UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLUMBIA

WP COMPANY LLC d/b/a THE WASHINGTON POST, et al.,

Plaintiffs, v. Civil Action No. 20-1240 (JEB) U.S. SMALL BUSINESS ADMINISTRATION,

Defendant.

MEMORANDUM OPINION

Six months ago, this Freedom of Information Act case — brought by a host of national

news organizations against the Small Business Administration — seemed a thing of the past.

This Court, after all, had granted judgment to Plaintiffs and ordered SBA to release a trove of

data concerning the Paycheck Protection Program (PPP) and the Economic Injury Disaster Loans

(EIDL) program — specifically, the names, addresses, and precise loan amounts for millions of

successful borrowers. The agency eventually did so, the Court awarded Plaintiffs attorney fees,

and the matter was put to bed.

Or not. Less than two months after this Court’s summary-judgment ruling, SBA

discovered that it possessed additional data responsive to the news organizations’ FOIA requests

not addressed in the prior round of litigation. Although the agency eventually released much of

that information, it once again determined that select portions were exempt from disclosure —

this time, information reflecting the current payment status of individual loans, unique numerical

identifiers for each PPP borrower known as DUNS numbers, and borrower tax-identification

numbers. Dissatisfied with those withholdings, Plaintiffs registered an intent to challenge their

1 propriety, and the parties submitted supplemental Cross-Motions for Summary Judgment. The

Court now delivers a mixed verdict: while SBA properly reserved the DUNS numbers, a remand

is warranted for the agency to more fully support its withholdings with respect to interim loan-

status information and borrower tax-identification numbers.

I. Background

The Court need only briefly summarize the history of this litigation in order to set the

stage for the present round of motions. Throughout April and May 2020, the eleven Plaintiffs in

this case submitted FOIA requests seeking data regarding loans approved pursuant to the PPP

and EIDL program. WP Co. LLC v. U.S. Small Bus. Admin. (WP I),

, 9

(D.D.C. 2020). Administered by SBA, those programs constituted the primary means by which

the federal government assisted small businesses adversely affected by the COVID-19 crisis. As

of May 31, 2021, the agency had processed and approved nearly $800 billion in more than 11.8

million individual PPP loans, along with an additional $217 billion in COVID-related EIDL

loans as of July 8, 2021. See SBA, Paycheck Protection Program (PPP) Report at 2,

https://bit.ly/3wB3e04 (5/31/21 PPP Report); SBA, Disaster Assistance Update: Nationwide

COVID EIDL, Targeted EIDL Advances, Supplemental Targeted Advances at 2,

https://bit.ly/3APeUQp (7/8/21 EIDL Report).

Plaintiffs brought suit in this Court after SBA declined to fulfill their FOIA requests. WP

I, 502 F. Supp. 3d at 9. Although the agency eventually published some loan-level information

in July 2020, it refused to release both dollar figures and borrower names and addresses for any

PPP loan. Id. at 9–10 (describing similar partial-disclosure approach for EIDL data). According

to the Government, its withholdings were based on FOIA Exemptions 4 and 6, which protect,

respectively, confidential commercial information and information the disclosure of which

2 would constitute a clearly unwarranted invasion of personal privacy. Id. (citing

(b)(4), (6)).

Believing those withholdings lacked merit, the news organizations moved for summary

judgment, and this Court ultimately agreed that neither of SBA’s claimed exemptions covered

the requested information.

. It accordingly ordered the agency to release the

“names, addresses, and precise loan amounts” for all individuals and entities that had received

PPP or EIDL loans during the COVID-19 pandemic. See ECF No. 22 (11/5/20 Order) at 2. On

December 1, 2020 — shortly after the Court denied the Government’s bid to stay that Order, see

WP Co. LLC v. U.S. Small Bus. Admin. (WP II),

, at *5 (D.D.C. Nov. 24,

2020) — SBA did just that, publicly producing the full dataset containing the names, addresses,

and precise loan amounts for millions of recipients of PPP and EIDL COVID-related loans

totaling hundreds of billions of dollars. WP Co. LLC v. U.S. Small Bus. Admin. (WP III),

, at *1 (D.D.C. Jan. 21, 2021). The Court subsequently awarded Plaintiffs $122,347

in attorney fees and costs early this year. Id. at *9.

As it turned out, however, that disposition — and the three Memorandum Opinions it

entailed — did not mark the terminus of this litigation. Instead, on December 23, 2020, SBA

notified Plaintiffs that it had located in its electronic systems additional PPP loan-level

information responsive to their FOIA requests. See ECF No. 36 (Mot. for Briefing Sched.) at 2.

Although the agency soon released the majority of the newly uncovered data fields, see ECF No.

37-1 (Declaration of Eric S. Benderson), ¶ 12 (cataloging released data), it informed the news

organizations that it was — once again — withholding certain information pursuant to FOIA

Exemptions 4 and 6. See Mot. for Briefing Sched. at 2. Invoking the former exemption, SBA

reserved 1) “[i]nformation that would reveal whether a PPP loan is in default,” including “the

3 status of certain loans, the date associated with that loan status, the outstanding balance of all

PPP loans, and internal codes that identify the SBA offices servicing and processing the PPP

loans”; and 2) Data Universal Numbering System (DUNS) numbers provided by the private

company Dun & Bradstreet to SBA for individual PPP borrowers. See ECF No. 36-1 (1/25/21

Ltr. from SBA to Plaintiffs) at ECF p. 2. Although SBA also later invoked Exemption 8 in

support of its withholding that first batch of information, see ECF No. 37 (Def. Suppl. MSJ) at

21–25, as the Court subsequently explains, that exemption is no longer relevant.

