Mission PA, LLC v. W. McKelvey

OPINION BY JUDGE SIMPSON These consolidated appeals arising from an access dispute under the Right-to-Know Law (RTKL) 1 involve complex procedural and substantive questions, including the public nature of applications under the Medical Marijuana Act (Act). 2 We are also presented with requests to supplement the record developed before the Office of Open Records (OOR), thus enlisting this Court's fact-finding functions. The Department of Health (DOH) and five successful applicants for medical marijuana grower/processor or dispensary permits (collectively, Permittees), 3 challenge OOR's final determination, granting in part and denying in part the request of Wallace McKelvey, PennLive and The Patriot-News (collectively, Requester) seeking unredacted copies of their six permit applications pursuant to the RTKL. OOR directed DOH to disclose Permittees' applications with minimal redaction of personal identifiers and proven trade secrets. We decline to supplement the record. On the record developed below, we reverse OOR's final determination in part to allow redaction of specified facility and systems security information, and we affirm in all other respects. I. Background A. Legal Framework The General Assembly enacted the Act, effective as of May 17, 2016, to establish a framework for legalization of medical marijuana in the Commonwealth. DOH is the Commonwealth agency responsible for administering the Act, including promulgating temporary regulations necessary to perform this function. Section 301 of the Act, 35 P.S. § 10231.301 ; Section 1107 of the Act, 35 P.S. § 10231.1107. Attendant to this authority, DOH promulgated temporary regulations and established an application process for businesses seeking permission to operate as medical marijuana organizations. See 28 Pa. Code §§ 1131.1 - 1191.33. Section 302(b) of the Act (relating to public disclosure) provides that applications "are public records and shall be subject to the [RTKL]." 35 P.S. § 10231.302(b). DOH's temporary regulation as to the same subject mirrors the Act by listing applications as "public records ... subject to disclosure under the [RTKL] ...." 28 Pa. Code § 1141.22 (Temporary Regulation). However, the Temporary Regulation states: "the following information is considered confidential, is not subject to the [RTKL] , and will not otherwise be released ... unless pursuant to court order ... information regarding the physical features of, and security measures installed in, a facility." 28 Pa. Code § 1141.22 (b)(9) (emphasis added). Further, in the application instructions, DOH advised all applicants to submit redacted and unredacted copies of their applications with the understanding that redacted copies would be posted on its public website. Although the instructions state all submissions would be subject to disclosure under the RTKL, they also quote the Temporary Regulation which extended protection to "information regarding physical features of and security measures installed in a facility, information in the electronic tracking system" and other information subject to protection by the RTKL or as proprietary under another law. Reproduced Record 4 (R.R.) at 46a. DOH received dozens of applications comprised of thousands of pages, both grower/processor (GP) applications and dispensary (DS) applications. DOH received all applications by March 2017. In late June 2017, DOH announced the award of 12 GP permits and 27 DS permits, including those of Permittees. B. Procedural History In May 2017, Requester initially sought all applications for GP permits and all successful applications for DS permits (Request). In July, DOH denied the Request in part, referring Requester to the redacted copies of GP applications posted on its website, and denying access to DS applications that were not posted yet. DOH's denial grounds included the right to privacy in personal information as well as RTKL exceptions contained in Section 708(b), 65 P.S. § 67.708(b), as to personal identifiers, trade secrets and confidential proprietary information, and records revealing infrastructure or computer security information. DOH explained that its redactions, as opposed to Permittees' redactions it allowed, were marked as "DOH redacted." Requester appealed to OOR only as to Permittees' six applications, both GP and DS applications from Cresco, the GP application from Terrapin, and DS applications from KW Ventures, Mission and Harvest (collectively, Applications). Requester asserted DOH lacked a legal basis for its redactions, emphasizing the disparity of redaction among Permittees. It argued the Applications were public records as a matter of law under the Act. Requester also noted the legislative intent and public interest in disclosure of the redacted information. See Certified Record (C.R.), Item No. 1 (Verified Appeal, Requester Mem. at 4-5, 9-10). OOR requested evidence and directed DOH to notify third parties under Section 1101(c) of the RTKL, 65 P.S. § 67.1101(c). Once notified, all Permittees asked to participate, submitting argument in support. Cresco also submitted an affidavit of its General Counsel John Figone (Figone Affidavit), and Harvest and Terrapin submitted unverified exemption logs. In its position statement, DOH admitted to some improper redaction. 5 C.R., Item No. 4 (August Submission, at 3); R.R. at 37a. DOH also submitted an affidavit of Program Director John Collins generally describing the varied redactions (Director Affidavit). R.R. at 48a-49a. It contained a citation to DOH's Temporary Regulation, 28 Pa. Code § 1141.22 (b)(9), and a general reference to the RTKL. Director explained DOH's redaction process, attesting DOH only redacted as follows: information marked as confidential proprietary by Permittees if not otherwise redacted; personal and financial information; and information related to building and infrastructure security. Director did not connect these redactions to specific parts of the Applications or differentiate between Permittees' Applications. He also alleged no harm related to disclosure. Nonetheless, DOH redacted entire parts of the Applications including: Section 10 (security/surveillance); Section 11C (transport plans); Section 12B (storage plans); Section 