¶1 During litigation, Ameriquest Mortgage Company released a number of confidential customer loan files to the Washington State Attorney General’s Office (AGO). The litigation ended in a settlement agreement. Subsequently, a Public Records Act1 (PRA) request was made to the AGO requesting those confidential files and the AGO’s work product regarding Ameriquest. The AGO willingly prepared the documents sought and notified Ameriquest of the proposed disclosure. Ameriquest sought to preliminarily enjoin the production of documents, arguing that (1) a federal act2 preempted the state PRA and prohibited disclosure of information provided from Ameri*151quest to the AGO and (2) the AGO’s decision to produce its attorney work product was arbitrary and capricious. The trial court denied the preliminary injunction; we granted discretionary review. We reverse the trial court’s order as it improperly combined the preliminary injunction hearing with the permanent injunction trial. We reverse and remand to the trial court for further proceedings with the following instructions: (1) the loan customers should be notified and have an opportunity to respond; (2) the federal act does preempt the PRA regarding nonpublic information contained in the customer loan files; and (3) based on the record to date, the trial court was correct to deny a preliminary injunction on the attorney work product issue.

FACTS

¶2 In 2003, the AGO, in association with the Washington Department of Financial Institutions, began an investigation under the Consumer Protection Act, chapter 19.86 RCW, into the mortgage lending practices of Ameriquest and two related entities. During the course of the investigation, the two Washington agencies amassed a substantial number of documents that can be sorted into three categories.

¶3 The first category of information is that received from Ameriquest through discovery. These documents included a number of confidential customer loan files and internal Ameriquest employees’ e-mails. The customer loan files included a customer’s full legal name, Social Security number, driver’s license number, date of birth, credit score, credit report, monthly income, sources of monthly income, employer’s name, employer’s address, length of employment, nature of employment, names and ages of any children, checking and savings account information, identification of other assets, residential address, residential phone number, and personal wireless telephone number, as well as all terms and conditions of the customer’s loan transaction.

*152f4 The second category of information included documents provided to the AGO by third parties, including information provided by those filing complaints with the AGO’s consumer resource center.3 The third category includes documents internally generated by the two agencies during the course of the investigation and prosecution of the case.

¶5 Two years into the investigation and prosecution of Ameriquest, in November 2005, the lawsuit between Ameriquest and 49 states and the District of Columbia settled for $325 million. The settlement agreement included a provision that “the State [was to] comply with applicable public disclosure laws and promptly provide notice to [Ameriquest] of the request” so as to afford Ameriquest “the reasonable opportunity to assert that the documents subject to the request are exempt from disclosure.”4 Clerk’s Papers (CP) at 165.

¶6 In February 2007, the Law Offices of Melissa Huelsman filed a request under Washington’s PRA with the AGO, requesting “all records relating to [the] investigation of Ameriquest.” CP at 164. The AGO entered into discussions with Huelsman to focus the request and to prioritize the order of document production. On March 1, 2007, the AGO notified Ameriquest of its intent to disclose the information requested, including the confidential documents Ameriquest supplied, by March 15, 2007. The AGO attached a list of documents that it intended to produce, including Ameriquest’s customer loan files for 35 Washing*153ton citizens and internal e-mail communications of two Ameriquest employees.5

¶7 To prevent the immediate disclosure of documents, Ameriquest filed a complaint for injunctive relief with the Thurston County Superior Court on March 9, 2007. Huelsman (Intervenor) filed a motion to intervene in the proceedings. All three parties stipulated to, and the trial court entered, a temporary restraining order preventing the release of the disputed documents.

¶8 Subsequently, Ameriquest filed a motion for a preliminary injunction. Ameriquest argued that the information the AGO intended to disclose to the Intervenor was protected from disclosure by the Gramm-Leach-Bliley Act (GLBA), 15 U.S.C. §§ 6801-6809, and was also exempt from disclosure under several PRA exemption provisions. Ameriquest argued that disclosure of the confidential customer loan files conflicted with, and was preempted by, the GLBA. Additionally, Ameriquest argued the necessity of judicial review for the AGO’s decision to waive exemptions available under the PRA. Ameriquest voiced specific concerns that the AGO’s treatment of its confidential documents was not consistent with the AGO’s behavior toward similarly situated companies or requests for similar types of documents.