As to Exemption 6, the agency withheld individual borrowers’ tax-identification numbers

— viz., Social Security Numbers and Employer Identification Numbers. See 1/25/21 Ltr. from

SBA to Plaintiffs at ECF p. 2. Although SBA admitted that EINs are not themselves exempt

from disclosure, it nonetheless reserved those numbers because they “are stored in the same data

field as [SSNs]” — which are protected under Exemption 6 — “and cannot be reliably

segregated from them in a dataset this large.” Id.

Plaintiffs objected to these additional withholdings and successfully sought entry of a

renewed briefing schedule to resolve their propriety. See Mot. for Briefing Sched. at 3; Min.

Order of 2/11/2021. Having now received dueling supplemental Cross-Motions for Summary

Judgment, see Def. Suppl. MSJ; ECF No. 42 (Pl. Suppl. Cross-Mot. & Opp.), the Court turns to

resolving them.

II. Legal Standard

Summary judgment may be granted if “the movant shows that there is no genuine dispute

as to any material fact and the movant is entitled to judgment as a matter of law.” Fed. R. Civ. P.

56(a); see also Anderson v. Liberty Lobby,

, 247–48 (1986); Holcomb v. Powell,

(D.C. Cir. 2006). A fact is “material” if it is capable of affecting the

4 substantive outcome of the litigation. See Liberty Lobby,

; Holcomb,

. A dispute is “genuine” if the evidence is such that a reasonable jury could return a verdict

for the nonmoving party. See Scott v. Harris,

(2007); Holcomb,

. “A party asserting that a fact cannot be or is genuinely disputed must support the assertion”

by “citing to particular parts of materials in the record” or “showing that the materials cited do

not establish the absence or presence of a genuine dispute, or that an adverse party cannot

produce admissible evidence to support the fact.” Fed. R. Civ. P. 56(c)(1).

FOIA cases typically and appropriately are decided on motions for summary judgment.

See Brayton v. Off. of the U.S. Trade Representative,

(D.C. Cir. 2011). In a

FOIA case, a court may grant summary judgment based solely on information provided in an

agency’s affidavits or declarations when they “describe the justifications for nondisclosure with

reasonably specific detail, demonstrate that the information withheld logically falls within the

claimed exemption, and are not controverted by either contrary evidence in the record nor by

evidence of agency bad faith.” Larson v. Dep’t of State,

(D.C. Cir. 2009)

(citation omitted). Such affidavits or declarations “are accorded a presumption of good faith.”

SafeCard Servs., Inc. v. SEC,

(D.C. Cir. 1991). “Unlike the review of other

agency action that must be upheld if supported by substantial evidence and not arbitrary or

capricious,” FOIA “expressly places the burden ‘on the agency to sustain its action’ and directs

the district courts to ‘determine the matter de novo.’” U.S. Dep’t of Justice v. Reporters Comm.

for Freedom of Press,

(1989) (quoting

(a)(4)(B)).

III. Analysis

Congress enacted FOIA “to pierce the veil of administrative secrecy and to open agency

action to the light of public scrutiny.” Dep’t of Air Force v. Rose,

(1976)

5 (citation omitted). “The basic purpose of FOIA is to ensure an informed citizenry, vital to the

functioning of a democratic society, needed to check against corruption and to hold the

governors accountable to the governed.” John Doe Agency v. John Doe Corp.,

(1989) (citation omitted).

In order to further that purpose, the statute provides that “each agency, upon any request

for records which (i) reasonably describes such records and (ii) is made in accordance with

published rules[,] . . . shall make the records promptly available to any person.”

(a)(3)(A). The Government need not, however, turn over requested information that falls

into one of nine statutorily created exemptions from FOIA’s broad directive. See

§ 552(b)(1)–(9). “Those exemptions,” the Supreme Court recently explained, “are as much a

part of FOIA’s purposes and policies as the statute’s disclosure requirement.” Food Mktg. Inst.

v. Argus Leader Media,

(2019) (cleaned up) (quoting Encino Motorcars,

LLC v. Navarro,

(2018)). Where an agency withholds records, it bears the

burden of showing that at least one of the exemptions applies. See Vaughn v. Rosen,

(D.C. Cir. 1975). In order to carry that burden, the Government must provide a

“relatively detailed justification” for its withholding, “specifically identifying the reasons why a

particular exemption is relevant.” Morley v. CIA,

(D.C. Cir. 2007)

(quoting King v. U.S. Dep’t of Justice,

(D.C. Cir. 1987)). Courts can compel

the release of any records that do not satisfy the requirements of at least one exemption. See

Reporters Comm.,

.

Here, SBA seeks to withhold three distinct categories of information. As the first two

groupings implicate Exemption 4, the Court begins there before shifting to Exemption 6 and

segregability.

6 A. Exemption 4

SBA invoked Exemption 4 to withhold 1) the interim payment status of individual PPP

loans (along with additional data that would reveal such status); and 2) DUNS numbers

associated with individual PPP borrowers. See Benderson Decl., ¶¶ 15–16.

