State of New Jersey v. Acosta

UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLUMBIA

PUBLIC CITIZEN HEALTH RESEARCH GROUP et al.,

Plaintiffs, Civil Action No. 19-166 (TJK) v.

PATRICK PIZZELLA1 et al.,

Defendants. STATE OF NEW JERSEY et al.,

Plaintiffs,

v. Civil Action Nos. 19-621 (TJK) PATRICK PIZZELLA et al.,

Defendants.

MEMORANDUM OPINION

To improve the collection of work-related injury data, the Occupational Safety and Health Administration, a component of the Department of Labor, requires qualifying employers to record work-related injuries and illnesses on three standardized forms. At first, OSHA only occasionally collected these forms from employers, either during on-site inspections or as part of broader industry surveys. But in May 2016, OSHA issued a new rule requiring employers to submit them electronically each year.

1 Under Federal Rule of Civil Procedure 25(d), Patrick Pizzella is automatically substituted as a defendant for R. Alexander Acosta.

But before the first filing deadline, OSHA announced that employers would be required only to submit one of the three forms, and it began a rulemaking to formalize this change. And on January 25, 2019, OSHA issued a final rule titled “Tracking of Workplace Injuries and Illnesses.” The rule rescinded portions of the 2016 rule, reverting to occasional collection of two of the forms and continuing the annual, electronic collection of the third.

In response, two sets of plaintiffs, one a group of public health organizations and the other a series of states, filed related lawsuits, claiming that OSHA’s rulemaking violated the Administrative Procedure Act because it is arbitrary and capricious. Plaintiffs in both cases moved for summary judgment. Defendants moved to dismiss the public health organizations’ suit for lack of subject-matter jurisdiction and cross-moved for summary judgment in the suit brought by the states. For the reasons explained below, the Court will grant Defendants’ motion to dismiss the public health organizations’ suit for lack of subject-matter jurisdiction because those plaintiffs have not suffered the required injury to support standing, and grant Defendants’ cross-motion for summary judgment in the states’ suit because the rule is neither arbitrary nor capricious.

Background

A. Statutory and Regulatory Background

1. The OSH Act

The Occupational Safety and Health Act, 29 U.S.C. § 651 et seq. (the “OSH Act”) authorizes the Secretary of Labor to promulgate regulations that require employers to “make, keep and preserve, and make available to the Secretary,” occupational health records. Id. § 657(c)(1); see also id. § 657(c)(2) (authorizing the Secretary to issue regulations requiring employers to “maintain accurate records of, and to make periodic reports on, work-related deaths, injuries and illnesses”). The Act also provides that, “the Secretary . . . shall develop and *3 maintain an effective program of collection, compilation, and analysis of occupational safety and health statistics.” Id. § 673(a).

Under this authority, the Occupational Safety and Health Administration (“OSHA”) requires employers with more than 10 employees to complete three forms documenting workplace injury and illness. First, Form 300, “Log of Work-Related Injuries and Illnesses,” is an annual incident log that contains basic information about each incident. Form 301, “Injury and Illness Incident Report,” provides more narrative details for each incident. Finally, Form 300A, “Summary of Work-Related Injuries and Illnesses,” is an annual summary of all logged incidents. See 29 C.F.R. § 1904.29. Historically, employers submitted these forms only upon request, typically during workplace inspections or through industry-specific surveys.

2. The Electronic Filing Rule

In May 2016, OSHA promulgated a rule (“the Electronic Filing Rule”) requiring employers with 250 or more employees to electronically submit all three forms annually. See Improve Tracking of Workplace Injuries and Illnesses, 81 Fed. Reg. 29,624 (May 12, 2016). The rule also required that in certain industries, employers with only 20 or more employees must annually submit Form 300A. See id. The rule’s preamble specified that collected data would be published to OSHA’s website. Id. at 29,625. OSHA thus determined that with “the information obtained through this final rule, employers, employees, employee representatives, the government, and researchers may be better able to identify and mitigate workplace hazards and thereby prevent worker injuries and illnesses.” Id. at 29,629. The Electronic Filing Rule noted that all data from Form 300A could be made available, but to protect worker privacy, certain personally identifiable information (PII) would need to be redacted before publishing Forms 300 and 301. Id. at 29,632. The rule also noted that software would be used to eliminate PII from the published forms. Id.