¶9 Both the AGO and the Intervenor opposed the motion for preliminary injunction. The AGO acknowledged the confidential nature of the documents but argued that the GLBA did not preempt the PRA. The AGO argued that the GLBA did not preempt the PRA based on the exception in the act that permits disclosure “to comply with Federal, State, or local laws, rules and other applicable legal requirements.” CP at 187. In the alternative, the AGO argued that even in case of preemption, the AGO’s redaction policy for “personal information” as defined by Hearst Corp. v. Hoppe, 90 Wn.2d 123, 133, 580 P.2d 246 (1978), satisfied the GLBA’s prohibitions on disclosure. CP at 186-87.

*154¶10 The trial court denied Ameriquest’s motion for a preliminary injunction. CP at 320-24. The trial court determined that the GLBA “does not preempt the State’s law on public disclosure of documents.” CP at 322. Additionally, the trial court found that Ameriquest had “no standing to assert” various exemptions to the PRA on the AGO’s behalf. CP at 322. The trial court ordered the temporary restraining order to remain until the AGO completed redaction of the documents in accordance with AGO policy. The documents were to be released to the Intervenor upon completion of satisfactory redaction.

¶11 Ameriquest filed its petition for discretionary review and emergency motion for stay, and we ultimately granted both. The information and documents in dispute have not been disclosed to the Intervenor.

ANALYSIS

¶12 We review all agency actions taken or challenged under the PRA, RCW 42.56.030 through 42.56.520, de novo. RCW 42.56.550(3). We stand in the shoes of the trial court reviewing declarations, memoranda of law, and other documentary evidence. See Dawson v. Daly, 120 Wn.2d 782, 788, 845 P.2d 995 (1993).

I. CR 65 Violation

¶13 Ameriquest argues that the trial court improperly combined the preliminary injunction hearing with a trial on the merits without giving the parties the notice that CR 65(a)(2) requires. The AGO and Intervenor argue that the trial court’s action was proper and that Ameriquest failed to make a sufficient offer of proof establishing its intent and ability to develop evidence that would likely prove its case at a permanent injunction trial. We agree with Ameriquest.

¶14 Civil Rule 65 governs trial court procedure for obtaining an injunction. The process generally progresses from temporary restraining order to preliminary injunction *155to permanent injunction. CR 65(a)(2) provides, however, that “[b]efore or after the commencement of the hearing of an application for a preliminary injunction, the court may order the trial of the action on the merits to be advanced and consolidated” with the preliminary injunction application hearing. If a “court does not expressly state that it is consolidating the injunction hearing and a trial on the merits,” though, “it may not render a final determination on the merits” at the preliminary injunction hearing. League of Women Voters of Wash. v. King County Records, Elections & Licensing Servs. Div., 133 Wn. App. 374, 382, 135 P.3d 985 (2006). The purpose of this rule, as with its federal counterpart, is to give the parties notice and time to prepare so that they will have a full opportunity to present their cases at the permanent injunction hearing. See Univ. of Tex. v. Camenisch, 451 U.S. 390, 395, 101 S. Ct. 1830, 68 L. Ed. 2d 175 (1981) (applying Federal Rule of Civil Procedure 65(a)(2), which mirrors CR 65(a)(2)).

¶15 Ameriquest argues that this case is analogous to Northwest Gas Ass’n v. Washington Utilities & Transportation Commission, 141 Wn. App. 98, 168 P.3d 443 (2007), review denied, 163 Wn.2d 1049 (2008), a recent decision from this court. In Northwest Gas, we reversed the trial court’s denial of a preliminary injunction under the PRA because “the trial court did not expressly inform the parties that it was consolidating the preliminary injunction hearing with a permanent injunction trial on the merits under CR 65(a)(2).” 141 Wn. App. at 114. We then, for purposes of judicial economy, stood in the place of the trial court and reviewed all materials to determine if, using the proper standards, the party seeking preliminary injunctive relief was entitled to it. Nw. Gas Ass’n, 141 Wn. App. at 115. After reviewing numerous documents detailing what factual inquiries the requesting party would make in preparing their case for a full trial on the merits, we were satisfied that they had met their burden, granted a preliminary injunction, and remanded for trial on the merits. Nw. Gas Ass’n, 141 Wn. App. at 127.