1. Legal Framework

Exemption 4 shields from disclosure “commercial or financial information obtained from

a person and privileged or confidential.”

(b)(4). To demonstrate that this

exemption shelters the information withheld, SBA must show that it is “(1) commercial or

financial, (2) obtained from a person, and (3) privileged or confidential.” Pub. Citizen Health

Res. Grp. v. FDA,

(D.C. Cir. 1983).

Much like the initial summary-judgment dispute last fall, the present contretemps turns

on the third prong. In order for commercial or financial information to qualify as “privileged or

confidential,” the government must show that such information is “both customarily and actually

treated as private by its owner.” WP I, 502 F. Supp. 3d at 12 (quoting Food Mktg.,

). In other words, the information must be “customarily kept private, or at least closely

held, by the person imparting it.” Food Mktg.,

. The critical question is “how

the particular party customarily treats the information, not how the industry as a whole treats the

information.” Ctr. for Auto Safety v. Nat’l Highway Traffic Safety Admin.,

(D.C. Cir. 2001) (citing Critical Mass Energy Project v. Nuclear Reg. Comm’n,

, 878–80 (D.C. Cir. 1992)).

“Complicating matters,” the Supreme Court in 2019 suggested that “the plain meaning of

the word ‘confidential’” might require the government to establish an “additional necessary

condition” before invoking Exemption 4 — namely, that “the party receiving the information . . .

7 ‘provide[d] some assurance that it [would] remain secret.’” Renewable Fuels Ass’n v. U.S.

EPA, No. 18-2031,

, at *6 (D.D.C. Feb. 16, 2021) (quoting Food Mktg.,

). The Court, however, did not resolve whether this second condition is mandatory,

see Food Mktg.,

, and this Court has since explained that binding Circuit

precedent compels an answer in the negative. See Renewable Fuels Ass’n,

, at

*7 (“The current law of the D.C. Circuit . . . is that information is confidential under Exemption

4 ‘if it is of a kind that would customarily not be released to the public by the person [or entity]

from whom it was obtained.’”) (alteration in original) (quoting Critical Mass,

).

This Court, accordingly, declines to “read the word ‘confidential’ to impose a blanket

requirement that the government provide an assurance of privacy in every case in which it asserts

Exemption 4.” Id. at *8.

Additionally, an agency may withhold information under Exemption 4 — even if it falls

within the scope of the exemption — “only if . . . the agency reasonably foresees that disclosure

would harm an interest protected by [that] exemption.”

(a)(8)(A)(i)(I); see also

Reporters Comm. for Freedom of Press v. FBI, No. 20-5091,

, at *2, 11–12

(D.C. Cir. July 2, 2021). To satisfy this standard, an agency must “identify specific harms to the

relevant protected interests that it can reasonably foresee would actually ensue from disclosure of

the withheld materials,” and it must “connect [such] harms in a meaningful way to the

information withheld.” Ctr. for Investigative Reporting v. U.S. Customs & Border Prot.,

, 106 (D.D.C. 2019) (cleaned up) (citation omitted).

2. Interim Loan-Status Information

With that prelude concluded, the Court may analyze the first category of documents.

SBA withheld, and Plaintiffs seek, “lender designations of certain [PPP] borrowers” as being

8 current, in default, delinquent, or late on loan payments. See Def. Suppl. MSJ at 1; see also

Benderson Decl., ¶¶ 15, 20. The Court will refer to these data, obtained via monthly reports

submitted by lenders to SBA via its standard Form 1502, as “interim loan[-]status information.”

Benderson Decl., ¶¶ 10, 28; see also SBA, SBA Form 1502 and Instructions,

https://bit.ly/2UHTLa0. The agency also reserved the dates associated with such statuses,

outstanding loan balances, and internal codes identifying the particular SBA office servicing

individual loans — data that, “if disclosed, [would] unavoidably reveal interim loan[-]status

information.” Def. Suppl. MSJ at 24; see also Benderson Decl., ¶¶ 15, 20–21, 55–56. SBA, by

contrast, has published the final — as opposed to interim — statuses of all qualifying PPP loans,

marking them as “paid in full” or “charged off.” Benderson Decl., ¶¶ 20, 45.

It makes sense to begin with the interim loan-status information. If Exemption 4 protects

that data, it likewise covers distinct material that would in turn reveal interim loan status. See

Renewable Fuels Ass’n,

, at *3; WP I, 502 F. Supp. 3d at 13. There is no

dispute that this information — which describes the extent to which borrowers are current on

their loan payments — is “commercial or financial” data, as required under Exemption 4’s initial

prong. See Def. Suppl. MSJ at 11. Nor do Plaintiffs gainsay that the relevant material was

“obtained from a person” — viz., the PPP lenders who reported it to SBA via Form 1502. Id. at

12; see also

(2) (defining “person” to include “an individual, partnership,

corporation, association, or public or private organization other than an agency”). The sole

disagreement thus revolves around whether the information is “privileged or confidential” under

prong three — or, to be more precise, whether these lenders “customarily and actually” treat

interim PPP loan status as “private, or at least closely held.” Food Mktg.,

,

9 2366; see also Def. Suppl. MSJ at 13, 19 (framing question as such); Pl. Suppl. Cross-Mot. &

Opp. at 9, 13 (similar).

a. Submitter-Specific Information

SBA stumbles out of the gate by declining to provide evidence of the type that would

shed the most light on that question: statements from PPP lenders themselves. Recall that the

critical inquiry for Exemption 4 is “how the particular party customarily treats the information,

not how the industry as a whole treats the information.” Renewable Fuels Ass’n,

, at *6 (emphasis added) (quoting Ctr. for Auto Safety,

).