OHSA intended the Electronic Filing Rule to come into effect over several years. And the first deadline—July 1, 2017—would only require employers to submit Form 300A for calendar year 2016. 81 Fed. Reg. at 29,640. But on June 28, 2017, shortly before this first filing deadline, OSHA issued a notice of proposed rulemaking (NPRM) to delay the deadline. See Improve Tracking of Workplace Injuries and Illnesses: Proposed Delay of Compliance Date, 82 Fed. Reg. 29,261 (proposed June 28, 2017). And in November, OSHA published a final rule delaying the first deadline until December 15, 2017. See Improve Tracking of Workplace Injuries and Illnesses: Delay of Compliance Date, 82 Fed. Reg. 55,761 (November 24, 2017). Then, in May 2018—after the first filing deadline had passed—OSHA posted an announcement on its website, specifying that again for 2017, employers would be expected only to provide Form 300A. Civil Action No. 19-166, ECF No. 1 (“Public Health Pls. Compl.”), ¶ 22. The announcement also informed the public that OSHA was not accepting Forms 300 and 301 and would issue a NPRM to reconsider, revise, or remove provisions of the Electronic Filing Rule. Id.

On July 30, 2018, OSHA issued a NPRM for a rule that would rescind the electronic filing requirements for Forms 300 and 301. See Tracking of Workplace Injuries and Illnesses, 83 Fed. Reg. 36,494 (proposed July 30, 2018). OSHA proposed the continued electronic collection of Form 300A, the summary form, but a return to only occasional collection of Forms 300 and 301. OSHA cited several justifications for the proposed rule change: risks to worker privacy, the relative uncertainty of the benefits that the data in Forms 300 and 301 may provide, and the opportunity cost of diverting limited resources from other enforcement efforts. Id. OSHA also raised several issues for the public to address during the comment period, including the efficacy of the software intended to remove PII from these forms. Id. at 36,505.

3. The Revised Rule

On January 25, 2019, OSHA issued its Final Rule (“the Revised Rule”) formally rescinding the requirement for electronic submission of Forms 300 and 301 but leaving in place the requirement to submit form 300A. See Tracking of Workplace Injuries and Illnesses, 84 Fed. Reg. 380 (January 25, 2019). As the basis for the Revised Rule, OSHA cited worker privacy and the resources necessary to avoid accidental disclosure of workers’ PII. OSHA noted that while none of the forms request PII, such information is sometimes inadvertently included alongside the requested information. Id. at 384. And OSHA also determined that automated PII-stripping software could not adequately protect worker privacy. Instead, OSHA concluded, its collection of Forms 300 and 301 would require a manual review process to eliminate PII and other contextual information that might allow the re-identification of impacted workers. Id. at 392. And even if it employed a costly manual screening process to remove PII, OSHA noted that it was possible that workers still could be reidentified. Id. at 384.

Alongside these costs, OSHA also concluded that third-party entities would not benefit from continued form collection because the data would not be published. Id. at 391 (noting OSHA had previously “determined publishing the data would do more harm than good” and did not intend to release it.). OSHA also contended that the “data from Forms 300 and 301 would be exempt from disclosure under FOIA exemptions.” Id. at 383. OSHA acknowledged that it may have to release information due to FOIA requests but suggested that any resulting benefits are “uncertain.” Id. Beyond the lack of benefits to outside entities, the Revised Rule also concluded that any benefits to OSHA itself are “uncertain.” It noted that OSHA has “no prior experience” using the data collected in Forms 300 and 301 and is “unsure how much benefit such data would have for [enforcement and outreach] purposes.” Id. at 388. And it discussed OSHA’s experience using the data collected from Form 300A for enforcement purposes. Id. In *6 the end, OSHA “determined that the best use of the agency’s resources at this time is full utilization of 300A and severe injury data, . . . especially when OSHA itself will continue to protect workers by accessing Forms 300 and 301 through on-site inspections and for specific enforcement actions as needed.” Id. at 391. As a result, OSHA decided to cease electronic collection of Forms 300 and 301 and instead direct resources towards “enforcement efforts and compliance assistance, rather than collecting data with uncertain benefits.” Id. at 393.

B. Plaintiffs’ Lawsuits

In Public Citizen Health Research Group, et al. v. Pizzella, 19-cv-166, plaintiffs are three public-health advocacy groups: Public Citizen Health Research Group, the American Public Health Association, and the Council of State and Territorial Epidemiologists (collectively, the “Public Health Plaintiffs”). The Public Health Plaintiffs assert that they are advocacy groups engaged in research, education, and advocacy on matters of public health, including issues of workplace health and safety. They sue the Secretary of Labor, the Department of Labor, and OSHA, asserting that OSHA’s promulgation of the Revised Rule violates the Administrative Procedure Act (“APA”), 5 U.S.C. § 500 et seq.2 See Public Health Pls. Compl. ¶¶ 1, 2. More specifically, they allege that the Revised Rule is arbitrary and capricious because (1) OSHA has “failed to provide a reasoned explanation for reversing its position”; (2) the Revised Rule is “not a product of reasoned decision-making”; and (3) OSHA failed to adequately respond to comments made during rulemaking. Id. at 10. They ask this Court to vacate the Revised Rule. Id. at 11.