14C (inventory management); Section 15 of the DS and Section 16B of the GP applications (diversion prevention); Section 15B of the GP application (waste disposal); and Attachment D (site and facility plans) of both GP and DS applications. R.R. at 43a. Significantly, DOH did not review any of the redacted material before preparing its August Submission. Instead, DOH reviewed the already redacted applications, relying on Permittees' redactions, as evinced by the Director Affidavit. DOH claimed it could not review the unredacted Applications based on the volume of records initially sought in the Request. Realizing that DOH did not review the Applications in unredacted form before asserting exemptions, in September 2017, OOR stayed the matter to allow DOH to evaluate the propriety of Permittees' redactions, to assert any applicable exemptions and to submit supporting evidence. R.R. at 72a-84a (September Opinion). OOR asked DOH to estimate the time for reviewing the Applications, and accepted DOH's verified estimate of 60 days. See R.R. at 95a-98a (DOH Estimate). Requester sought reconsideration of the stay because only "2,844 pages" remained at issue, and because the stay allowed DOH a second opportunity to support exceptions asserted months before. R.R. at 97a (quoting DOH). OOR denied reconsideration. DOH submitted its response early, noting it kept Permittees' redactions for confidential proprietary/trade secrets and security information. R.R. at 104a-37a (November Submission). Specifically, DOH represented it: lifted clearly improper redactions ... maintained [Permittees'] redactions that were proper and appropriately cited ... [and] redactions that may not have been properly cited, but were clearly exempt under another subsection. [It] further maintained redactions where [Permittees] asserted confidential proprietary, trade secret or personal safety and security exemptions , as [DOH] is unable to stand in the shoes of the individual or entity claiming such exemptions. Rather, [DOH] defers to the OOR's determination as to the propriety of these redactions . R.R. at 104a (emphasis added). DOH also submitted an exemption log as to each Application. See R.R. at 114a-36a (DOH Logs). The DOH Logs were verified by its open records officer attesting the "records withheld are described in the preceding exemption log" without additional description in the verification. R.R. at 115a, 121a, 124a, 129a, 131a, 137a. DOH did not submit affidavits describing the information redacted, or explaining the risks (if any) implicated by disclosure. DOH's November Submission was similar to its August Submission. DOH asserted its Temporary Regulation and the infrastructure security exception in Section 708(b)(3) of the RTKL, as to several sections of the Applications in their entirety. However, in addition to those set forth in its August Submission, DOH also listed sections of the Applications corresponding to sanitation and safety (Section 16 of DS, Section 20 of GP), and recordkeeping (Section 17 of DS, Section 22 of GP) as protected on security grounds. Compare R.R. at 43a, with R.R. at 110a. Requester responded to DOH's November Submission, outlining the deficiencies in the exemption logs submitted by DOH and Permittees to date. R.R. at 3615a-32a. OOR then granted Permittees' requests to participate, allowing them to submit additional evidence. Only Terrapin did so. R.R. at 3636a-74a. In December 2017, Terrapin submitted another brief and four affidavits to support its redactions. As to the confidential nature of its financial information, Terrapin submitted the affidavit of Director of Government Affairs Shawn Coleman (Coleman Affidavit). R.R. at 3651a-56a. As to infrastructure and physical security, it submitted the affidavit of Director of Information Technology James Wenzl (Wenzl Affidavit). R.R. at 3658a-62a. As to trade secrets, Terrapin submitted two affidavits regarding their secrecy. It submitted the affidavit of Director of Cultivation Ian Peak as to its growing and harvesting processes (Peak Affidavit), R.R. at 3664a-68a, and of Director of Infused Product Manufacturing Jef Frick, as to its extraction and production processes (Frick Affidavit). R.R. at 3670a-74a. In its brief, Terrapin adopted DOH's arguments as to personal identifiers and argued the Applications do not qualify as "financial records" under the RTKL. Cresco, Mission and KW Ventures relied on their prior submissions. Harvest attempted to submit additional argument and more detailed exemption logs, but OOR did not consider the submission because it was untimely and unsworn. Based on the evidence submitted, OOR issued its final determination granting access to most of the Applications, upholding minimal redaction of personal information under the constitutional right to privacy and as enumerated in Section 708(b)(6)(i) of the RTKL, 65 P.S. § 67.708(b)(6)(i), and allowing Terrapin's redaction of trade secrets. See McKelvey v. Dep't of Health , OOR Dkt. No. AP 2017-1443, 2018 WL 417604 (issued January 12, 2018) (Final Determination). As a matter of law, OOR construed the Act to allow redaction of the Applications in accordance with the RTKL. OOR also concluded KW Ventures, Mission and Harvest did not prove any exemptions because their unsworn submissions were not competent evidence. Overall, OOR noted deficiencies in the evidence submitted. As DOH's evidence lacked sufficient detail about security issues, OOR upheld redaction of only "plans, specifications, including architectural drawings" in Attachment D as clearly exempt under the Temporary Regulation. Id. at 50. OOR rejected Cresco's Figone Affidavit as vague and conclusory. It also rejected as insufficient Terrapin's evidence as to infrastructure security and the confidentiality of its financial information. Ultimately, OOR directed DOH to disclose the Applications with few redactions: specified parts of Attachment D; personal information (birth dates, street addresses, personal identification numbers, bank account numbers, organ donor status and photographs); and, as to Terrapin only, redaction of proven trade secrets. DOH filed a petition for review from the Final Determination, asserting OOR erred in applying its Temporary Regulation and Section 708(b)(3) of the RTKL so narrowly. It claimed all security-related redactions should have been upheld. Permittees filed their respective petitions for review. Mission alleged OOR erred in applying the right to privacy and the RTKL exceptions. KW Ventures argued OOR erred in not upholding all redactions under the Temporary Regulation. 