Notwithstanding the reality that it bears the “burden of proving the provider’s custom,” Critical

Mass,

, SBA did not contact a single lender and inquire how it actually and

customarily treats interim loan-status information. Indeed, the Government has not made any

particularized showing whatsoever with respect to the lenders that disbursed PPP funds.

That failure is problematic, especially when considered in the context of comparable

Exemption 4 cases from this district. Earlier this year, for instance, this Court considered a

dispute involving certain documents containing information obtained from small oil refineries.

Renewable Fuels Ass’n,

, at *6. Upon receiving the plaintiff’s FOIA request,

EPA contacted at least 72 individual refineries and provided them an opportunity to denote and

substantiate whether they treated the relevant information as confidential.

The Court then

considered those refinery-by-refinery submissions when determining whether the government

had “adequately ‘sustain[ed]’ its decision to withhold” under Exemption 4 the information

contained in individual documents.

at *6–7 (alteration in original) (quoting Reporters

Comm.,

) (affirming agency’s withholding decisions as to information relating to

certain refineries but remanding for further examination of select information that refineries had

10 not demonstrated they kept confidential); see also Humane Soc’y Int’l v. U.S. Fish & Wildlife

Serv., No. 16-720,

, at *2–4 (D.D.C. Mar. 29, 2021) (noting agency’s

invitation to private companies whose data it withheld under Exemption 4 to certify that they

customarily and actually treated the requested information as confidential and considering over a

hundred declarations from such companies). In Center for Investigative Reporting, similarly,

Chief Judge Beryl Howell rejected an agency’s Exemption 4 argument where it “offer[ed] no

declarations from the submitters themselves” as to their customary handling of the contested

information, but instead simply relied on “[c]onclusory statements by an agency official about

what the agency official may believe about how a submitter customarily treats the information.”

436 F. Supp. 3d at 110–11 (citation omitted). Absent greater “foundation to support [its]

confidentiality claim” — e.g., an “indicat[ion] that the submitters told [the agency] that [the

relevant information] w[as] confidential” — the government could not carry its burden.

In each of these Exemption 4 cases, the court emphasized the central importance of

government evidence substantiating “how the particular party customarily treats the information”

at issue. Renewable Fuels Ass’n,

, at *6 (quoting Ctr. for Auto Safety,

); see also Humane Soc’y,

, at *3; Ctr. for Investigative Reporting,

436 F. Supp. 3d at 110–11. That evidence can take a number of forms. An agency affidavit, for

instance, may reflect personal knowledge that submitters keep certain information confidential.

Ctr. for Investigative Reporting, 436 F. Supp. 3d at 110–11 (citing ICM Registry, LLC v. U.S.

Dep’t of Commerce,

(D.D.C. 2008)). Sometimes a confidential header

on a document, the nature of its contents, or the existence of a non-disclosure agreement may

speak for itself.

at 111 (citing, e.g., Elec. Privacy Info. Ctr. v. U.S. Dep’t of Homeland Sec.,

(D.D.C. 2015)). In the absence of these or similar forms of proof,

11 however, an agency may find it necessary to contact submitters of the requested information and

provide them an opportunity to denote its confidentiality and substantiate that claim. At bottom,

the Government must do something to establish how the particular information-providers

customarily and actually treat the relevant material.

(rejecting Government argument

that “there can be no debate that a company customarily keeps private the types of information

contained in the withheld records” and instead demanding proof that “these specific companies

customarily do so”) (citation omitted).

This reality was not lost on SBA. On the contrary, the agency’s opening brief

acknowledged that precedent compels a focus “on the activity of the particular persons whose

information [is] in dispute, rather than on the entire sector of the economy from which the

information ar[ises].” Def. Suppl. MSJ at 12 (citing Renewable Fuels Ass’n,

,

at *6). Defendant nonetheless actively disclaimed any intent to make the former (mandatory)

showing, insisting that it was “not feasible” to “conduct[] . . . a party-particularized inquiry”

because it could not “obtain from each of the several thousand participating PPP lenders a

declaration regarding their confidentiality practices.”

. Yet nowhere does the

Government suggest that it could not obtain such statements from some lenders. Indeed, in

2021, the top fifteen PPP lenders accounted for over half (52%) of all loans approved and nearly

a third (32%) of net dollars approved. See 5/31/21 PPP Report at 2, 7; see also Pl. Suppl. Cross-

Mot. & Opp. at 10 (offering data for earlier time period). A survey of that small yet meaningful

subset of lenders, along with credible substantiation of any individual lender’s claim of

customary and actual confidentiality with respect to interim PPP loan status, would go a long

way toward bringing that material within Exemption 4’s sweep. At present, however, the

agency’s decision to eschew a party-specific inquiry of any scope — despite Plaintiffs’

12 highlighting the issue in their Cross-Motion, see Pl. Suppl. Cross-Mot. & Opp. at 9–10 — only

raises questions about whether PPP lenders truly consider and treat the relevant information as

confidential. The Court’s holding, therefore, would appear straightforward: in the absence of

any evidence regarding the particular practices of even a single PPP lender with respect to

interim loan-status information, it cannot sustain SBA’s decision to withhold that information.

b. SBA’s Arguments

In a bid to discharge its burden notwithstanding the conspicuous dearth of lender-specific

evidence, SBA points to several “circumstances” that assertedly “warrant the inference” that

“interim loan information . . . is ‘both customarily and actually treated as private by its owner.’”