2 The Public Health Plaintiffs also filed an earlier related suit through which they sought a preliminary injunction requiring OSHA to stop delay of the Electronic Filing Rule’s deadlines and to accept all three forms, which this Court denied. See Pub. Citizen Health Research Group v. Acosta, 363 F. Supp. 3d 1 (2018) (“Public Citizen I”). Ultimately, the Court dismissed that suit for lack of subject-matter jurisdiction after OSHA promulgated the Revised Rule.

The second group of plaintiffs, the State of New Jersey, the State of Illinois, the State of Maryland, the Commonwealth of Massachusetts, the State of Minnesota, and the State of New York (collectively, the “State Plaintiffs”) also challenge OSHA’s rescission of the reporting requirements for Forms 300 and 301. Civil Case No. 19-621, ECF No. 1 (“State Pls. Compl.”), ¶ 2. They argue that the Revised Rule is arbitrary and capricious because (1) OSHA failed to consider “important aspects of the issue”; (2) OSHA’s explanation for the rule is “contrary to the evidence that was before them”; (3) OSHA failed to address the benefits of the Electronic Filing Rule, as raised by commenters; and (4) OSHA failed to provide an “adequately reasoned explanation” for departure from the Electronic Reporting Rule. Id. ¶¶ 102, 103. For these reasons, they urge the Court to vacate the rule and order OSHA to implement all aspects of the Electronic Filing Rule. Id. ¶ 104.

The State Plaintiffs noticed their case as related to the Public Health Plaintiffs’ case, Civil Case No. 19-621, ECF No. 2, and at the request of the parties, the Court entered a joint scheduling order, Civil Case No. 19-621, ECF No. 14. Both sets of Plaintiffs moved for summary judgment. See Civil Case No. 19-166, ECF No. 16 (“Public Health Pls. MSJ”); Civil Case No. 19-621, ECF No. 18 (“State Pls. MSJ”). In response, Defendants moved to dismiss the Public Health Plaintiffs’ complaint, and in the alternative, for summary judgment. See Civil Case No. 19-166, ECF No. 17 (“Defs. MSJ”). They also moved for summary judgment in the case brought by the State Plaintiffs. Civil Case No. 19-621, ECF No. 20.

Legal Standard

A motion to dismiss under Federal Rule of Civil Procedure 12(b)(1) “presents a threshold challenge to the court’s jurisdiction.” Haase v. Sessions, 835 F.2d 902, 906 (D.C. Cir. 1987). As federal courts are courts of limited jurisdiction, it is “presumed that a cause lies outside this *8 limited jurisdiction.” Kokkonen v. Guardian Life Ins. Co., 511 U.S. 375, 377 (1994). Thus, when faced with a motion to dismiss under Rule 12(b)(1), “the plaintiff bears the burden of establishing jurisdiction by a preponderance of the evidence.” Moran v. U.S. Capitol Police Bd., 820 F. Supp. 2d 48, 53 (D.D.C. 2011) (citing Lujan v. Defenders of Wildlife, 504 U.S. 555, 561 (1992)). In reviewing such a motion, while the Court is not limited to the allegations in the complaint and may consider materials outside the pleadings, the Court must “accept all of the factual allegations in [the] complaint as true.” Jerome Stevens Pharm., Inc. v. FDA, 402 F.3d 1249, 1253 (D.C. Cir. 2005) (alteration in original) (quoting United States v. Gaubert, 499 U.S. 315, 327 (1991)).

“Summary judgment is appropriately granted when, viewing the evidence in the light most favorable to the non-movants and drawing all reasonable inferences accordingly, no reasonable jury could reach a verdict in their favor.” Lopez v. Council on Am.-Islamic Relations Action Network, Inc., 826 F.3d 492, 496 (D.C. Cir. 2016). “The evidence presented must show ‘that there is no genuine dispute as to any material fact and the movant is entitled to judgment as a matter of law.’” Id. (quoting Fed. R. Civ. P. 56(a)). In an APA case in which both parties have moved for summary judgment, “the district judge sits as an appellate tribunal” and “[t]he entire case on review is a question of law.” Am. Bioscience, Inc. v. Thompson, 269 F.3d 1077, 1083 (D.C. Cir. 2001) (internal quotation marks and footnote omitted). “Summary judgment . . . serves as the mechanism for deciding, as a matter of law, whether the agency action is supported by the administrative record and otherwise consistent with the APA standard of review.” Kadi v. Geithner, 42 F. Supp. 3d 1, 9 (D.D.C. 2012).