*156¶16 It appears that the trial court here similarly conflated the preliminary injunction hearing with a full hearing on the merits without providing prior notice to the parties. First, we note that the trial court used the wrong standard of proof. At a preliminary injunction hearing, a successful applicant must show a likelihood of prevailing at a trial on the merits. Here, the trial court ruled that Ameriquest had to “show: [(] a) [a] clear legal or equitable right, [(]b) a well-grounded fear of immediate invasion of that right, and [(]c) that the acts complained of will result in or threaten to result in actual or substantial injury.” CP at 322. This standard applies to a permanent injunction hearing. Second, the trial court entered what amounted to a final order on the disclosure issue. The trial court determined that the “Gramm-Leach-Bliley Act, 15 U.S.C. § 6801 et seq. (GLBA), did not preempt the State’s law on public disclosure of documents” and determined that “Ameriquest [had] no standing to assert the intelligence information and investigative records exemption, RCW 42.56.240,” or other exemptions under State public disclosure laws. CP at 322. Following these findings, the trial court ordered, subject to redaction, the release of documents the Intervenor sought. Based on these irregularities, we hold that the trial court erred in combining the preliminary and permanent injunction hearings and in issuing a final order. We, therefore, reverse.

f 17 We could end our analysis here and remand to the trial court to reconsider Ameriquest’s request for a preliminary injunction in accordance with CR 65. To conserve the parties’ and the courts’ resources, we address issues likely to arise on remand.

II. Notification of Ameriquest Customers

¶18 Throughout briefing and oral argument, all parties professed a deep desire to protect the personal information of the individuals whose Ameriquest loan files are at issue. Surprisingly, though, these individuals neither have been contacted nor made aware of this tug-of-war over their *157confidential information, nor have they been invited to represent their interests before the trial court.

¶19 On remand, the trial court must make reasonable provision for at least attempted notice to all of the Ameriquest loan customers whose information is being sought for public disclosure. The trial court shall also make reasonable provisions for those loan customers wishing to intervene or otherwise be heard. Finally, until the loan customers have had the opportunity to be heard and the trial court has appropriately ruled on the merits of either a preliminary or permanent injunction, the loan customer’s nonpublic personal information shall remain confidential.

III. Public Records Act — Preliminary Injunctive Relief

¶20 A preliminary injunction serves the same general purpose as a temporary restraining order to preserve the status quo until the trial court can conduct a full hearing on the merits. Nw. Gas Ass’n, 141 Wn. App. at 115-16. The “status quo ante” means the “ ‘last actual, peaceable, noncontested condition which preceded the pending controversy’.” Gen. Tel. Co. of Nw., Inc. v. Wash. Utils. & Transp. Comm’n, 104 Wn.2d 460, 466, 706 P.2d 625 (1985) (quoting State ex rel. Pay Less Drug Stores v. Sutton, 2 Wn.2d 523, 529, 98 P.2d 680 (1940)). At a preliminary injunction hearing, the plaintiff need not prove, and the trial court does not reach or resolve, the merits of the issues underlying the three requirements for permanent injunctive relief. Tyler Pipe Indus., Inc. v. Dep’t of Revenue, 96 Wn.2d 785, 793, 638 P.2d 1213 (1982). Instead, the trial court considers only the likelihood that the plaintiff will ultimately prevail at a trial on the merits by showing (1) that he has a clear legal or equitable right (2) that he reasonably fears will be invaded by the requested disclosure, and (3) the disclosure will result in substantial harm. Tyler Pipe, 96 Wn.2d at 792-93. We address each of these three injunctive-relief requirements.