Def. Suppl. MSJ at 14 (quoting Food Mktg.,

). Certain of those

“circumstances,” if in future considered with a survey of individual PPP lenders establishing

their confidentiality practices, might well fortify any renewed Exemption 4 argument from the

agency. They cannot, however, currently carry the day on their own, as none has substantial

bearing on — let alone speaks squarely to — the operative question here: whether PPP lenders

customarily and actually treat interim loan status as confidential. A good deal more than “mere

inference and guesswork” is needed before this Court can resolve that inquiry in the affirmative.

Citizens for Responsibility & Ethics in Wash. v. U.S. Dep’t of Justice,

(D.D.C. 2013).

To start, SBA highlights language from FOIA’s legislative history that supposedly

“indicates that Congress itself viewed information about the lender-borrower relationship as

protected by Exemption 4.” Def. Suppl. MSJ at 15–16; see S. Rep. No. 89-813, at 9 (1965)

(stating that Exemption 4 would “include any commercial, technical, and financial data,

submitted by an applicant or a borrower to a lending agency in connection with any loan

13 application or loan”). The fact that legislators more than fifty years ago believed that FOIA

protected certain loan-related information, however, says little about the confidentiality practices

of PPP lenders today vis-à-vis interim PPP loan status. Nor do the agency’s non-binding,

decades-old cases from different contexts have much to offer on that critical question. See

Comstock Int’l (U.S.A.), Inc. v. Export-Import Bank of the U.S.,

(D.D.C.

1979) (noting agency’s assessment of confidentiality practices of banks with respect to loan

agreements, not loan statuses); Vogel v. W. T. Grant Co.,

, 127–31 (1974) (pre-FOIA

case discussing tort remedy for breaches of confidential debtor-creditor relationship with respect

to consumer credit, not commercial credit).

In addition, to the extent that any “practical reasons” why lenders might generally keep

their borrowers’ loan-payment status under wraps suggest that they actually do so, see Def.

Suppl. MSJ at 17, such reasons would appear to carry far less weight in the specific context of

PPP loans. As SBA itself admits, the ongoing and evolving nature of its PPP loan-forgiveness

process — a unique benefit not available to borrowers under the agency’s normal loan-guaranty

program, see Benderson Decl., ¶ 33 — ensures that “interim loan[-]status information supplies

little probative insight into whether a loan ultimately will be charged off or paid in full.” Def.

Suppl. MSJ at 2–3, 5–6. Overdue payment status, accordingly, cannot reliably be construed as

“a sign of a [PPP] borrower’s financial weakness.” Id. at 17 (seemingly recognizing as much).

Neither would disclosure of the delinquent share of a lender’s PPP loan portfolio supply a rival

company “unfair insights” and “competitive advantage.” Id. at 19. In contrast, once again, to

the agency’s general lending program, SBA guarantees the full value of all PPP loans, thereby

ensuring that lenders will be made whole regardless of whether borrowers pay up. Id. at 5 (citing

(a)(36)(K)(i)); see also ECF No. 46 (Pl. Suppl. Reply) at 6–7.

14 Finally, the agency points to its own FOIA regulations, under which “loan status, other

than charged-off or paid-in-full,” is “generally exempt from disclosure.” Def. Suppl. MSJ at 14

(cleaned up) (quoting 13 C.F.R. Pt. 102, Subpt. A, App. A). But the fact that SBA might largely

refrain from disclosing interim loan-status information does not resolve whether participating

PPP lenders customarily and actually do the same — and that, of course, is the $64,000 question.

To be sure, while a government “assurance of privacy is undoubtedly relevant” to the Exemption

4 analysis, WP I, 502 F. Supp. 3d at 16 (citation and internal quotation marks omitted), SBA’s

general FOIA regulation does not come close to establishing the specific confidentiality practices

of PPP lenders in a manner sufficient to get the agency over the hump. Of greater probative

value for that key inquiry would be the existence of a federal prohibition on lenders’ publicly

disclosing their borrowers’ interim loan status. Although SBA’s discussion is somewhat

muddled, a single paragraph in its opening brief intimates that agency regulations might set out

such a bar. See Def. Suppl. MSJ at 15 (stating that lender’s failure to treat as confidential “Form

1502’s contents” — which include interim loan status — “could be” a “ground” for “triggering

informal enforcement proceedings”) (cleaned up) (citing

(c)(8)); see also

. To the extent that any such disclosure prohibition encompasses the

payment status of individual loans as a general matter — as opposed to simply the literal

information contained in Form 1502 — that would once again be relevant to, although not

dispositive of, the question at hand. On the present record, however, precisely what SBA

regulations and accompanying guidance demand of lenders with respect to interim loan status

and confidentiality — and, more importantly, how lenders actually behave on the ground — is

far too nebulous for the Court to conclude that SBA has carried its burden to justify its

Exemption 4 withholdings.

