historically, employers submitted these forms only upon

request, typically during workplace inspections or through industry-specific surveys.

2. The Electronic Filing Rule

In May 2016, OSHA promulgated a rule (“the Electronic Filing Rule”) requiring

employers with 250 or more employees to electronically submit all three forms annually. See

Improve Tracking of Workplace Injuries and Illnesses,

(May 12, 2016).

The rule also required that in certain industries, employers with only 20 or more employees must

annually submit Form 300A. See

The rule’s preamble specified that collected data would be

published to OSHA’s website.

. OSHA thus determined that with “the information

obtained through this final rule, employers, employees, employee representatives, the

government, and researchers may be better able to identify and mitigate workplace hazards and

thereby prevent worker injuries and illnesses.”

. The Electronic Filing Rule noted

that all data from Form 300A could be made available, but to protect worker privacy, certain

personally identifiable information (PII) would need to be redacted before publishing Forms 300

and 301.

. The rule also noted that software would be used to eliminate PII from

the published forms.

3 OHSA intended the Electronic Filing Rule to come into effect over several years. And

the first deadline—July 1, 2017—would only require employers to submit Form 300A for

calendar year 2016. 81 Fed. Reg. at 29,640. But on June 28, 2017, shortly before this first filing

deadline, OSHA issued a notice of proposed rulemaking (NPRM) to delay the deadline. See

Improve Tracking of Workplace Injuries and Illnesses: Proposed Delay of Compliance Date,

(proposed June 28, 2017). And in November, OSHA published a final rule

delaying the first deadline until December 15, 2017. See Improve Tracking of Workplace

Injuries and Illnesses: Delay of Compliance Date,

(November 24, 2017).

Then, in May 2018—after the first filing deadline had passed—OSHA posted an announcement

on its website, specifying that again for 2017, employers would be expected only to provide

Form 300A. Civil Action No. 19-166, ECF No. 1 (“Public Health Pls. Compl.”), ¶ 22. The

announcement also informed the public that OSHA was not accepting Forms 300 and 301 and

would issue a NPRM to reconsider, revise, or remove provisions of the Electronic Filing Rule.

On July 30, 2018, OSHA issued a NPRM for a rule that would rescind the electronic

filing requirements for Forms 300 and 301. See Tracking of Workplace Injuries and Illnesses,

(proposed July 30, 2018). OSHA proposed the continued electronic collection

of Form 300A, the summary form, but a return to only occasional collection of Forms 300 and

301. OSHA cited several justifications for the proposed rule change: risks to worker privacy, the

relative uncertainty of the benefits that the data in Forms 300 and 301 may provide, and the

opportunity cost of diverting limited resources from other enforcement efforts.

OSHA also

raised several issues for the public to address during the comment period, including the efficacy

of the software intended to remove PII from these forms.

.

4 3. The Revised Rule

On January 25, 2019, OSHA issued its Final Rule (“the Revised Rule”) formally

rescinding the requirement for electronic submission of Forms 300 and 301 but leaving in place

the requirement to submit form 300A. See Tracking of Workplace Injuries and Illnesses,

(January 25, 2019). As the basis for the Revised Rule, OSHA cited worker privacy and

the resources necessary to avoid accidental disclosure of workers’ PII. OSHA noted that while

none of the forms request PII, such information is sometimes inadvertently included alongside

the requested information.

. And OSHA also determined that automated PII-stripping

software could not adequately protect worker privacy. Instead, OSHA concluded, its collection

of Forms 300 and 301 would require a manual review process to eliminate PII and other

contextual information that might allow the re-identification of impacted workers.

.

And even if it employed a costly manual screening process to remove PII, OSHA noted that it

was possible that workers still could be reidentified.

.

Alongside these costs, OSHA also concluded that third-party entities would not benefit

from continued form collection because the data would not be published.

(noting

OSHA had previously “determined publishing the data would do more harm than good” and did

not intend to release it.). OSHA also contended that the “data from Forms 300 and 301 would be

exempt from disclosure under FOIA exemptions.”

. OSHA acknowledged that it may

have to release information due to FOIA requests but suggested that any resulting benefits are

“uncertain.”

Beyond the lack of benefits to outside entities, the Revised Rule also

concluded that any benefits to OSHA itself are “uncertain.” It noted that OSHA has “no prior

experience” using the data collected in Forms 300 and 301 and is “unsure how much benefit such

data would have for [enforcement and outreach] purposes.”

. And it discussed

OSHA’s experience using the data collected from Form 300A for enforcement purposes.

In

5 the end, OSHA “determined that the best use of the agency’s resources at this time is full

utilization of 300A and severe injury data, . . . especially when OSHA itself will continue to

protect workers by accessing Forms 300 and 301 through on-site inspections and for specific

enforcement actions as needed.”

. As a result, OSHA decided to cease electronic

collection of Forms 300 and 301 and instead direct resources towards “enforcement efforts and

compliance assistance, rather than collecting data with uncertain benefits.”

.

B. Plaintiffs’ Lawsuits

In Public Citizen Health Research Group, et al. v. Pizzella, 19-cv-166, plaintiffs are three

public-health advocacy groups: Public Citizen Health Research Group, the American Public

Health Association, and the Council of State and Territorial Epidemiologists (collectively, the

“Public Health Plaintiffs”). The Public Health Plaintiffs assert that they are advocacy groups

engaged in research, education, and advocacy on matters of public health, including issues of

workplace health and safety. They sue the Secretary of Labor, the Department of Labor, and

OSHA, asserting that OSHA’s promulgation of the Revised Rule violates the Administrative

Procedure Act (“APA”),

et seq.2 See Public Health Pls. Compl. ¶¶ 1, 2. More

specifically, they allege that the Revised Rule is arbitrary and capricious because (1) OSHA has

“failed to provide a reasoned explanation for reversing its position”; (2) the Revised Rule is “not

a product of reasoned decision-making”; and (3) OSHA failed to adequately respond to

comments made during rulemaking.