*158A. Clear Legal or Equitable Right

¶21 The GLBA establishes an obligation to protect financial customers’ nonpublic information. Each financial institution “shall establish appropriate standards . . . relating to administrative, technical, and physical safeguards ... to insure the security and confidentiality of customer records and information.” 15 U.S.C. § 6801(b)(1). The GLBA expands consumer protection by requiring that any nonaffiliated third party that receives nonpublic personal information shall not disclose such information to any other person. 15 U.S.C. § 6803(c). It is on this provision that Ameriquest bases its duty to protect the disclosure of information collected by the AGO. Additionally, there is no dispute that Ameriquest has a clear interest in the confidentiality of its business records.

f 22 “ ‘To establish ... a clear legal or equitable right, the moving party must show that it is likely to prevail on the merits’ ” at trial. Nw. Gas Ass’n, 141 Wn. App. at 116 (alteration in original) (quoting San. Juan County v. No New Gas Tax, 160 Wn.2d 141, 154, 157 P.3d 831 (2007)). Here, Ameriquest claims that the GLBA preempts Washington’s PRA. This is an issue of first impression in Washington, but to survive the preliminary injunction hearing, Ameriquest must show that it is likely to prove this preemption at a subsequent trial on the merits.

¶23 State laws may be preempted by Congress through express preemption, field preemption, or conflict preemption. Progressive Animal Welfare Soc’y v. Univ. of Wash., 125 Wn.2d 243, 265, 884 P.2d 592 (1994). However, “ ‘[t]here is a strong presumption against finding preemption in an ambiguous case and the burden of proof is on the party claiming preemption. . . . State laws are not superseded by federal law unless that is the clear and manifest purpose of Congress.’ ” Progressive Animal Welfare Soc’y, 125 Wn.2d at 265 (alterations in original) (quoting Wash. State Physicians Ins. Exch. & Ass’n v. Fisons Corp., 122 Wn.2d 299, 327, 858 P.2d 1054 (1993)). Ameriquest argues *159that the GLBA expressly preempts the state PRA law and mandates nondisclosure of the loan files in their entirety. We agree and hold that the GLBA preempts the PRA in this case.

1. The GLBA Preempts Inconsistent State Law

¶24 Congress enacted the GLBA to effectuate its policy that “each financial institution has an affirmative and continuing obligation to respect the privacy of its customers and to protect the security and confidentiality of those customers’ nonpublic personal information.”6 15 U.S.C. § 6801(a). “Nonpublic personal information” applies to “personally identifiable financial information — (i) provided by a consumer to a financial institution; (ii) resulting from any transaction with the consumer or any service performed for the consumer; or (iii) otherwise obtained by the financial institution.” 15 U.S.C. § 6809(4)(A).

¶25 The GLBA addresses preemption of state law and preserves only a state “statute, regulation, order, or interpretation” that is not “inconsistent” with GLBA 15 U.S.C. § 6807(a). 15 U.S.C. § 6807(b). Therefore, we must determine whether compliance with the PRA by the AGO in this case is inconsistent with the GLBA. If compliance with the PRA is inconsistent with the GLBA, then the GLBA preempts the PRA on this point and prohibits disclosure.

2. The GLBA’s Nondisclosure Provisions

¶26 The GLBA contains two related confidentiality provisions. The first provision prevents financial institutions from releasing nonpublic personal information without providing notice to consumers:

Except as otherwise provided ... a financial institution may not, directly or through any affiliate, disclose to a nonaffiliated third party any nonpublic personal information, unless such financial institution provides or has provided to the consumer a notice that complies with [15 U.S.C. § 6803].

*16015 U.S.C. § 6802(a). There is a limited, exception to this provision in that a financial institution may disclose nonpublic personal information

to comply with a properly authorized civil, criminal, or regulatory investigation... by Federal, State, or local authorities; or to respond to judicial process or government regulatory authorities having jurisdiction over the financial institution for examination, compliance, or other purposes as authorized by law.

15 U.S.C. § 6802(e)(8).

¶27 The second confidentiality provision expressly limits the reuse of information disclosed by financial institutions to nonaffiliated third parties:

Except as otherwise provided ... a nonaffiliated third party that receives from a financial institution nonpublic personal information under this section shall not, directly or through an affiliate of such receiving third party, disclose such information to any other person that is a nonaffiliated third party of both the financial institution and such receiving third party, unless such disclosure would be lawful if made directly to such other person by the financial institution.

15 U.S.C. § 6802(c). Ameriquest maintains that this provision applies to the AGO, preempts the PRA here, and prohibits the transfer of information from the AGO to the Intervenor. The AGO counters that it is not subject to the GLBA because it is not a nonaffiliated third party, as the statute envisions. The AGO is wrong; it is a nonaffiliated third party and it is subject to the GLBA reuse restrictions.