6 Terrapin asserted its affidavits and exemption log met its burden of proof as to its extensive redaction. Cresco and Harvest, represented by the same counsel, contended the Applications were proprietary in their entirety and alleged OOR erred in applying the RTKL exceptions. Harvest claimed its unsworn exemption log provided sufficient detail, whereas Cresco relied on the Figone Affidavit to prove its exemptions. Requester did not cross appeal as to the redactions OOR upheld. In addition, DOH asks this Court to supplement the record, claiming it relied on Permittees' redactions and so did not assert or support its own exemptions to the redacted information. Mission also seeks to supplement the record with an affidavit from its principal regarding security measures taken in its facilities. 7 II. Discussion Before reaching the merits, we consider the requests to supplement the record filed by DOH and Mission. A. Additional Evidence/Requests to Supplement DOH asks this Court to allow it to supplement the record with a more detailed exemption log. Mission asks to submit an affidavit. Neither party offers a reason for neglecting to submit the evidence to OOR. Generally, this Court declines to serve as fact-finder, a "role ... best reserved for unique occasions." Dep't of Labor & Indus. v. Heltzel , 90 A.3d 823 , 834 (Pa. Cmwlth. 2014) ( en banc ). Where OOR's "record contains no information on [records'] nature and content," we may supplement the record. Pa. State Police v. Grove , 119 A.3d 1102 , 1105-06 (Pa. Cmwlth. 2015), aff'd , 640 Pa. 1 , 161 A.3d 877 (2017). An appeals officer has discretion in developing the record, and may request evidence or explanation from the parties. See Dep't of Educ. v. Bagwell , 114 A.3d 1113 (Pa. Cmwlth. 2015). Nevertheless, "it is not incumbent upon OOR to request additional evidence when developing the record. Rather, it is the parties' burden to submit sufficient evidence to establish material facts." Highmark Inc. v. Voltz , 163 A.3d 485 , 491 (Pa. Cmwlth. 2017) ( en banc ). To the extent the record developed before OOR is inadequate, DOH and Permittees are at fault for that inadequacy. Lack of evidence, when the parties and participants had a full opportunity to submit evidence to the fact-finder, is not a valid reason for supplementing the record. Id. We are unmoved by DOH's contention that it was unable to evaluate the unredacted Applications based on the sheer volume of records. The time to submit evidence supporting the redactions was the appeals officer stage, not the request stage. As such, the alleged volume of records sought in the request stage offers no excuse. During the appeals officer stage, DOH had the onus to review only six Applications. At that time, only "2,844 pages" were at issue. R.R. at 97a (DOH Estimate, ¶11). Indeed, OOR allowed DOH to set its own time frame for a response. By issuing a stay, OOR afforded DOH additional time and opportunity to raise any applicable exemptions and remedy the identified deficiencies in its review process. DOH neglected to do so. Instead, it responded early, and its November Submission was substantially similar to its August Submission. Compare R.R. at 43a (August Submission), with R.R. at 110a (November Submission). Critically, DOH offered no reason for not submitting the evidence comprised in its request to supplement the record when it had the chance to do so before OOR. DOH has been subject to the RTKL in its current form for more than a decade. During that time, this Court's decisional law consistently underscores the necessity for evidence substantiating how asserted exemptions apply. Similarly, Mission offered no cause for not submitting an affidavit when it had the opportunity. In December 2017, over Requester's objection, OOR allowed Permittees additional time to submit evidence supporting their redactions after Requester detailed the deficiencies in DOH's and Permittees' prior submissions. Only Terrapin submitted additional proof to remedy the identified deficiencies. Moreover, allowing additional evidence at the judicial review stage has implications beyond the present matter. To ensure the RTKL offers an expedient means of access to public records, parties withholding information must be held to their burden of proof. Accepting additional evidence without cause essentially allows agencies to withhold records without legal grounds until reaching a Chapter 13 court, undermining the presumption of openness that forms the foundation of the current RTKL. Here, OOR afforded maximum due process and attempted to develop a thorough record, providing DOH and Permittees more than ample guidance, time and opportunity to support the redactions. Therefore, we decline to review the additional evidence as fact-finder, or to remand to OOR to reopen the record to accept this evidence. To do otherwise would allow Permittees and DOH a "proverbial [third] bite at the apple." Highmark , 163 A.3d at 491 . Accordingly, we deny the requests to supplement the record on appeal, and review the merits in our appellate capacity. 8 B. Merits In these consolidated appeals, this Court is tasked with examining OOR's analysis of several exemptions, and the evidence submitted to prove them. Here, the disparate redaction of the Applications based on different grounds is at issue, as DOH accepted Permittees' redactions without ensuring their consistency. 1. Agency's Duty of Disclosure Under the RTKL, an agency has a mandatory duty to disclose records 9 in its possession unless an exemption applies to protect the requested information. Sections 305(a) and 701 of the RTKL, 65 P.S. § 67.305(a), § 67.701. Entrusted as a gatekeeper of records, an agency fulfills a public service of guaranteed access, guided by the legal presumption of openness. In the request stage, an agency is required to assess the public status of requested records, and if applicable, specify reasons for denying access with "citation of supporting legal authority." Section 903 of the RTKL, 65 P.S. § 67.903. When a record is not exempt, in whole or in part, an agency "shall" provide access by inspection or duplication. 