. They ask this Court to vacate the Revised Rule.

.

2 The Public Health Plaintiffs also filed an earlier related suit through which they sought a preliminary injunction requiring OSHA to stop delay of the Electronic Filing Rule’s deadlines and to accept all three forms, which this Court denied. See Pub. Citizen Health Research Group v. Acosta,

(2018) (“Public Citizen I”). Ultimately, the Court dismissed that suit for lack of subject-matter jurisdiction after OSHA promulgated the Revised Rule.

6 The second group of plaintiffs, the State of New Jersey, the State of Illinois, the State of

Maryland, the Commonwealth of Massachusetts, the State of Minnesota, and the State of New

York (collectively, the “State Plaintiffs”) also challenge OSHA’s rescission of the reporting

requirements for Forms 300 and 301. Civil Case No. 19-621, ECF No. 1 (“State Pls. Compl.”),

¶ 2. They argue that the Revised Rule is arbitrary and capricious because (1) OSHA failed to

consider “important aspects of the issue”; (2) OSHA’s explanation for the rule is “contrary to the

evidence that was before them”; (3) OSHA failed to address the benefits of the Electronic Filing

Rule, as raised by commenters; and (4) OSHA failed to provide an “adequately reasoned

explanation” for departure from the Electronic Reporting Rule. Id. ¶¶ 102, 103. For these

reasons, they urge the Court to vacate the rule and order OSHA to implement all aspects of the

Electronic Filing Rule. Id. ¶ 104.

The State Plaintiffs noticed their case as related to the Public Health Plaintiffs’ case, Civil

Case No. 19-621, ECF No. 2, and at the request of the parties, the Court entered a joint

scheduling order, Civil Case No. 19-621, ECF No. 14. Both sets of Plaintiffs moved for

summary judgment. See Civil Case No. 19-166, ECF No. 16 (“Public Health Pls. MSJ”); Civil

Case No. 19-621, ECF No. 18 (“State Pls. MSJ”). In response, Defendants moved to dismiss the

Public Health Plaintiffs’ complaint, and in the alternative, for summary judgment. See Civil

Case No. 19-166, ECF No. 17 (“Defs. MSJ”). They also moved for summary judgment in the

case brought by the State Plaintiffs. Civil Case No. 19-621, ECF No. 20.

Legal Standard

A motion to dismiss under Federal Rule of Civil Procedure 12(b)(1) “presents a threshold

challenge to the court’s jurisdiction.” Haase v. Sessions,

(D.C. Cir. 1987). As

federal courts are courts of limited jurisdiction, it is “presumed that a cause lies outside this

7 limited jurisdiction.” Kokkonen v. Guardian Life Ins. Co.,

(1994). Thus,

when faced with a motion to dismiss under Rule 12(b)(1), “the plaintiff bears the burden of

establishing jurisdiction by a preponderance of the evidence.” Moran v. U.S. Capitol Police Bd.,

(D.D.C. 2011) (citing Lujan v. Defenders of Wildlife,

(1992)). In reviewing such a motion, while the Court is not limited to the allegations in the

complaint and may consider materials outside the pleadings, the Court must “accept all of the

factual allegations in [the] complaint as true.” Jerome Stevens Pharm., Inc. v. FDA,

(D.C. Cir. 2005) (alteration in original) (quoting United States v. Gaubert,

(1991)).

“Summary judgment is appropriately granted when, viewing the evidence in the light

most favorable to the non-movants and drawing all reasonable inferences accordingly, no

reasonable jury could reach a verdict in their favor.” Lopez v. Council on Am.-Islamic Relations

Action Network, Inc.,

(D.C. Cir. 2016). “The evidence presented must show

‘that there is no genuine dispute as to any material fact and the movant is entitled to judgment as

a matter of law.’”

(quoting Fed. R. Civ. P. 56(a)). In an APA case in which both parties have

moved for summary judgment, “the district judge sits as an appellate tribunal” and “[t]he entire

case on review is a question of law.” Am. Bioscience, Inc. v. Thompson,

(D.C. Cir. 2001) (internal quotation marks and footnote omitted). “Summary judgment . . .

serves as the mechanism for deciding, as a matter of law, whether the agency action is supported

by the administrative record and otherwise consistent with the APA standard of review.” Kadi v.

Geithner,

(D.D.C. 2012).

Under the APA, courts must “hold unlawful and set aside” agency action that is

“arbitrary, capricious, [or] an abuse of discretion.”

(2)(A). An agency action is

8 arbitrary and capricious if the agency has “entirely failed to consider an important aspect of the

problem, [or] offered an explanation for its decision that runs counter to the evidence before the

agency.” Motor Vehicle Mfrs. Ass’n of U.S., Inc. v. State Farm Mut. Auto. Ins. Co.,

(1983). The scope of review under the “arbitrary and capricious” standard is narrow and “a

court is not to substitute its judgment for that of the agency.”

Even so, the agency must

articulate a satisfactory explanation for its action including a “rational connection between the

facts found and the choice made.” Burlington Truck Lines v. United States,

(1962). As a result, a court’s review is limited to deciding whether the agency’s “decision was

based on a consideration of the relevant factors and whether there has been a clear error in

judgment.” Ctr. For Auto Safety v. Peck,

, 1342 (D.C. Cir. 1985). The reviewing

court should not attempt to make up for such deficiencies itself: “[A court] may not supply a

reasoned basis for the agency’s action that the agency itself has not given.” Motor Vehicle Mfrs.