15 ***

Although the Government has not yet established that interim loan-status information —

and, by extension, distinct material that would in turn reveal such information — qualifies for

protection under Exemption 4, it may well be the case that a renewed showing in accordance

with the guidance contained in this Opinion produces a different result. The Court, accordingly,

will provide SBA another opportunity to explain “with reasonably specific detail” how the

information at hand “logically falls within” Exemption 4. Elec. Frontier Found. v. U.S. Dep’t of

Justice,

(D.C. Cir. 2014) (quoting Miller v. Casey,

(D.C. Cir.

1984)); see also Cause of Action Inst. v. Export-Import Bank of the U.S., No. 19-1915,

, at *7 (D.D.C. Feb. 23, 2021) (requiring agency to provide more robust explanations for

withholdings in comparable circumstances). It expects that any such effort will feature a

particularized showing of the customary and actual practices of PPP lenders themselves.

Three final issues merit brief mention. First, the Court’s present disposition renders it

unnecessary to fully explore — at least for now — Plaintiffs’ argument that PPP loan status is

not “private” information because “lenders routinely provide information about borrowers to

commercial credit bureaus, which can then make that information publicly available in business

credit reports.” Pl. Suppl. Cross-Mot. & Opp. at 10. While the Court has its doubts about the

force of that position, it seems wiser to defer analysis until SBA returns with a more complete

picture of how lenders customarily treat interim PPP loan-status information. Nor need the

Court consider whether the Government has demonstrated the requisite foreseeable harm from

disclosure of such material; since the agency has not yet established the applicability of

Exemption 4 in the first instance, it has, “a fortiori, failed to satisfy the ‘heightened’ foreseeable-

harm requirement as well.” Ctr. for Investigative Reporting, 436 F. Supp. 3d at 113.

16 Finally, and as previously mentioned, SBA’s summary-judgment motion alternatively

contends that PPP loan status is protected from disclosure under Exemption 8. See Def. Suppl.

MSJ at 21–24; see also

(b)(8) (shielding information “contained in or related to

examination, operating, or condition reports prepared by, on behalf of, or for the use of an

agency responsible for the regulation or supervision of financial institutions”). Both parties seem

to agree, however, that the Court need not address Exemption 8 in any capacity, as the fate of the

interim loan-status information turns entirely on the outcome of the Exemption 4 dispute. See

ECF No. 45 (Def. Suppl. Reply & Opp.) at 17–18 (“If the information is confidential . . . , it is

properly withheld under Exemption 4 (so no Exemption 8 analysis is necessary). If, on the other

hand, the information is not confidential, then it cannot be withheld under either exemption

under the circumstances here presented.”); Pl. Suppl. Reply at 8 (“Plaintiffs agree with the SBA

that the Court ‘need not address’ Exemption 8 . . . .”). Perfectly happy to forbear, the Court

pivots to the next category of withholdings.

3. DUNS Numbers

Beyond interim loan-status information, SBA also reserved DUNS numbers associated

with individual PPP borrowers. It requires considerably less analysis for the Court to conclude

that these withholdings fall squarely under the Exemption 4 umbrella.

Developed and maintained by Dun & Bradstreet, DUNS numbers are unique nine-digit

identifiers for businesses. See Benderson Decl., ¶ 16; ECF No. 37-5 (D&B Ltr.) at ECF p. 2.

Having contracted with SBA to support the PPP, D&B provides — for a fee — the agency with

“access to and a limited right to use those numbers.” Benderson Decl., ¶ 16. Specifically, that

“limited license” permits SBA to “use [DUNS] Numbers . . . solely for identification purposes

and only for [the agency’s] internal business use”; in addition, “DUNS Numbers are proprietary

17 to and controlled by D&B.” Id., ¶ 66; see also D&B Ltr. at ECF p. 2 (supplying more detail

regarding license agreement). According to D&B, PPP borrowers’ DUNS numbers “are not

publishable by SBA under the terms of the SBA contract and the Dun & Bradstreet License.”

ECF No. 45-3 (2d D&B Ltr.) at ECF p. 2. More generally, D&B meticulously protects the

assignment and distribution of DUNS numbers, which were “developed at great effort and

expense.” D&B Ltr. at ECF p. 2. “It is only in the strictest of circumstances — and where

carefully negotiated by D&B — that any display of a [DUNS] is permitted, even in small

amounts.” Id.

The above discussion plainly demonstrates that DUNS numbers are “commercial”

information “obtained from a person” — i.e., D&B. See

(b)(4); Baker &

Hostetler LLP v. U.S. Dep’t of Commerce,

(D.C. Cir. 2006) (explaining that

Exemption 4 “applies (among other situations) when the provider of the information has a

commercial interest in the information submitted to the agency”). Exemption 4’s third condition

— confidentiality — is likewise satisfied. The DUNS numbers are proprietary information

protected by trademark, D&B’s license agreement with SBA does not “allow distribution or

publication of the [DUNS] in any format,” and the company “has deliberately restricted any

possibility of mass accumulation of [DUNS] information” — and even the display of small

quantities of such numbers — “outside of a Licensed customer contract.” D&B Ltr. at ECF pp.

2–3; see also Benderson Decl., ¶¶ 66–67; 2d D&B Ltr. at ECF p. 2 (“[D&B] only makes [DUNS

numbers] available under license.”).