3. Nonaffiliated Third Party

¶28 The AGO argues that because it is not a financial institution, the GLBA reuse provisions do not apply. Alternatively, the AGO argues that because it is “affiliated” with the Intervenor (because the Intervenor is a member of the public), the GLBA prohibitions on disclosure are not triggered. These assertions are legally incorrect.

¶29 Under the GLBA, a nonaffiliated third party is defined as “any entity that is not an affiliate of, or related by common ownership or affiliated by corporate control with, *161the financial institution, but does not include a joint employee of such institution.” 15 U.S.C. §6809(5) (emphasis added). There is no requirement that the nonaffiliated third party provided with the information from the original financial institution also be a financial institution. Instead, GLBA language clearly states that “any entity” that comes into possession of nonpublic personal information is considered a nonaffiliated third party and is subject to reuse provisions.

¶30 In Hodes v. United States Department of Housing & Urban Development, 532 F. Supp. 2d 108 (D.D.C. 2008), the United States District Court for the District of Columbia decided a similar issue.7 Hodes filed a Freedom of Information Act, 5 U.S.C. § 522, action against the Department of Housing and Urban Development, seeking information identifying individuals that held mortgage-backed securities under Government National Mortgage Association’s (Ginnie Mae) mortgage-backed securities program. Hodes, 532 F. Supp. 2d at 111. Hodes made the same argument the AGO makes here, namely, that the GLBA does not apply to Ginnie Mae because it is not a financial institution. The court held that the GLBA’s “plain language indicates that ‘any’ entity may be considered a nonaffiliated third party, not just other financial institutions.” Hodes, 532 F. Supp. 2d at 115. Additionally, the court noted:

[T]he practical effect of Hodes’s interpretation would be antithetical to the Act’s stated purpose, which is, in part, to “insure the security and confidentiality of customer records and information.” 15 U.S.C. § 6801(b)(1). If Hodes were correct that the Act’s confidentiality provisions were only applicable to financial institutions, nonpublic consumer information could be disclosed to any number of third party entities that would be unbound by the Act’s restrictions on the use of that information, rendering its confidentiality provisions largely meaningless.

Hodes, 532 F. Supp. 2d at 115 (emphasis added).

*162¶31 We agree with the Hodes court. The GLBA’s definition of a “nonaffiliated third party” is purposefully broad to better protect nonpublic customer information from those who would misuse it. On this issue, the AGO is situated no differently than Ginnie Mae. We hold that the AGO is a nonaffiliated third party and the GLBA’s confidentially provisions apply.8 This federal provision prohibiting disclosure of information directly conflicts with Washington’s PRA and thus, the GLBA’s nondisclosure provisions preempt the PRA.

¶32 Additionally, the AGO argues that its transfer of information to the Intervenor is not prohibited because, as a Washington citizen, the Intervenor is a necessary “affiliate” of the AGO and vice versa. This interpretation of “affiliated” would seem to make all citizens of Washington “affiliates” of all state agencies, entitling those citizens to use the PRA to obtain nonpublic personal information from state agencies. Thus, this interpretation runs afoul of the GLBA’s specific preemption of inconsistent state law on public disclosure of private, personal information. At least under the GLBA, citizens are not “affiliated” with the AGO.

4. Exception Not Applicable

¶33 As noted above, under 15 U.S.C. § 6802(e)(8), a financial institution may release nonpublic personal information to a nonaffiliated third party, as part of an official government investigation, to government *163regulatory authorities, and “to respond to [the] judicial process.” There is no Washington case law interpreting what “to respond to [the] judicial process” means; however, other jurisdictions have interpreted the phrase to encompass discovery requests in civil litigation.

¶34 In Marks v. Global Mortgage Group Inc., 218 F.R.D. 492 (S.D. W. Va. 2003), the United States District Court for the Southern District of West Virginia held that disclosure of nonpublic personal information to a plaintiff in a civil action was permissible under the “judicial process” language:

The court FINDS that 15 U.S.C. § 6802(e)(8) permits a financial institution to disclose the non-public personal financial information of its customers to comply with a discovery request. The phrase “to respond to judicial process” is syntactically separate and distinct from the phrase “to respond to . . . government regulatory authorities having jurisdiction over the financial institution for examination, compliance or other purposes as authorized by law.” See § 6802(e)(8). Thus, the “judicial process” exemption is independent from, and in addition to, the exception permitting disclosure to comply with a government regulatory investigation.