Ass’n,

. The court will, however, “uphold a decision of less than ideal clarity if the

agency’s path may reasonably be discerned.” Bowman Transp. Inc. v. Arkansas-Best Freight

System,

(1974).

Analysis

A. Defendants’ Motion to Dismiss the Public Health Plaintiffs’ Complaint for Lack of Standing

The jurisdiction of the federal courts extends only to cases and controversies of the

“justiciable sort referred to in Article III”—in other words, claims the plaintiff can show they

have “standing” to bring. Lujan,

. To satisfy the standing requirement, a plaintiff

must establish at a minimum that (1) he has “suffered an injury in fact—an invasion of a legally

protected interest which is (a) concrete and particularized, and (b) actual or imminent, not

conjectural or hypothetical,” (2) “a causal connection” exists between the injury and the

9 challenged conduct, and (3) a favorable decision will likely redress the injury.

at 560–61

(citations and internal quotation marks omitted).

Defendants argue that the Public Health Plaintiffs lack injury-in-fact and therefore their

complaint should be dismissed for lack of subject-matter jurisdiction. See Defs. MSJ at 11; Fed.

R. Civ. P. 12(b)(1).3 In response, the Public Health Plaintiffs claim that OSHA’s decision to

refrain from collecting and publishing the data from Forms 300 and 301 injures them in two

ways: (1) it “substantially limits the type and amount of workplace injury or information” that is

available to conduct research analyzing illness and injury threats to workers and (2) it impedes

their organizational activities. Civil Action No. 19-166, ECF No. 16-1 (“Carome Decl.”), ¶ 11.

The threshold showing that plaintiffs must make for each element of standing “depends

on the stage of the litigation.” Food and Water Watch, Inc. v. Vilsack,

(D.C.

Cir. 2015). In evaluating the Public Health Plaintiffs’ standing at the motion to dismiss stage,

the Court must presume that they will succeed in their merits claims. See City of Waukesha v.

E.P.A.,

(D.C. Cir. 2003). But the Public Health Plaintiffs must allege facts

satisfying each element of standing to survive a motion to dismiss.

1. Informational Injury

The Public Health Plaintiffs’ first claim is one of informational injury. To establish

informational injury, a plaintiff must show that “1) it has been deprived of information that, on

its interpretation, a statute requires the government or a third party to disclose to it, and 2) it

suffers, by being denied access to that information, the type of harm Congress sought to prevent

by requiring disclosure.” Elec. Priv. Info. Ctr. v. Presidential Advisory Comm’n on Election

3 Defendants do not contest State Plaintiffs’ standing.

10 Integrity,

(D.C. Cir. 2017) (quoting Friends of Animals v. Jewell,

(D.C. Cir. 2016)).

The Public Health Plaintiffs fail to satisfy the first requirement and thus fail to establish

informational injury. First, they must point to a statutory provision that requires disclosure of the

information at issue. See Friends of Animals,

. The Public Health Plaintiffs cite

the Freedom of Information Act (FOIA)—rather than the OSH Act or any similar statute—as the

law that purportedly requires disclosure of the information. Civil Action No. 19-166, ECF No.

19 (“Public Health Pls. Opp.”), at 2. But FOIA does not require the disclosure of any specific

information to anyone; it applies across the entire executive branch to require access to records

when a request has been made and its exemptions are inapplicable. Dep’t of State v. Ray,

(1991). Thus, even if the information at issue is available to the Public Health

Plaintiffs through FOIA, to hold that that FOIA is a statute that satisfies the first requirement for

informational injury would all but eviscerate the requirement. And indeed, the second

requirement—that plaintiffs suffer “the type of harm Congress sought to prevent by requiring

disclosure”—also suggests that the statute at issue must require the disclosure of specific

information. The Public Health Plaintiffs have cited no case in which a court found that FOIA

satisfied the first requirement for informational injury, and in one recent case in this District, the

court specifically rejected that proposition. See Judicial Watch, Inc. v. Office of Dir. of Nat'l

Intelligence, No. 1:17-CV-00508 (TNM),

, at *3 (D.D.C. Mar. 22, 2018)

(finding no informational standing for challenge brought under Intelligence Community

Directive where Plaintiff relied on FOIA for a disclosure requirement).

The Public Health Plaintiffs point to Waterkeeper Alliance v. E.P.A.,

(D.C.

Cir. 2017) to suggest that informational injury can be established where the agency’s

11 information-gathering and information-disclosure obligations arise from different statutes. In

Waterkeeper Alliance, the plaintiffs established informational standing to challenge a rule

promulgated under the Comprehensive Environmental Response, Compensation, and Liability

Act (CERCLA). The rule exempted farms from CERCLA’s requirement that covered entities

report to the government air releases from animal waste, information that then would have

otherwise been reportable by the government to the public under the requirements of the

Emergency Planning and Community Right-to-Know Act (EPCRA).

. The D.C.

Circuit found that the plaintiffs had suffered an informational injury, even though CERCLA

itself contained no public disclosure requirements.

. The Court found that EPCRA’s

disclosure requirements were “expressly tied” to CERCLA, explicitly piggybacking on

CERCLA’s government notification mandates.

That is not the situation here. The OSH Act

and FOIA do not present the same “complex interplay” as the two statutes at issue in

Waterkeepers.