Plaintiffs, once again, contest only this third prong of the Exemption 4 analysis —

whether the withheld DUNS numbers are customarily and actually treated as “private, or at least

closely held.” Food Mktg.,

; see Pl. Suppl. Cross-Mot. & Opp. at 13. In doing

18 so, they point to three Government websites that assertedly “make DUNS numbers available on

demand and in bulk with no apparent restrictions on their use.” Pl. Suppl. Cross-Mot. & Opp. at

14; see also ECF No. 42-3 (Declaration of Maxwell S. Mishkin), ¶¶ 12–14. As SBA

persuasively rejoins, however, these selective disclosures of several thousand DUNS numbers

each occurred pursuant to a specific license agreement developed in a unique context distinct

from the far larger PPP dataset at issue here. For instance, the U.S. General Services

Administration maintains a special contract with D&B that authorizes it to publish certain D&B

data (including DUNS numbers) for federal contractors registered in the Government’s System

for Award Management (SAM), a precondition to obtaining any federal contract. See ECF No.

45-1 (Second Declaration of Eric Benderson), ¶¶ 27–28, 31. (SAM is the common database

from which each of Plaintiffs’ identified websites appear to draw. Id., ¶ 29.) As D&B makes

clear, the rights accorded GSA under its “customized” license “would not be” — and, in fact, are

not — “extended to all 420 million+ DUNS Numbers at issue (or to the 7+ million in the PPP

loan program).” 2d D&B Ltr. at ECF p. 2. Put differently, D&B’s decision to provide the

Government with limited publication rights for a “specific subset” of DUNS numbers — i.e.,

entities registered on SAM — does not mean that the company has surrendered any claim of

customary confidential treatment regarding the overwhelming remainder of its proprietary

dataset, particularly the millions of distinct numbers for PPP borrowers that the D&B-SBA

license agreement expressly prohibits the agency from disclosing. See 2d Benderson Decl., ¶ 32;

see also 2d D&B Ltr. at ECF p. 2.

In addition, the Government has carried its burden to show reasonably foreseeable harm

from disclosure of the DUNS numbers. To fulfill the foreseeable-harm requirement in the

context of Exemption 4, the agency must explain how disclosure “would harm an interest”

19 protected by such exemption, “such as by causing genuine harm to the submitter’s economic or

business interests.” Ctr. for Investigative Reporting, 436 F. Supp. 3d at 113 (cleaned up)

(citation omitted); see also Leopold v. U.S. Dep’t of Justice, No. 19-3192,

, at

*7 (D.D.C. Jan. 13, 2021) (foreseeable harm established in Exemption 4 context where private

company asserted that release “could disadvantage [it] and provide an unfair advantage to its

competitors”). Here, although SBA’s discussion is rather cursory, both the agency and D&B

assert precisely that type of harm to the company’s business interests. See Benderson Decl., ¶ 68

(“[A] bulk release of over 5 million [DUNS] Numbers . . . would upend D&B’s management of

its proprietary system and sale of its product.”); D&B Ltr. at ECF p. 2 (“When a large set of

[DUNS] Numbers become[s] freely available to third parties, its use as a unique identifier

becomes diluted for those businesses whose [DUNS] have become widely available.”);

at

ECF p. 3 (“[T]he damage to D&B’s data collection and verification abilities that would be

caused by releasing such a large amount of proprietary [DUNS] data would be significant.”).

Plaintiffs, for their part, never even address the issue of foreseeable harm with respect to the

DUNS numbers. That information, accordingly, was properly withheld.

B. Exemption 6 and Segregability

The final set of reserved data at issue here comprises PPP borrowers’ tax-identification

numbers. As a reminder, the Government withheld SSNs for individual borrowers and EINs for

other businesses. See Benderson Decl., ¶ 70. All agree that SSNs are properly protected under

Exemption 6. See

(b)(6) (covering information “the disclosure of which would

constitute a clearly unwarranted invasion of personal privacy”); Def. Suppl. MSJ at 28; Pl.

Suppl. Cross-Mot. & Opp. at 21. No one, meanwhile, contends that EINs themselves fall within

the scope of that exemption. See Def. Suppl. MSJ at 29; Pl. Suppl. Cross-Mot. & Opp. at 18–19.

20 So why is this issue hard? It turns out that SBA reserved EINS because it assertedly lacked the

ability to distinguish between them and SSNs. See Def. Suppl. MSJ at 28–29.

Explaining how that could be so requires a little more detail. Both SSNs and EINs — the

latter of which are issued by the Internal Revenue Service — are unique nine-digit identifiers.

See Benderson Decl., ¶¶ 70, 72. SSNs usually contain dashes after the third and fifth digit, while

EINs often contain a single dash after the second — e.g., XXX-XX-XXXX vs. XX-XXXXXXX. Id., ¶ 72.

Absent such markings, however, a reader cannot tell the two numbers apart. Id. The original

PPP application form contained a single free-text field labeled “Business TIN” into which

prospective borrowers entered their SSN or EIN, either with or without dashes. Id., ¶ 73. Apart

from using those dashes, the form offered no way for borrowers to indicate which of the two

numbers they were providing. Id.