Marks, 218 F.R.D. at 496 (alteration in original).

¶35 The District Court for the Southern District of West Virginia cited the GLBA’s legislative history to support its holding:

[T]he legislative history indicates that the House Bill, which added the privacy protections to the GLBA, envisaged an independent judicial process exception. See H.R. 74, 106th Cong. 93, 108-09, 124 (1999) (discussing a judicial process exception without reference to “government regulatory authorities . . .”).

Marks, 218 F.R.D. at 496.

¶36 It further concluded that when a party must disclose information under a discovery request, the party is responding to a judicial process. Thus, under the judicial process exception, the financial institution may disclose its *164customers’ nonpublic personal information in response to a plaintiff discovery request. Marks, 218 F.R.D. at 495-96.

¶37 The West Virginia Supreme Court adopted the District Court’s reasoning in Martino v. Barnett, 215 W. Va. 123, 595 S.E.2d 65 (2004). It held that there was “no basis for limiting the effect of the exception to discovery as no such limitation to application of the term ‘judicial process’ appears in the GLBA exception.” Martino, 215 W. Va. at 130.

f 38 The Supreme Court of Alabama also considered the judicial process exception in Ex parte National Western Life Insurance Co., 899 So. 2d 218 (Ala. 2004). After considering the clauses’ syntax, legislative history, and even Black’s Law Dictionary’s definition of “judicial process,” the Alabama court agreed that “the phrase ‘judicial process’ in § 6802(e)(8) encompasses a court order.” Ex parte Nat’l W. Life Ins. Co., 899 So. 2d at 227.

f 39 We agree with these courts and hold that the phrase “judicial process” in 15 U.S.C. § 6802(e)(8) includes a court order entered in civil litigation. Hypothetically, here, the Intervenor could enter into litigation with Ameriquest, begin the discovery process, and gain access to the client files in question through a court order.9 The hypothetical possibility, however, that the Intervenor could get the information directly from Ameriquest under a court order is not enough to satisfy us that the Intervenor is entitled to the information through a PRA request. The Intervenor asks us to make numerous assumptions to reach the conclusion that it would be entitled to the information through a discovery process. Only in actual civil litigation may a trial court properly review the merits of the Intervenor’s requests for production and relevancy of the documents to determine if production is warranted.

*165¶40 Here, there is insufficient information in the record to determine whether the Intervenor is entitled to obtain this nonpublic personal customer information directly from Ameriquest, thus, the Intervenor may not take advantage of the exception provided in 15 U.S.C. § 6802(a).

5. Effect of Redaction

¶41 The AGO indicates that it is redacting the Ameriquest loan files in accordance with AGO policy to protect the nonpublic confidential information in the loan files. Since the GLBA prohibits only release of nonpublic information, this process could take the disclosures beyond the ambit of PRA protections. What information in the loan customers’ files is public is a factual question that the trial court will need to address on remand. Certainly any information that is disclosed by county auditor or treasurer records related to any transaction is already in the public realm. On remand, the trial court must address this issue after the loan customers have been given notice and an opportunity to be heard.

B. Well-Grounded Fear of Immediate Invasion of Rights

¶42 As we have noted, Ameriquest has a proprietary right to keep its business records private. Further, the GLBA requires it to seek protection of confidential client information. Disclosure of its customers’ records to a third party could be an invasion of Ameriquest’s proprietary rights, and the posture of the case on remand will likely be such that it will give Ameriquest a well-grounded fear of immediate invasion of its rights. Under the preliminary injunction standard, Ameriquest will likely satisfy this second prong. See Tyler Pipe Indus., 96 Wn.2d at 792.

C. Actual or Substantial Injury

¶43 On remand, the trial court must determine whether Ameriquest meets the third prong of the preliminary injunction test: that is, it will suffer actual harm if the preliminary injunction is not granted. At oral argument, *166Ameriquest articulated risk of litigation as potential harm. Because the issue of actual or substantial injury has not been briefed or argued in a meaningful way, we do not further address this issue.