Here, the only potential link between OSH and FOIA is the Electronic Filing

Rule’s preamble, which references FOIA and notes that OSHA would make the data from Forms

300 and 301 available through FOIA requests. 81 Fed. Reg. at 29,658–62. But this non-binding

provision of an agency regulation is far too attenuated a link between these two statutes to

conclude that they are “expressly tied” to each other, or suggest the kind of “complex interplay”

between them that would provide the basis for informational standing. 4 See Friends of Animals,

(finding no informational injury despite statute’s disclosure provision where

4 Plaintiff’s invocation of Envtl. Integrity Project v. McCarthy,

(D.D.C. 2015) fails for similar reasons. There, the challenged regulation was promulgated under a statute that “contained a public disclosure provision that expressly require[d] that any records, reports, or information obtained under the statute . . . shall be available to the public.”

.

12 plaintiffs were suing to enforce a separate provision that did not mandate the disclosure of

information).

The Public Health Plaintiffs also argue that this Court’s decision in Public Citizen I

suggested that their entitlement to the information at issue under FOIA could satisfy the first

informational injury requirement. Not so. The Court merely held, in addressing the

redressability element of standing, that the likelihood that the Public Health Plaintiffs could

obtain the information at issue through FOIA could be part of a casual chain, beginning with a

favorable court decision, that would redress any injury-in-fact they had suffered. See Public

Citizen I,

.

2. Organizational Injury

The Public Health Plaintiffs offer a second injury to support standing: impact on their

organizational activities. Assessing this kind of injury involves a two-part inquiry (1) “whether

the agency’s action or omission to act ‘injured the [organization’s] interest’” and (2) whether

“the organization ‘used its resources to counteract that harm.’” People for the Ethical Treatment

of Animals v. Dep’t. of Agric.,

(D.C. Cir. 2015) (“PETA”) (quoting Equal

Rights Ctr. v. Post Props, Inc.,

(D.C. Cir. 2011)); see also Havens Realty

Corp. v. Coleman,

(1982) (finding organizational injury where there is an

“injury to the organization’s activities” and “[a] consequent drain on the organization’s

resources.”). The Public Health Plaintiffs fail to satisfy this first prong, and thus fail to prove

organizational, and well as informational, standing.

To satisfy the first prong, the organization “must plausibly allege that the challenged

conduct ‘perceptibly impaired [its] ability to provide services’ by causing an ‘inhibition of [the

organization’s] daily operations.’” Texas Low-Income Hous. Information Service v. Carson,

, 52 (D.D.C. 2019) (quoting Food & Water Watch, Inc.,

).

13 “[T]he Court’s task is to differentiate between ‘organizations that allege that their activities have

been impeded’—which suffices for standing purposes—‘from those that merely allege that their

mission has been compromised’—which does not.” Citizens for Responsibility & Ethics in

Washington v. U.S. Office of Special Counsel, No. 19-cv-3757 (JEB),

, at *5

(D.D.C. Aug. 6, 2020) (quoting Abigail All. for Better Access to Developmental Drugs v.

Eschenbach,

, 133 (D.C. Cir. 2006)).

The Public Health Plaintiffs fail to show that the organizations’ daily operations are

“inhibit[ed] . . . in a concrete way” by Defendants’ actions. See Citizens for Responsibility and

Ethics in Washington,

at *5 (D.D.C. August 6, 2020) (citing PETA,

). They allege that they “have lost access to an important source of timely, establishment-

specific information” that is otherwise unavailable, see Public Health Pls. Compl. ¶ 7, but they

have failed to show this deprivation has directly inhibited their daily operations. Nor could they.

The Public Health Plaintiffs essentially argue that they are being deprived of an anticipated

benefit—the data from Forms 300 and 301. And in so doing, they can only describe how they

“intended to use” or “would have used” the data “that would have been available” under the

Electronic Filing Rule. Civil Action No. 19-166, ECF No. 16-2 (“Benjamin Decl.”), ¶ 4;

Carome Decl. ¶ 3; Civil Action No. 19-166, ECF No. 16-3 (“Harrison Decl.”), ¶ 9. This data

never played a role in the Public Health Plaintiffs’ ability to provide services or their daily

operations. Thus, the Revised Rule, which effectively withholds this data from them, could not

have perceptively impaired their ability to provide those services or inhibited those daily

operations. And the Public Health Plaintiffs do not point to any case in which a court has held

that an organization’s interest suffered injury for standing purposes in a similar situation.

14 For similar reasons, the Public Health Plaintiffs have not shown that they meet the second

prong of the organizational standing test: that they expended resources to counteract their alleged

injuries. To satisfy this requirement, an organization must expend resources in response to the

impairment of its ability to provide services. Litigation or advocacy expenses do not satisfy this

requirement. See Food & Water Watch,

(“Our precedent makes clear that an

organization’s use of resources for litigation, investigation in anticipation of litigation, or

advocacy is not sufficient to give rise to an Article III injury.”). And a plaintiff organization

“cannot convert its ordinary program costs into an injury in fact.” Nat’l Taxpayers Union, Inc. v.

United States,

(D.C. Cir. 1995).

Each of the Public Health Plaintiffs claim that the loss of data they would have received

from Forms 300 and 301 will set back their efforts, but none assert that they spent any money to

counteract this harm. See Carome Decl. ¶ 11 (concluding OSHA’s rescission of the Electronic

Filing Rule substantially curtails the type and amount of workplace injury data HRG will be able

to use to conduct research); Benjamin Decl. ¶ 6 (explaining without this data it is significantly

harder to identify workplace hazards and to develop policies accordingly); Harrison Decl. ¶ 9

(alleging the 2019 Final Rule has caused CTSE and its members to lose access to an important

source of injury and illness information). Instead, they represent that their failure to receive this

data will require them to “continue to use data available from other sources, [but] such data is not

as complete and is more difficult to gather.” Public Health Pls. Opp. at 8. But simply

maintaining their current operational costs cannot help them stablish organizational injury. See

Nat’l Taxpayers Union,

(finding no injury without any evidence that

organization was subject “to operational costs beyond those normally expended”). Thus, they

15 have failed to show the “consequent drain on the organization’s resources” necessary to establish

organizational injury. Havens Realty Corp.,

.