Upon receiving borrowers’ applications, lenders transmitted information contained

therein to SBA through an electronic interface. Id., ¶ 74. That interface required lenders to input

an applicant’s tax-identification number as a single nine-digit string (sans dashes) and then to

check a box indicating whether such number was an SSN or EIN. Id. Because the underlying

PPP application form did not ask prospective borrowers to indicate which type of number they

were providing, however, lenders checking the box in the interface were “often forced to guess

whether they were submitting an EIN or SSN.” Id. As some lenders “must have guessed

incorrectly” or made other “manual errors,” id., ¶ 75, SBA “has good reason to believe that some

indeterminate share of the identification numbers recorded as EINs in its PPP loan database are

in fact SSNs, and vice versa.” Def. Suppl. MSJ at 27–28. According to the agency, because it

has “no way to check or correct for such errors” or otherwise confirm which numbers are in fact

EINs and which are SSNs, an en masse release of numbers identified by lenders as EINs “would

21 almost certainly result in an erroneous release of numerous social security numbers.” Benderson

Decl., ¶¶ 75, 77; see also id., ¶ 77 (stating that “there is no means of segregating the [EINs]

without great risk of releasing SSNs”). It thus elected to withhold the entire data field — EINs

and SSNs alike — even though only the latter fell under a FOIA exemption. Id., ¶ 77; see also

Def. Suppl. MSJ at 28–29.

FOIA requires that “[a]ny reasonably segregable portion of a record shall be provided to

any person requesting such record after deletion of the portions which are exempt.”

(b). While the Government is “entitled to a presumption that [it] complied with the

obligation to disclose reasonably segregable material,” Hodge v. FBI,

(D.C.

Cir. 2013) (citation omitted), such presumption of compliance does not obviate its obligation to

carry its evidentiary burden and fully explain its decisions on segregability. See Mead Data

Cent., Inc. v. U.S. Dep’t of Air Force,

, 261–62 (D.C. Cir. 1977). To do so, the

agency must provide “a ‘detailed justification’ and not just ‘conclusory statements’ to

demonstrate that all reasonably segregable information has been released.” Valfells v. CIA,

(D.D.C. 2010) (quoting Mead Data,

); see also Elec.

Privacy Info Ctr. v. U.S. Dep’t of Homeland Sec.,

(D.D.C. 2013) (“To

justify withholding a document in full, an agency must show with ‘reasonable specificity’ why

the document cannot be further segregated . . . or why the document is not reasonably

segregable.”) (quoting Johnson v. Exec. Off. for U.S. Att’ys,

, 776 (D.C. Cir.

2002)).

SBA’s present submissions are insufficient to sustain its segregability decision for a

simple reason: the agency has not explained why it cannot reasonably segregate EINs from

SSNs. All the Government offers on that score is the conclusory assertion that it has “no

22 technical way to check or correct for” any SSNs that were incorrectly labeled as EINs. See Def.

Suppl. MSJ at 28; see also Def. Suppl. Reply & Opp. at 19. Plaintiffs, however, have an idea:

seek assistance from the Social Security Administration to identify SSNs and from the IRS to

identify EINs. See Pl. Suppl. Cross-Mot. & Opp. at 21. Perhaps those agencies, Plaintiffs

submit — each of which is responsible for the respective numbers at issue — could themselves

efficiently segregate the electronic data with the stroke of a few keys. The Government never

explains why it did not pursue this method or declined even to consult with those agencies.

In light of that plausible unaddressed possibility and SBA’s thin submissions as to its

own inability to distinguish between the numbers, the Court concludes that the Government has

not discharged its “obligation to carry its evidentiary burden and fully explain its decisions on

segregability.” Am. Immigr. Council v. U.S. Dep’t of Homeland Sec.,

(D.D.C. 2013). The agency, in other words, has not demonstrated with “reasonable specificity,”

Johnson, 310 F.3d at 776 (citation omitted), why non-exempt EINs are “inextricably

intertwined” with exempt SSNs. Mead Data,

. To be clear, the Court does not

here order the Government to actually carry out Plaintiffs’ proposed strategy. Perhaps the SSA

and IRS face the same barriers as does SBA. Or perhaps any disentangling will be excessively

burdensome or time consuming in a dataset as large as the present so as to render the suggested

tack “[un]reasonabl[e].”

(b). At a minimum, however, SBA must “explain why

the possibility of [this] method of segregability is unavailable if it is to claim the protection of

the exemption,” Evans v. Fed. Bureau of Prisons,

, 587 (D.C. Cir. 2020) (emphasis

added) — or at least bolster its (presently unsupported) contention that information is not

“reasonably” segregable when it “cannot be segregated by any technical means available to the

agency that holds the record.” Def. Suppl. Reply & Opp. at 20; cf. Mead Data,

23 (“[U]nless the segregability provision of the FOIA is to be nothing more than a precatory

precept, agencies must be required to provide the reasons behind their conclusions in order that

they may be challenged by FOIA plaintiffs and reviewed by the courts.”).

The Court, accordingly, will provide the Government another opportunity to more fully

explain its segregability decision — or, alternatively, to actually segregate the relevant data

through some reasonably available means. This will balance the need to protect sensitive SSNs

while affording the possibility of the release of EINs.

IV. Conclusion

For the foregoing reasons, the Court will grant in part and deny in part both supplemental

Cross-Motions for Summary Judgment. A separate Order so stating shall issue this day.

/s/ James E. Boasberg JAMES E. BOASBERG United States District Judge Date: July 15, 2021

24