65 P.S. § 67.701. When parts of a record are public, meaning not exempt by another law, privilege or exception under Section 708(b) of the RTKL, 65 P.S. § 67.708(b), an agency "shall grant access to" the public parts of the record pursuant to its disclosure duty. Section 706 of the RTKL, 65 P.S. § 67.706. The RTKL places the statutory duty of disclosure solely on an agency. The RTKL also places the burden of proving any asserted exemptions squarely on an agency. Section 708(a)(1) of the RTKL, 65 P.S. § 67.708(a)(1). The RTKL does not allow an agency to delegate its disclosure duty or burden of proof to third parties. As to records that are not in an agency's possession, this Court explained a third-party contractor may wear the "shoes of [an] agency for purposes of the burden of proof when the contractor performs a governmental function." Allegheny Cty. Dep't of Admin. Servs. v. Parsons , 61 A.3d 336 , 342 (Pa. Cmwlth. 2013). Mindful of the presumption of openness to records in an agency's possession, including records submitted by private parties, decisional law allows third parties to raise and defend exemptions to protect their information. Highmark ; Dep't of Educ. v. Bagwell , 131 A.3d 638 (Pa. Cmwlth. 2016) ; Office of the Governor v. Bari , 20 A.3d 634 (Pa. Cmwlth. 2011). Further, "agencies are not permitted to waive a third party's interest in protecting the records." Bagwell , 131 A.3d at 650 . We reject DOH's premise that its voluntary reliance on Permittees' redactions merely followed this precedent. Our decisions on third-party rights do not compel an agency to defer to a third party's exemptions without regard to their validity or consistent application. 10 As the responding agency, DOH bore the burden of supporting its grounds for partially denying access to the Applications. That a third party may be best suited to provide the most detailed proof does not relieve an agency of its burden. We disapprove of any attempt to shift this burden to third parties, particularly as an agency's duty of disclosure conflicts with a private party's interest in protection. 2. Public Nature Records in an agency's possession are presumed public unless exempt under an exception in the RTKL, a privilege, or another law. Section 305(a) of the RTKL, 65 P.S. § 67.305(a). Also, the RTKL does not supersede the public nature of a record established by statute or regulation. Section 306 of the RTKL, 65 P.S. § 67.306. The Act expressly provides permit applications "are public records and shall be subject to the [RTKL]." Section 302(b) of the Act, 35 P.S. § 10231.302(b) (emphasis added). We agree with OOR that the phrase "subject to" renders the Applications public except when any RTKL exceptions or other exemptions apply. 11 Here, DOH and Permittees asserted the varied redactions are protected under the constitutional right to privacy, certain RTKL exceptions, regarding security and trade secret/proprietary status, and the Temporary Regulation. a. Evidence The party asserting an exemption bears the burden of proving that exemption applies. Global Tel*Link Corp. v. Wright , 147 A.3d 978 (Pa. Cmwlth. 2016) ; Jones v. Office of Open Records , 993 A.2d 339 (Pa. Cmwlth. 2010) (agency must prove its regulation applies). Under Section 708(a)(1) of the RTKL, a party must prove a RTKL exception applies "by a preponderance of the evidence." 65 P.S. § 67.708(a)(1). In this context, we define a preponderance as "a more likely than not inquiry." Borough of Pottstown v. Suber-Aponte , 202 A.3d 173 , 180 n.11 (Pa. Cmwlth. 2019). Only three parties submitted evidence to prove the asserted exemptions: DOH, Cresco, and Terrapin. DOH submitted the Director Affidavit and DOH Logs. Cresco submitted the Figone Affidavit, and Terrapin submitted multiple affidavits. KW Ventures, Harvest and Mission did not submit evidence. Therefore, the redactions of their applications are unsubstantiated, except to the extent the evidence applies to all Permittees. b. Exemptions (i). Right to Privacy First, we consider OOR's application of the constitutional right to informational privacy to certain redactions. As Requester did not file a cross appeal, we do not disturb the redactions OOR upheld premised on this right to privacy. Article I, Section 1 of the Pennsylvania Constitution inures individuals with the right "to control access to, or the dissemination of, personal information about himself or herself." Pa. State Educ. Ass'n v. Dep't of Cmty. & Econ. Dev. , 637 Pa. 337 , 148 A.3d 142 (2016) ( PSEA ). In PSEA , our Supreme Court explained the intersection of the personal right to privacy with the public right to access under the RTKL. Applying precedent analyzing the former law, 12 it reconfirmed that "certain types of [personal] information" may be protected under the right of privacy when the personal right outweighed the public interest in disclosure. 13 Id. at 156-57 (quoting Tribune-Review Publ'g Co. v. Bodack , 599 Pa. 256 , 961 A.2d 110 , 115-16 (2008) ). Ultimately, the Court protected an individual's home address. As to partial address information, however, our Supreme Court remanded to the fact-finder to perform the balancing test of the personal and public interests. See Reese v. Pennsylvanians for Union Reform , 643 Pa. 530 , 173 A.3d 1143 (2017). Balancing of interests by the fact-finder is a crucial part of privacy analysis. Id. Here, after recognizing the competing interests, and an individual's right to privacy in a street address, OOR performed the requisite balancing test. Deferring to OOR as the fact-finder, we decline to rebalance the interests. Id. We discern no error in OOR's analysis of the right to privacy in the residential addresses of certain individuals. First, OOR explained how certain types of information were personal, emphasizing that corporate information is not protected under an individual's right to privacy. Second, OOR recognized the importance of "[v]erification of principals, operators, financial backers or employees" in this budding industry. Section 602(a)(1) of the Act, 35 P.S. § 