Since the Public Health Plaintiffs have failed to show an impairment of their ability to

provide services, nor expenditures to counteract that impairment, they do not have an injury to

support organizational standing. Thus, the Court must dismiss their complaint for lack of

subject-matter jurisdiction.5

B. Defendants’ and the State Plaintiffs’ Motions for Summary Judgment on the State Plaintiffs’ APA Claim

The State Plaintiffs argue that the Revised Rule violates APA for three broad reasons: (1)

OSHA’s calculation of the costs of collecting Forms 300 and 301 was arbitrary and capricious;

(2) OSHA’s calculation of the benefits of collecting Forms 300 and 301 was also arbitrary and

capricious; and (3) OSHA’s reasoning was internally consistent regarding the Revised Rule’s

costs and benefits.

1. OSHA’s Assessment of the Costs of Collecting Forms 300 and 301

A. Changes to OSHA’s Privacy Risk Assessment

First, the State Plaintiffs argue that OSHA’s privacy risk assessment in the Revised Rule

is “contrary to the evidence before the agency and not supported by sufficient reasoning.” State

Pls. MSJ at 18. And it is true that agency action “based on a factual premise that is flatly

contradicted by the agency’s own record does not constitute reasoned administrative

decisionmaking, and cannot survive review under the arbitrary and capricious standard.” City of

5 The Public Health Plaintiffs point out that in Public Citizen I, in denying Defendants’ motion to dismiss for lack of subject-matter jurisdiction, this Court found that they had organizational standing to pursue substantially similar claims, a ruling at odds with the one here. Public Citizen I,

. The Court notes that for whatever reason, Defendants in that case only contested redressability and not injury-in-fact, so the Court did not have the benefit of the briefing on the injury-in-fact requirement that the parties have provided here. And in any event, that case was eventually dismissed for lack of subject-matter jurisdiction on other grounds.

16 Kansas City, Mo. v. Dep’t of Hous. & Urban Dev.,

(D.C. Cir. 1991). State

Plaintiffs argue that the change in how OSHA treated privacy risks from the Electronic

Reporting Rule to the Revised Rule is evidence of such contradiction. See Civil Action No. 19-

166, ECF No. 1 (“State Pls. Compl.”), ¶ 103; see also Ass’n of Priv. Sector Colls. & Univs. v.

Duncan,

(D.C. Cir. 2012) (“An agency’s departure from past practice can . . .

if unexplained, render regulations arbitrary and capricious.”). And the State Plaintiffs note that

“OSHA carefully considered [privacy issues] when it promulgated the Electronic [Filing] Rule in

2016” and “identified numerous actions it would take” to mitigate privacy concerns. State Pls.

MSJ at 16. They insist that the Revised Rule “cites no new evidence” to support OSHA’s

“abrupt change of position.” Id. at 17. For that reason, the State Plaintiffs argue, this new

position is insufficiently justified and contrary to the evidence before the agency. Id.

But the Revised Rule’s conclusion about the privacy risks at stake is not based on a

factual premise “flatly contradicted by the agency’s own record.” City of Kansas City,

. Both the Electronic Filing Rule and the Revised Rule reflect OSHA’s concern with the

privacy risks associated with the collection of Forms 300 and 301. Compare 81 Fed. Reg. at

29,632 with 84 Fed. Reg. at 385. The Revised Rule merely reflects a change in the level of risk

to privacy that OSHA found acceptable, rather than new information about those risks. And, for

what it’s worth, OSHA characterized that change as merely “restor[ing] OSHA’s historical

emphasis on protecting the privacy of workers and its longstanding practice of releasing sensitive

data on a case-by-case basis only to those with a ‘need to know.’” See 84 Fed. Reg. at 384. The

State Plaintiffs evidently disagree with that change. But that hardly makes OSHA’s changed

position contrary to the record before it.

17 In addition, despite the State Plaintiffs’ suggestions otherwise, OSHA need not meet a

special burden to adjust the level of risk to privacy that it found acceptable. See F.C.C. v. Fox

Television Stations, Inc.,

(2009) (there is “no basis in the Administrative

Procedure Act or in [Supreme Court] opinions for a requirement that all agency change be

subjected to more searching review.”). Of course, an agency should “display awareness that [the

agency] is changing position,” but “the APA imposes no special burden when an agency elects to

change course.” Home Care Ass’n of Am. v. Weil,

, 1094–95 (D.C. Cir. 2015).

But the Revised Rule acknowledges that OSHA changed its position about the level of risk to

privacy it found acceptable. Indeed, the Revised Rule describes how “OSHA considered the

issue of worker privacy in the 2016 final rule and included protections to reduce the likelihood of

sensitive information being made public.” 84 Fed. Reg. at 385. But OSHA concluded that it “no

longer views such protections as sufficient,” given the effectiveness of PII-removing software, as

well as the risk of reidentification. Id.

Similarly, the State Plaintiffs’ argument that OSHA must provide “a more detailed

justification than what would suffice for a new policy created on a blank slate” because the “new

policy rests upon factual findings that contradict those which underlay its prior policy” fails. Fox

Television,

. As already discussed, the Revised Rule does not stem from new

factual findings, but a change in the level of risk to privacy that the agency found acceptable.

Thus, it is enough that OSHA has shown awareness of and a reasoned explanation for its change.

See Home Care Ass’n,

.