Under the APA, courts must “hold unlawful and set aside” agency action that is “arbitrary, capricious, [or] an abuse of discretion.” 5 U.S.C. § 706(2)(A). An agency action is *9 arbitrary and capricious if the agency has “entirely failed to consider an important aspect of the problem, [or] offered an explanation for its decision that runs counter to the evidence before the agency.” Motor Vehicle Mfrs. Ass’n of U.S., Inc. v. State Farm Mut. Auto. Ins. Co., 463 U.S. 29, 43 (1983). The scope of review under the “arbitrary and capricious” standard is narrow and “a court is not to substitute its judgment for that of the agency.” Id. Even so, the agency must articulate a satisfactory explanation for its action including a “rational connection between the facts found and the choice made.” Burlington Truck Lines v. United States, 371 U.S. 156, 168 (1962). As a result, a court’s review is limited to deciding whether the agency’s “decision was based on a consideration of the relevant factors and whether there has been a clear error in judgment.” Ctr. For Auto Safety v. Peck, 751 F.2d 1336, 1342 (D.C. Cir. 1985). The reviewing court should not attempt to make up for such deficiencies itself: “[A court] may not supply a reasoned basis for the agency’s action that the agency itself has not given.” Motor Vehicle Mfrs. Ass’n, 463 U.S. at 43. The court will, however, “uphold a decision of less than ideal clarity if the agency’s path may reasonably be discerned.” Bowman Transp. Inc. v. Arkansas-Best Freight System, 419 U.S. 281, 286 (1974).

Analysis

A. Defendants’ Motion to Dismiss the Public Health Plaintiffs’ Complaint for Lack of Standing

The jurisdiction of the federal courts extends only to cases and controversies of the “justiciable sort referred to in Article III”—in other words, claims the plaintiff can show they have “standing” to bring. Lujan, 504 U.S. at 560. To satisfy the standing requirement, a plaintiff must establish at a minimum that (1) he has “suffered an injury in fact—an invasion of a legally protected interest which is (a) concrete and particularized, and (b) actual or imminent, not conjectural or hypothetical,” (2) “a causal connection” exists between the injury and the *10 challenged conduct, and (3) a favorable decision will likely redress the injury. Id. at 560–61 (citations and internal quotation marks omitted).

Defendants argue that the Public Health Plaintiffs lack injury-in-fact and therefore their complaint should be dismissed for lack of subject-matter jurisdiction. See Defs. MSJ at 11; Fed. R. Civ. P. 12(b)(1).3 In response, the Public Health Plaintiffs claim that OSHA’s decision to refrain from collecting and publishing the data from Forms 300 and 301 injures them in two ways: (1) it “substantially limits the type and amount of workplace injury or information” that is available to conduct research analyzing illness and injury threats to workers and (2) it impedes their organizational activities. Civil Action No. 19-166, ECF No. 16-1 (“Carome Decl.”), ¶ 11.

The threshold showing that plaintiffs must make for each element of standing “depends on the stage of the litigation.” Food and Water Watch, Inc. v. Vilsack, 808 F.3d 905, 913 (D.C. Cir. 2015). In evaluating the Public Health Plaintiffs’ standing at the motion to dismiss stage, the Court must presume that they will succeed in their merits claims. See City of Waukesha v. E.P.A., 320 F.3d 228, 235 (D.C. Cir. 2003). But the Public Health Plaintiffs must allege facts satisfying each element of standing to survive a motion to dismiss.

1. Informational Injury

The Public Health Plaintiffs’ first claim is one of informational injury. To establish informational injury, a plaintiff must show that “1) it has been deprived of information that, on its interpretation, a statute requires the government or a third party to disclose to it, and 2) it suffers, by being denied access to that information, the type of harm Congress sought to prevent by requiring disclosure.” Elec. Priv. Info. Ctr. v. Presidential Advisory Comm’n on Election

3 Defendants do not contest State Plaintiffs’ standing.

Integrity, 878 F.3d 371, 378 (D.C. Cir. 2017) (quoting Friends of Animals v. Jewell, 828 F.3d 989, 992 (D.C. Cir. 2016)).