10231.602(a)(1). Noting the importance of statutory intent, 14 it also emphasized both the legislature and DOH required applicants seeking the privilege of engaging in the medical marijuana business to disclose names and residential addresses of financial backers and principals. The submission of this information to the government is a condition of engaging in this regulated industry. OOR determined the street addresses may be redacted from the applications but required disclosure of the cities, states and zip codes of the residential addresses. Accordingly, residential addresses that reveal an individual's location are not at issue. We are only evaluating an individual's privacy right in the remainder of the residential address. DOH's primary argument that the full names and addresses are exempt is that Requester did not cite any public interest in such information. However, Requester articulated a public interest in identifying individuals who "own, operate and finance medical marijuana organizations." C.R., Item No. 1 (Verified Appeal at 5); see also id. at 9; R.R. at 3618a (Requester's Position Statement). This interest is substantially similar to the interest OOR identified predicated on the Act. The record does not contain support for a reasonable subjective belief that residential addresses would be protected from disclosure. Notably, the application instructions do not list "residential addresses" as confidential information, thus indicating the contrary. C.R., Item No. 4 (August Submission at 12). Further, none of the parties submitted evidence supporting a subjective expectation in the privacy of residential addresses submitted in a voluntary application process. OOR struck an appropriate balance in permitting partial redaction of addresses here. Thus, we discern no error by OOR in analyzing the right to privacy. (ii). Physical & Facility Security To protect the physical features and security measures of permitted facilities, DOH and Permittees asserted Section 708(b)(3) of the RTKL, 65 P.S. § 67.708(b)(3). DOH and Terrapin also asserted the Temporary Regulation. (a). Facility Security Exception Section 708(b)(3) of the RTKL protects from disclosure "[a] record, the disclosure of which creates a reasonable likelihood of endangering the safety or the physical security of a building ... [including] (iii) building plans" disclosing the location or configuration of critical systems. 65 P.S. § 67.708(b)(3)(iii). "For this exemption to apply, 'the disclosure of' the records, rather than the records themselves, must create a reasonable likelihood of endangerment to the safety or physical security of certain structures ...." Suber-Aponte , 202 A.3d at 181 (citation omitted). More than speculation is required. Carey v. Dep't of Corr. , 61 A.3d 367 (Pa. Cmwlth. 2013). OOR concluded that none of the parties met their evidentiary burden to prove this exception. Reviewing the record as a whole, we disagree. Terrapin submitted the Wenzl Affidavit to protect its facility security information. See R.R. at 3658a-62a. Wenzl installed, operated and maintained video surveillance and physical security systems for Terrapin's Pennsylvania facilities, and he has a security certification. Wenzl Affidavit, ¶5. He attested Terrapin's redactions included descriptions of its "security and surveillance systems that are intended to protect unauthorized entrance into the facility; and to prevent and detect diversion, theft or loss of any [s]eeds, medical marijuana plants and medical marijuana products." Id. , ¶11. Terrapin also redacted "information regarding the measures to protect ... the security and safety of its (i) facility ... exhibits and other attachments that describe, for example, the manner in which its patient data information is transmitted, the location of its surveillance and security systems and the process by which it intends to transport its products." Id. , ¶16. Wenzl identified Sections 10, 11, 12, 15, 16 and 20 and Attachments C and D as containing such information. The Wenzl Affidavit contains sufficient detail about some of Terrapin's redactions on security grounds. In concluding otherwise, OOR erred. OOR deemed the Wenzl Affidavit conclusory based on "[t]he breadth of Terrapin's argument [...] as it advocates for the redaction of entire sections without describing the specific information contained therein." Final Determination at 26. We disagree with OOR that a party's legal argument may render its evidence conclusory. Argument and evidence are distinct for purposes of assessing whether an entity satisfied its burden of proof. 15 Just as a position statement does not prove an exception, a position statement does not render evidence incompetent. The Wenzl Affidavit stands on its own merit. However, Terrapin's redaction of entire sections does not comport with the narrow construction of RTKL exceptions and the minimal redaction mandate. Thus, only the locations of security and surveillance measures and the description of the processes for transmitting patient data and transporting products contained in Sections 10, 11, 12, 15, 16 and 20 and Attachments C and D may be redacted. In addition to describing protected content, Wenzl attested to the danger posed by disclosure of Terrapin's security measures. From his knowledge and industry experience, he recognized "credible threats from unauthorized personnel intent on committing crimes or other unethical actions." Wenzl Affidavit, ¶20. Noting the threats of diversion, theft and black-market activity within the medical marijuana industry, Wenzl advised "disclosure of ... security and surveillance measures ... would increase the danger of (i) security breaches; (ii) substantial injury to its staff and customers and (iii) diversion of its medical marijuana products." Id. , ¶21. Based on this evidence, Terrapin proved the security-related content of certain redactions and the danger posed by their disclosure. Thus, we allow limited redaction of the above-described information under Section 708(b)(3) of the RTKL. Although it is tempting for this Court to apply this exception to all Permittees to the same extent it applies to Terrapin, doing so would undermine the evidentiary requirements of the RTKL. A preponderance of the