IV. Standing under PRA

¶44 The trial court also denied Ameriquest’s preliminary injunction motion for the documents internally generated by the two agencies during the course of the investigation and prosecution of the case. The trial court stated that Ameriquest did not have standing to assert exemptions on behalf of the AGO.10 Having already determined that the trial court improperly joined the preliminary injunction hearing with a trial on the merits, we review this issue.

¶45 Ameriquest argues that the trial court misapprehended its request for judicial review of the AGO’s decision to disclose the confidential documents. It argues that it was not attempting to assert the PRA privileges on behalf of the AGO; rather it sought judicial review of the AGO’s actions in disclosing its attorney work product. The AGO argues that Ameriquest lacks standing to demand judicial review of its actions.

¶46 Ameriquest is a party that will be affected by the disclosure of the AGO’s work product and, thus, it has standing to challenge the AGO’s decision to disclose documents related to it. Ameriquest may also challenge the AGO’s decision to waive applicable exemptions. As we stated in Wilson v. Nord, “a complainant with standing has a fundamental right to have [an] agency abide by the constitution, statutes, and regulations which affect the agency’s exercise of discretion.” 23 Wn. App. 366, 373, 597 P.2d 914 (1979). Further, “the court [has the] inherent power to review agency action which is arbitrary and capricious.” Int'l Fed’n of Prof’l & Technical Eng’rs v. State *167Pers. Bd, 47 Wn. App. 465, 472, 736 P.2d 280 (1987). Establishing standing to pursue this claim, however, does not necessarily mean that Ameriquest can meet the standard for a preliminary injunction restraining production of the AGO’s attorney work product.

¶47 To prevail at a trial on the merits, Ameriquest must prove that the AGO’s behavior was arbitrary and capricious. Ameriquest claims that through discovery it will be able to find the necessary information to prove its claim. An “arbitrary and capricious action” is defined as

“[a] willful and unreasoning action, without consideration and in disregard of facts and circumstances. Where there is room for two opinions, action is not arbitrary and capricious even though one may believe an erroneous conclusion has been reached.”

Int’l Fed’n, 47 Wn. App. at 473 (quoting Pierce County Sheriff v. Civil Serv. Comm’n for Sheriff’s Employees, 98 Wn.2d 690, 695, 658 P.2d 648 (1983)). This is an extraordinarily high bar for Ameriquest to meet at trial, as neither party disputes that the decision to disclose the AGO work product was a discretionary decision. Ameriquest notes its suspicion that “the AGO’s stubborn unwillingness to exercise those exemptions on its own behalf was . . . likely founded on animus towards Ameriquest,” but it cites no actual evidence or expectation that evidence proving arbitrary and capricious behavior will be produced if given the opportunity to conduct discovery. Appellant’s Br. at 21. It provides only the possibility that it will discover something that will prove its case.

¶48 Without any further showing that Ameriquest will be able to prove its claim at trial, the trial court did not err in refusing a preliminary injunction on these materials and, absent some further order from the trial court, the AGO is free to disclose its work product to the Intervenor. Because the case is being remanded and the customers will be allowed to make further factual showings, the trial court may take further evidence or argument on this point and *168grant a preliminary injunction against this disclosure if some additional evidence of abuse of discretion is presented.

¶49 We reverse and remand to the trial court for further proceedings. Initially, the Ameriquest customers whose information is at issue must be notified and given opportunity to present their concerns to the trial court. The trial court must make reasonable provision for contact with these parties. Until the customers have been given a reasonable opportunity to respond, the trial court must protect their nonpublic personal information from disclosure.

|50 The trial court shall also conduct a preliminary injunction hearing using the proper standard. We hold that the GLBA preempts the state PRA where nonpublic personal information is concerned and that the State qualifies as a nonaffiliated third party under the GLBA any time it receives nonpublic personal information from a financial institution under that act. Redaction may be an acceptable solution, but because the GLBA applies, redaction must comply with that act, not just the PRA. This will necessarily require the trial court to determine, under the GLBA, what information is otherwise publicly available.

Review granted at 166 Wn.2d 1010 (2009).