B. OSHA’s Privacy Standard

Next, the State Plaintiffs argue that OSHA’s determination that manual review of Forms

300 and 301 is required is unsupported by the record in two ways. State Pls. MSJ at 18. They

18 contend that OSHA adopted a standard for handling PII that is a “100 percent privacy

guarantee[]” and that is “an unreasonable and unrealistic standard for any entity to set.” Id. at

19. They also assert that the record does not support OSHA’s privacy concerns nor the need for

a two-tiered manual review process. Id. Of course, if OSHA’s action is arbitrary, capricious,

and unsupported by the record, it would violate the APA. See

. But it complies

with the statute if is supported by “such relevant evidence as a reasonable mind might accept as

adequate” to do so. See Sage IT, Inc. v. Cissna,

(D.D.C. 2018)

(quoting Consolo v. Fed. Mar. Comm’n,

(1966)).

To begin with, OSHA did not, as the State Plaintiffs say, require the manual review of

Forms 300 and 301 to reduce the privacy risk to zero. Instead, the comments that the State

Plaintiffs string together in their brief merely reflect that OSHA considered the relevant privacy

risks. See 84 Fed. Reg. at 385 (“Although OSHA previously thought to address this issue with

software, de-identification software is not 100% effective, and OSHA believes that some PII

could be released even after being processed through the software.”). Specifically, the Revised

Rule reflects that OSHA decided that manual review of the forms was needed to avoid

“expos[ing] sensitive worker information to a meaningful risk of disclosure”—not no risk. Id. at

387 (emphasis added). Otherwise, inasmuch as the State Plaintiffs again question the level of

privacy risk that OSHGA found acceptable, for reasons already explained, OSHA did not violate

the APA by prioritizing privacy interests as it did; making such a value judgment is well within

its discretion. State Farm,

(“[A] court is not to substitute its judgment for that of

the agency.”).6

6 In addition, OSHA’s determination of the privacy risk it found acceptable was of course not the end of the story; it then considered that risk as part of a “balancing test to weigh the value of

19 Moreover, OSHA’s privacy concerns, and its determination that a manual review process

was necessary to remove PII from Forms 300 and 301, are not contrary to or lacking support in

the record. As for OSHA’s privacy concerns, the Revised Rule explains that employers often

submit PII, even though Forms 300 and 301 do not require it. 84 Fed. Reg. at 384. Citing

comments in the administrative record, the rule then explains that automated software may be

able to eliminate some of this inadvertently submitted PII, but that it is not capable of the level of

review needed to prevent re-identification. Id. And as for OSHA’s determination that a manual

review process is necessary, the State Plaintiffs also argue that automated review is enough—and

even that two-tier manual review is potentially less effective. State Pls. MSJ at 19–20. They cite

evidence in the administrative record for the proposition that automated processes “have been

shown to allow for high accuracy” and that the problems they have “are also shared with manual

de-identification approaches.” Id. at 20. But the authorities cited by the State Plaintiffs refer to

the removal of PII in clinical medical records. See Civil Case No. 19-621, ECF No. 26-1 at 78

(explaining that de-identification targets specific identifiers like “personal names and social

security numbers”). Instead, the Revised Rule focuses on the risk of re-identification because of

non-PII information contained in Forms 300 and 301. And on that score, OSHA determined that

“even if PII could be completely removed from the data, concerns about re-identification would

remain.” 84 Fed. Reg. at 384. Moreover, the Revised Rule states that “particularly in a small

town,” information like “what was the employee doing just before the incident occurred, what

happened, and what was the injury or illness” could allow re-identification. Id. (cleaned up).

The articles cited by the State Plaintiffs do not discuss the efficacy of software in removing this

worker privacy against the usefulness of releasing the data.” 84 Fed. Reg. at 384; see also Civil Case No. 19-621, ECF No. 25 (“Defs. Reply”) at 12–13.

20 kind of contextual information. Thus, neither OSHA’s privacy concerns nor its assessment that

manual review is necessary to prevent re-identification is unsupported by or contrary to the

record. Both are supported by “such relevant evidence as a reasonable mind might accept as

adequate.” Sage IT, Inc.,

(quoting Consolo,

).

C. Notice of OSHA’s Cost Assessment

The State Plaintiffs’ final cost-related argument is procedural. They argue that OSHA

failed to provide notice and the opportunity to be heard about the two-tier manual review process

described in the final Revised Rule. State Pls. MSJ at 20–22. “Notice requirements are designed

(1) to ensure that agency regulations are tested via exposure to diverse public comment, (2) to

ensure fairness to affected parties, and (3) to give affected parties an opportunity to develop

evidence in the record to support their objections to the rule and thereby enhance the quality of

judicial review.” Int'l Union, United Mine Workers of Am. v. Mine Safety & Health Admin.,

(D.C. Cir. 2005). Thus, a proposed rule and the final rule may only differ to the

extent that the final rule is a “logical outgrowth” of the proposal. Envtl. Integrity Project v.

E.P.A.,

(D.C. Cir. 2005); see also

(c). “A final rule is a logical

outgrowth of a proposed rule only if interested parties should have anticipated that the change

was possible, and thus reasonably should have filed their comments on the subject during the

notice-and-comment period,” United Mine Workers of Am.,

(quotations

omitted).

State Plaintiffs argue that OSHA violated the APA when it determined, for the first time

in the final Revised Rule, that a two-tiered manual review process was necessary to protect PII.

State Pls. MSJ at 21. The NPRM had anticipated use of an automated process to remove PII

from Forms 300 and 301. 83 Fed. Reg. at 36,503. OSHA thus determined that it would save

21 $53,000 to $64,000 per year if it no longer collected Forms 300 and 301. Id. But the final

Revised Rule determined that a manual review process would be necessary to adequately protect

privacy. Thus, the Revised Rule added roughly $7.5 million to its proposed savings to account

for the manual review process. 84 Fed. Reg. at 402.