evidence may be the lowest burden of proof, but it still requires evidence unless the facts are uncontested or clear from the face of the RTKL request or the exemption. Therefore, only security information described in competent evidence may be redacted. The DOH Logs verified by its open records officer are competent evidence supporting DOH's redactions under this exception (mis-cited as Section 708(b)(6)(3)), R.R. at 114a-36a. DOH cited this exception to support its redactions from the DS applications submitted by Harvest, Mission and KW Ventures. As to Harvest's application, DOH redacted part of page 222 (R.R. at 1379a) described as "Site Plans/Blueprint" contained in Attachment C (relating to property). R.R. at 114a. As to Mission's application, it redacted a few words on pages 48, 58 and 61 (R.R. at 2704a, 2714a, 2717a) described as "Detailed Information Regarding Storage/Secured Areas" contained in Section 12 (Storage). R.R. at 116a. As to KW Ventures' application, DOH redacted a few words on pages 94, 112-13, and 115 described as "Detailed Information Regarding Storage/Secured Areas" from Section 14 (Inventory Management), R.R. at 122a. DOH also redacted parts and full pages (correlating to R.R. at 3452a-63a) from Section 12 and a few words on pages 451 and 453-54 (R.R. at 3465a, 3467a-69a) for the same reason. Lastly, DOH redacted a few words from a letter (R.R. at 3563a) described as "Transport Fleet Details." Id. Based on the surrounding unredacted content of the Applications, DOH's description of its redactions suffices to trigger this exception. However, DOH provided no evidence as to the "reasonable likelihood of endangering safety" as Section 708(b)(3) of the RTKL requires. 65 P.S. § 67.708(b)(3). Regardless, as to reasonable likelihood, the record as a whole contains sufficient evidence regarding the dangers unique to the medical marijuana industry. We discern no reason for limiting proof of industry-wide risks to Terrapin alone. The Wenzl Affidavit establishes that disclosure of specified security information has a reasonable likelihood of endangering physical security of facilities engaged in the "legal cannabis industry." Wenzl Affidavit, ¶8. Moreover, the application form itself recognizes the threat of diversion. See Sections 15 of the DS application and 16B of the GP application (diversion prevention). Permittees completed the same application form seeking information about security measures. Based on the risks inherent in this cash-based industry, disclosure of security measures and locations of surveillance systems presents a credible threat to physical security of facilities that amounts to more than mere speculation. Carey . Because the record as a whole contains sufficient evidence satisfying the reasonable likelihood prong, we uphold DOH's minimal redactions under Section 708(b)(3) of the RTKL from the applications of Harvest, Mission and KW Ventures. Also, as to Cresco, Figone attested its "application contains detailed descriptions of its security protocols and surveillance systems[,] [s]chematic drawings [that] disclose the location of each of the video surveillance cameras, primary power hook-ups, facility access points, [and] of the vault and other designated high-security areas." R.R. at 63a (Figone Affidavit, ¶12). This sufficiently describes "schematic drawings" and "detailed descriptions of ... surveillance systems" for redaction. Id. Accordingly, this information may be redacted from Cresco's application. In sum, the record supports certain redactions under Section 708(b)(3). Thus, we reverse OOR's Final Determination as to its application of this exception. (b). Temporary Regulation Only DOH and Terrapin asserted the Temporary Regulation as an exemption. 16 Importantly, DOH did not submit any supporting evidence. Jones . The DOH Logs do not cite the Temporary Regulation, and the Director Affidavit does not describe the contents of any of the Applications to support redaction. As such, we discern no error in OOR allowing limited redaction of Attachment D on this ground. (iii). Trade Secret & Confidential Proprietary Exception Permittees claim that various parts of the Applications are protected under Section 708(b)(11) of the RTKL, 65 P.S. § 67.708(b)(11). Section 708(b)(11) protects "a record that constitutes or reveals a trade secret or confidential proprietary information" from disclosure. 65 P.S. § 67.708(b)(11). We analyze the trade secret and confidential proprietary aspects of this exception separately. Bari . (a). Trade Secret Status Section 102 of the RTKL defines "trade secret" in pertinent part as: Information including a formula, drawing, pattern, compilation, including a customer list, program, device, method, technique or process that: (1) derives economic value, actual or potential, from not being generally known to and not being readily ascertainable by proper means by other persons who can obtain economic value from its disclosure or use; [and] (2) is the subject of efforts that are reasonable under the circumstances to maintain its secrecy. 65 P.S. § 67.102. See also Uniform Trade Secrets Act, 12 Pa. C.S. § 5302 (same). A fact-finder considers six factors to determine trade secret status under the RTKL: (1) the extent to which the information is known outside of the business; (2) the extent to which the information is known by employees and others in the business; (3) the extent of measures taken to guard the secrecy of the information; (4) the value of the information to the business and to competitors; (5) the amount of effort or money expended in developing the information; and (6) the ease or difficulty with which the information could be properly acquired or duplicated by others. Smith v. Dep't Envtl. Prot. , 161 A.3d 1049 (Pa. Cmwlth. 2017). The most important indicia for determining whether information constitutes a trade secret are "substantial secrecy and competitive value to the owner." W. Chester Univ. of Pa. v. Schackner (Bravo) , 124 A.3d 382 (Pa. Cmwlth. 2015). Trade secret status is a fact-specific inquiry, and must be decided "on a case-by-case basis." O.D. Anderson, Inc. v. Cricks , 815 A.2d 1063 , 1071 (Pa. Super. 2003). Permittees had the opportunity to submit additional evidence to OOR after receiving Requester's brief outlining the deficiencies in the evidence DOH submitted. Because the evidence Permittees submitted varies considerably as far as competence and quality, we review the evidence of each Permittee separately. As to trade secrets, Terrapin submitted the Peak Affidavit and the Frick Affidavit. These affidavits offer a model for establishing the trade secrets exception. Peak attested to his considerable experience in marijuana cultivation throughout the life cycle of the plants. He devoted years to developing the nutrient regimen, fertilization for growing and enhancing the growth process. See Peak Affidavit, ¶¶5-7. He attested to the competitiveness of the medical marijuana industry, and the interest in producing a high-quality product. Id. , ¶¶9, 15. His descriptions of Terrapin's growing and processing methods, nutrient and additive practices, and harvest processes establish that information constitutes trade secrets. Frick attested to his experience in extraction processes and the manufacturing of cannabis products. He explained this specialized technique was developed after investing significant time and resources. Accordingly, the Frick Affidavit establishes the trade secret status in the extraction and oil manufacturing processes of cannabis products. Frick Affidavit, ¶¶5, 6, 16-18. Regarding the competitive nature of the industry and the trade secret status of the growing, cultivation, nutrition, additive, extraction and harvest processes and practices, we deem the Peak Affidavit and Frick Affidavit sufficient evidence of the first prong of the trade secret exception, applicable as to all Permittees. See , e.g., Dep't of Pub. Welfare v. Eiseman , 85 A.3d 1117 (Pa. Cmwlth. 2014) ( en banc ), rev'd on other grounds , 633 Pa. 366 , 125 A.3d 19 (2015) (recognizing testimony by expert in the field may support multiple managed care organizations' claims of trade secret status in negotiated rates). Accordingly, these processes are trade secrets that may qualify for protection if Permittees meet the second criterion, i.e. , undertaking reasonable steps to maintain secrecy of the described secrets. As OOR concluded, Terrapin established its reasonable efforts to maintain secrecy of trade secrets. See Peak Affidavit, ¶¶21-23; Frick Affidavit ¶¶20-23. None of the other Permittees submitted evidence of the second prong. Other than Terrapin, among Permittees only Cresco submitted evidence. Although Figone confirmed the competitiveness of the industry, he did not attest to any steps Cresco undertook to protect secrecy as required to prove this second prong. We also defer to OOR's determination that Figone lacked credibility because he deemed Cresco's entire application a trade secret. Figone Affidavit, ¶¶5-7. Because they did not substantiate any steps taken to maintain secrecy, the trade secret claims of Cresco, Harvest, Mission and KW Ventures fail. We also affirm OOR's application of the trade secrets exception to Terrapin. (b). Confidential Proprietary Information Only "[c]ommercial or financial information received by an agency: (1) which is privileged or confidential; and (2) the disclosure of which would cause substantial harm to the competitive position of the person that submitted the information" is protected by the confidential proprietary exception. Section 102 of the RTKL, 65 P.S. § 67.102. The measures undertaken to maintain secrecy of the information are important indicators of its confidential nature. Smith . Because none of the Permittees other than Terrapin submitted evidence regarding steps for maintaining secrecy, they fail to prove confidential nature. As such, we consider only whether OOR erred in applying this exception to Terrapin. 17 Terrapin redacted hundreds of pages under this exception. For example, Terrapin redacted all of Attachment B (Organizational Documents), 689 consecutive pages, as "confidential proprietary information." 18 R.R. at 1785a-2474a. In support, Terrapin submitted the Coleman Affidavit. R.R. at 3651a-56a. Coleman advised Sections 3 (Diversity Plan), 10 (Security), 24 (Business History), 27 (Capital Requirements) and 28 (Community Impact) of Terrapin's application contained confidential financial information. However, he did not describe their content sufficiently so as to permit total redaction. Also, Coleman described efforts to maintain confidentiality of "any and all financial information." Coleman Affidavit, ¶16. But the Coleman Affidavit is flawed in that it assumes all financial information is confidential rather than alleging facts to establish its confidentiality. The fact that the medical marijuana industry is extremely competitive does not substantiate Terrapin's extensive redaction here. In removing all indicators of subject matter, there is no context for evaluating the redacted content. See R.R. at 1483a-2642a. Because Terrapin did not prove confidential nature or describe the content of its redactions, we uphold OOR's application of this exception. C. Bad Faith Lastly, we consider Requester's bad faith charge. Requester argues that DOH's failure to review unredacted Applications to assess the appropriateness of Permittees' redactions during the request or appeals officer stage constitutes bad faith. Procedurally, we are not in a position to decide whether DOH committed bad faith when it did not comply with the RTKL during the request stage, or with OOR's directive to evaluate unredacted Applications in the appeals officer stage. See September Opinion. Although Requester refers to OOR's findings regarding DOH's noncompliance with its statutory duties, the statute is clear that only a court may make a finding regarding an agency's bad faith. See Sections 1304 and 1305 of the RTKL, 65 P.S. §§ 67.1304 - 67.1305 ; Uniontown Newspapers, Inc. v. Dep't of Corr. , 197 A.3d 825 (Pa. Cmwlth. 2018) (single j. op.). Whether an agency committed bad faith is not determined as a matter of law; rather, it depends in part on the degree of noncompliance. Uniontown Newspapers, Inc. v. Dep't of Corr. , 151 A.3d 1196 (Pa. Cmwlth. 