Despite its impact on OSHA’s expected savings, the final Revised Rule is a logical

outgrowth of the proposed rule with respect to the methods OSHA proposed to use to protect PII.

Therefore, the notice the State Plaintiffs received was adequate. “[C]ases finding that a rule was

not a logical outgrowth have often involved situations where the proposed rule gave no

indication that the agency was considering a different approach, and the final rule revealed that

the agency had completely changed its position.” CSX Transp., Inc. v. Surface Transp. Bd.,

, 1081 (D.C. Cir. 2009). Here, the NPRM conveyed that OSHA was assessing the

proposed automated review of the forms to determine whether that review was adequate to

protect PII. The NPRM even asked for comment on the issue. See 83 Fed. Reg. at 36,500

(“What risks to worker privacy are posed by the electronic collection of information from Forms

300 and 301[?] How could OSHA make [these risks] less likely, and what resources would be

required?” Id. (“[W]hat other agencies and organizations in the public and private sectors use

automated de-identification systems to remove PII from text data before making the data

available to the public? What challenges have they faced in using those systems to keep PII

protected?”). This was enough to put interested parties on notice that OSHA was reconsidering

its approach and weighing alternatives to the automated review process. See CSX Transp., 584

F.3d at 1081 (“[A] final rule represents a logical outgrowth where the NPRM expressly asked for

comments on a particular issue or otherwise made clear that the agency was contemplating a

22 particular change.”) Thus, the final Revised Rule is a logical outgrowth of the NPRM, and this

change did not violate the APA’s notice requirements.

2. OSHA’s Assessment of the Benefits of Collecting Forms 300 and 301

The State Plaintiffs also argue that OSHA did not properly consider evidence of potential

benefits of the collection of Forms 300 and 301. State Pls. MSJ at 22–26. “[A]n agency rule

would be arbitrary and capricious if the agency . . . entirely failed to consider an important aspect

of the problem.” State Farm,

. And while “an agency’s decision need not be a

model of analytic precision to survive a challenge,” Frizelle v. Slater,

(D.C.

Cir. 1997) (cleaned up), it must be clear to the Court that an agency has “grapple[d] with”

evidence contradicting its position, see Aragon v. Tillerson,

(D.D.C.

2017).

State Plaintiffs argue that Defendants failed to consider, or “blithely dismissed” the

benefits to three types of entities: (1) state programs addressing worker safety, (2) workers, their

representatives, and advocacy groups, and (3) researchers. State Pls. MSJ at 22. As evidence of

these benefits, they point to comments in the administrative record discussing the potential use of

Form 300 and 301 data for public health and occupational safety studies and efforts. Id. at 22,

23, 25.

The benefits at issue, however, would never accrue to these outside organizations (the

State Plaintiffs cite no benefits to OSHA) unless these entities successfully sued to receive Form

300 and 301 data through FOIA. This is so because even before the rulemaking process related

to the Revised Rule, OSHA decided not to make the data publicly available. 84 Fed. Reg. at 391

(noting OSHA “determined publishing the data would do more harm than good” and did not

intend to release it.). And it is OSHA’s view that the data would be exempt from public

disclosure under FOIA, so it will not produce them voluntarily in response to a FOIA request.

23 Thus, the Revised Rule concluded that “many of the benefits discussed by commenters would

not materialize.”7 84 Fed. Reg. at 391.

The Court can think of no reason why the APA required OSHA, when promulgating the

Revised Rule, to consider benefits that would accrue to outside entities only if those entities

successfully sued the agency for the information under FOIA. Regardless of the likelihood those

entities would be successful, such a holding would effectively require OSHA to consider FOIA a

reason why the information needed to be collected or created in the first place. That stretches the

effect of the statute too far. “[O]nly the Federal Records Act, and not the FOIA, requires an

agency to actually create records.” Kissinger v. Reporters Comm. for Freedom of the Press,

(1980). FOIA itself “does not obligate agencies to create or retain documents; it

only obligates them to provide access to those which it in fact has created and retained.”

Moreover, even if OSHA had to consider the potential benefits accruing to these outside

entities if they mounted a successful FOIA lawsuit, the Revised Rule hardly “entirely failed” to

consider them. State Farm,

. The rule acknowledged that commenters raised

these potential benefits. See 84 Fed. Reg. at 392–93 (“Commenters pointed to OSHA’s

statements in the 2016 final rule that collecting data from Forms 300 and 301 would allow the

agency to leverage its resources to execute its mission by . . . providing data to employers,

workers, unions and academics that would assist them in researching and innovating to improve

7 The State Plaintiffs also argue that OSHA committed to sharing data with state agencies through the Revised Rule. State Pls. MSJ at 23. But that argument misreads the plain language of the rule, which says “OSHA also notes, in response to a comment that some states have more limited surveillance capacity than others, that those states will have access to the summary data collected by OSHA.” 84 Fed. Reg. at 381. The phrase “summary data” refers to the information provided in Form 300A, “Summary of Work-Related Injuries and Illnesses,” which is still collected under the Revised Rule. See generally 84 Fed. Reg. at 380.

24 workplace safety and health.”); id. at 393 (“Although OSHA identified these potential benefits,

OSHA never quantified them.”). But OSHA “d[id] not ignore . . . the possibility that benefits

could result from collecting the data, but conclude[d] that the scope of any such benefits [was]

uncertain.” Id. Ultimately, OSHA concluded that it “does not believe that these uncertain

benefits justify the diversion of OSHA’s resources from other agency initiatives with a proven

record of effectiveness.” Id.8 And a court should not substitute its judgment for that of the

agency in such matters. See Burlington,

.9 See also Envtl. Integrity Project v.