2016) (declining to grant summary relief as to bad faith). Requester has not enlisted this Court's fact-finding under Chapter 13 of the RTKL here. Notwithstanding DOH's noncompliance with the RTKL, we note this case is distinguishable from Uniontown Newspapers in that DOH did not misidentify responsive records. Throughout, DOH was clear that the Applications were at issue and that DOH relied on Permittees' redactions without assessing them. Whether DOH's approach amounted to bad faith would entail judicial fact-finding. III. Conclusion OOR afforded extraordinary due process to DOH and Permittees, including multiple opportunities to submit evidence supporting their redactions. DOH and Mission offer no reason for not submitting the evidence they want to submit to this Court during that process. Therefore, we deny their applications for relief seeking to supplement the record. Based on the existing record, we reverse OOR's Final Determination as to the sufficiency of the evidence submitted to protect certain security information pursuant to Section 708(b)(3) of the RTKL. The record as a whole demonstrated the reasonable likelihood aspect of the building and physical security exception as applied to medical marijuana facilities such that Terrapin and Cresco may support minimal redaction of the security measures detailed in their affidavits. We also uphold DOH's minimal redaction of the DS applications submitted by Mission, Harvest and KW Ventures as set forth in the DOH Logs. We affirm the Final Determination in all other material respects. ORDER AND NOW , this 4 th day of June, 2019, the Final Determination of the Office of Open Records is REVERSED IN PART , as to the application of Section 708(b)(3) of the Right-to-Know Law, 1 65 P.S. § 67.708(b)(3), in accordance with the foregoing opinion, and is AFFIRMED IN PART as to the remaining exemptions. The applications for relief seeking to supplement the record on appeal filed by the Department of Health and by Mission Pennsylvania, LLC, are DENIED . Footnotes [1] Act of February 14, 2008, P.L. 6, 65 P.S. §§ 67.101 -67.3104. [2] Act of April 17, 2016, P.L. 84, 35 P.S. §§ 10231.101 -10231.2110. [3] In addition to the appeal filed by the Department of Health (DOH) (No. 189 C.D. 2018), Permittees filed petitions for review as follows: Mission Pennsylvania, LLC (Mission) (No. 185 C.D. 2018); Terrapin Investment Fund 1, LLC (No. 186 C.D. 2018) (Terrapin); SMPD Manufacturing, LLC and SMPB Retail, LLC (Harvest) (No. 187 C.D. 2018); Cresco Yeltrah, LLC (Cresco) (188 C.D. 2018); and KW Ventures Holdings, LLC (KW Ventures) (No. 190 C.D. 2018). [4] The reproduced record does not comply with Pa. R.A.P. 2173 in either its printed or electronic form; notably, the two versions differ. Complicating our review and references to the record, parts of the reproduced record lack any pagination, and numbering is completely absent for hundreds of fully redacted pages. In such instances, we cite the certified record. [5] For example, DOH initially redacted labeling processes from DS applications when it did not redact the same information from GP applications. [6] KW Ventures did not file a brief or join any other party's brief. [7] In their petitions for review, Harvest and Cresco requested this Court to accept additional evidence or to remand to allow OOR to accept additional evidence as alternative relief. [8] This Court may review appeals involving Commonwealth agencies on the existing record and defer to OOR as the initial fact-finder. Dep't of Labor & Indus. v. Heltzel , 90 A.3d 823 (Pa. Cmwlth. 2014) ( en banc ). Our review of matters of law is plenary. Id. [9] There is no dispute that the Applications are "records" as that term is defined in Section 102 of the RTKL, 65 P.S. § 67.102, because they were submitted to DOH for agency action. [10] Because Permittees' level of redaction varied widely, DOH's denial of access among the Applications was inconsistent. For example, Cresco redacted almost all of Section 14 (Inventory), whereas KW Ventures did not redact it, so DOH redacted only a few words for security reasons. [11] OOR's jurisdiction to assess statutory and regulatory exemptions pursuant to Section 305(a)(3) of the RTKL, 65 P.S. § 67.305(a)(3), is well-established. Heltzel . [12] Act of June 21, 1957, P.L. 390, as amended , formerly 65 P.S. §§ 66.1 -66.9, repealed by Section 3102(2)(ii) of the RTKL, 65 P.S. § 67.3102(2)(ii). [13] The Court recognized the right to privacy protects three identifiers: social security numbers, telephone numbers and home addresses. Butler Area Sch. Dist. v. Pennsylvanians for Union Reform , 172 A.3d 1173 , 1181 (Pa. Cmwlth. 2017) (citing Tribune-Review Publ'g Co. v. Bodack , 599 Pa. 256 , 961 A.2d 110 (2008) ; Penn. State Univ. v. State Emps.' Ret. Bd. , 594 Pa. 244 , 935 A.2d 530 (2007) ; Sapp Roofing Co. v. Sheet Metal Workers' Int'l Ass'n , 552 Pa. 105 , 713 A.2d 627 (1998) (plurality op.)). [14] Our Supreme Court recognized that in crafting legislation, the legislature is cognizant of privacy interests, such that statutory provisions on public nature reflect the balancing test the legislature already performed. Pa. State Educ. Ass'n v. Dep't of Cmty. & Econ. Dev. , 637 Pa. 337 , 148 A.3d 142 , 157-58 n.8 (2016). [15] An "unsworn position statement does not constitute evidence. Position statements are akin to briefs ... which, while part of the record, are distinguishable from the evidentiary record." Pa. Game Comm'n v. Fennell , 149 A.3d 101 , 104 (Pa. Cmwlth. 2016) (italics in original) (quoting Office of the Governor v. Davis , 122 A.3d 1185 , 1193-94 (Pa. Cmwlth. 2015) ( en banc )). [16] As we allow Terrapin's redaction of sufficiently described physical security information under Section 708(b)(3) of the RTKL, analysis under the Temporary Regulation is unnecessary. [17] In its brief, Terrapin also argues OOR erred in not analyzing whether its financial information qualifies as a "financial record" under Section 102 of the RTKL. Terrapin Br. at 23-27. It was unnecessary for OOR to analyze the definition because it did not conclude Terrapin's financial information was public as a matter of law. Rather, OOR concluded Terrapin did not establish an exception protecting its financial information because it did not submit sufficient evidence. [18] Terrapin also cited Section 708(b)(6) of the RTKL, but it did not explain its application. [1] Act of February 14, 2008, P.L. 6, 65 P.S. §§ 67.101 -67.3104