McCarthy,

(D.D.C. 2015) (holding that EPA’s decision not to collect

information, so it could prioritize other enforcement tools, was not a clear error in judgment).

3. Internal Inconsistencies

Finally, the State Plaintiffs argue that OSHA’s weighing of the costs and benefits of the

Revised Rule is internally inconsistent. They note that OSHA’s assessment of the costs of

collecting Forms 300 and 301 presumes that the information in those forms will be released,

while its assessment of the benefits assumes that the information will not. State Pls. MSJ at 14.

And to be sure, “it would be arbitrary and capricious for [an] agency’s decision making to be

‘internally inconsistent.’” Nat. Res. Def. Council v. U.S. Nuclear Regul. Comm’n,

State Plaintiffs also object to OSHA’s dismissal of the benefits of Form 300 and 301 data for research on the grounds “that researchers already have access to BLS data and severe injury data.” 84 Fed. Reg. at 391. But this remark does not mean that OSHA failed to recognize or consider these benefits. The Revised Rule does not say that BLS and other available data are perfect substitutes for the data collected from Forms 300 and 301. Instead, OSHA merely suggested that at least some of the benefits might be realized in other ways, such that lack of access to Form 300 and 301 data will not leave researchers in the dark. 9 The Electronic Filing Rule says that data from Forms 300 and 301 might be “of great use” to outside entities. 81 Fed. Reg. at 29,631. In contrast, the Revised Rule describes those benefits as “speculative.” But the preamble of the Electronic Filing Rule suggested that OSHA would publish the information gathered in the collection of Forms 300 and 301. Id. at 29,625. Afterward, OSHA decided to change course, which accounts for the change.

25 1202, 1214 (D.C. Cir. 2018) (quoting Air Transp. Ass’n of Am. v. Dep't of Transp.,

(D.C. Cir. 1997)); see also Gen. Chemical Corp. v. United States,

, 854 (D.C.

Cir. 1987) (concluding that agency must weigh evidence “in a rational and consistent manner”).

But OSHA’s response explains how it can simultaneously claim that it “would not make

the data public even if collected,” 84 Fed. Reg. at 391, and that “collecting the data . . . would

subject sensitive worker information to a meaningful risk of public disclosure.” 84 Fed. Reg. at

383. Before it engaged in the rulemaking that led to the Revised Rule, OSHA decided to change

course and not voluntarily provide the data to the public. Thus, for the reasons already explained

above, OSHA did not need to consider the benefits of voluntarily disclosing the information to

the public, or even those benefits that could accrue if outside entities successfully sued for it

under FOIA—and even if it had to do the latter, it did. 84 Fed. Reg. at 393. At the same time,

again for reasons already explained above, even if OSHA did not voluntarily disclose the data to

the public, it had to weigh the possibility—perhaps even the likelihood 10—that these outside

entities might successfully sue to obtain the Form 300 and 301 data, so it had to consider the

more ascertainable costs of reducing the privacy risk to the point it found acceptable. 11 See id. at

10 See Pub. Citizen I,

. 11 The State Plaintiffs briefly raise a second inconsistency argument. They argue that the Revised Rule is inconsistent as to whether OSHA plans to use data from Forms 300 and 301 in its enforcement efforts. See State Pls. MSJ at 36–37. They claim that the Revised Rule cites the need to protect the confidentiality of enforcement efforts as a reason not to release Form 300 and 301 data. However, they argue, this conflicts with OSHA’s suggestion that it would not use this data for enforcement. But OSHA did not cite the confidentiality of enforcement efforts as a reason why it ceased collection of Forms 300 and 301. The portions of the rule that the State Plaintiffs cite for this proposition address only Form 300A. See 84 Fed. Reg. at 383 (“OSHA has already taken the position that Form 300A is exempt from disclosure under FOIA and that OSHA will not make such data public for at least the approximately four years after its receipt that OSHA intends to use the data for enforcement purposes.”).

26 381 (assessing costs of PII stripping for potential FOIA release). Nothing about OSHA’s

decision-making was logically inconsistent. In fact, this argument appears merely a rehashing of

the State Plaintiffs’ earlier challenges to how OSHA assessed the benefits of the Revised Rule.

At bottom, “cost-benefit analyses epitomize the types of decisions that are most

appropriately entrusted to the expertise of an agency.” Off. of Commc’n of United Church of

Christ v. F.C.C.,

, 1440 (D.C. Cir. 1983). And despite the State Plaintiffs’

insistence, it was not arbitrary and capricious for OSHA to prioritize “other agency initiatives

with a proven record of effectiveness” over those with “uncertain benefits.” 84 Fed. Reg. at 393.

See In re Barr Labs., Inc.,

(D.C. Cir. 1991) (“The agency is in a unique—and

authoritative—position to view its projects as a whole, estimate the prospects for each, and

allocate its resources in the optimal way. Such budget flexibility as Congress has allowed the

agency is not for us to hijack.”).

Conclusion

For all the above reasons, Defendants’ Motion to Dismiss, ECF No. 17 in Civil Action

No. 19-166, and Motion for Summary Judgment, ECF No. 20 in Civil Action No. 19-621, will be

granted and Plaintiffs’ Motions for Summary Judgment, ECF No. 16 in Civil Action No. 19-166

and ECF No. 18 in Civil Action No. 19-621, will be denied. A separate order will issue.

/s/ Timothy J. Kelly TIMOTHY J. KELLY United States District Judge

Date: January 11, 2021

27