The Public Health Plaintiffs fail to satisfy the first requirement and thus fail to establish informational injury. First, they must point to a statutory provision that requires disclosure of the information at issue. See Friends of Animals, 828 F.3d at 992. The Public Health Plaintiffs cite the Freedom of Information Act (FOIA)—rather than the OSH Act or any similar statute—as the law that purportedly requires disclosure of the information. Civil Action No. 19-166, ECF No. 19 (“Public Health Pls. Opp.”), at 2. But FOIA does not require the disclosure of any specific information to anyone; it applies across the entire executive branch to require access to records when a request has been made and its exemptions are inapplicable. Dep’t of State v. Ray, 502 U.S. 164, 173 (1991). Thus, even if the information at issue is available to the Public Health Plaintiffs through FOIA, to hold that that FOIA is a statute that satisfies the first requirement for informational injury would all but eviscerate the requirement. And indeed, the second requirement—that plaintiffs suffer “the type of harm Congress sought to prevent by requiring disclosure”—also suggests that the statute at issue must require the disclosure of specific information. The Public Health Plaintiffs have cited no case in which a court found that FOIA satisfied the first requirement for informational injury, and in one recent case in this District, the court specifically rejected that proposition. See Judicial Watch, Inc. v. Office of Dir. of Nat'l Intelligence, No. 1:17-CV-00508 (TNM), 2018 WL 1440186, at *3 (D.D.C. Mar. 22, 2018) (finding no informational standing for challenge brought under Intelligence Community Directive where Plaintiff relied on FOIA for a disclosure requirement).

The Public Health Plaintiffs point to Waterkeeper Alliance v. E.P.A., 853 F.3d 527 (D.C. Cir. 2017) to suggest that informational injury can be established where the agency’s *12 information-gathering and information-disclosure obligations arise from different statutes. In Waterkeeper Alliance, the plaintiffs established informational standing to challenge a rule promulgated under the Comprehensive Environmental Response, Compensation, and Liability Act (CERCLA). The rule exempted farms from CERCLA’s requirement that covered entities report to the government air releases from animal waste, information that then would have otherwise been reportable by the government to the public under the requirements of the Emergency Planning and Community Right-to-Know Act (EPCRA). Id. at 532. The D.C. Circuit found that the plaintiffs had suffered an informational injury, even though CERCLA itself contained no public disclosure requirements. Id. at 533. The Court found that EPCRA’s disclosure requirements were “expressly tied” to CERCLA, explicitly piggybacking on CERCLA’s government notification mandates. Id. That is not the situation here. The OSH Act and FOIA do not present the same “complex interplay” as the two statutes at issue in Waterkeepers. Id. Here, the only potential link between OSH and FOIA is the Electronic Filing Rule’s preamble, which references FOIA and notes that OSHA would make the data from Forms 300 and 301 available through FOIA requests. 81 Fed. Reg. at 29,658–62. But this non-binding provision of an agency regulation is far too attenuated a link between these two statutes to conclude that they are “expressly tied” to each other, or suggest the kind of “complex interplay” between them that would provide the basis for informational standing. 4 See Friends of Animals, 828 F.3d at 993 (finding no informational injury despite statute’s disclosure provision where

4 Plaintiff’s invocation of Envtl. Integrity Project v. McCarthy, 139 F. Supp. 3d 25, 38 (D.D.C. 2015) fails for similar reasons. There, the challenged regulation was promulgated under a statute that “contained a public disclosure provision that expressly require[d] that any records, reports, or information obtained under the statute . . . shall be available to the public.” Id. at 36.

plaintiffs were suing to enforce a separate provision that did not mandate the disclosure of information).

The Public Health Plaintiffs also argue that this Court’s decision in Public Citizen I suggested that their entitlement to the information at issue under FOIA could satisfy the first informational injury requirement. Not so. The Court merely held, in addressing the redressability element of standing, that the likelihood that the Public Health Plaintiffs could obtain the information at issue through FOIA could be part of a casual chain, beginning with a favorable court decision, that would redress any injury-in-fact they had suffered. See Public Citizen I, 363 F. Supp. 3d at 14.

2. Organizational Injury

The Public Health Plaintiffs offer a second injury to support standing: impact on their organizational activities. Assessing this kind of injury involves a two-part inquiry (1) “whether the agency’s action or omission to act ‘injured the [organization’s] interest’” and (2) whether “the organization ‘used its resources to counteract that harm.’” People for the Ethical Treatment of Animals v. Dep’t. of Agric., 797 F.3d 1087, 1094 (D.C. Cir. 2015) (“PETA”) (quoting Equal Rights Ctr. v. Post Props, Inc., 633 F.3d 1136, 1140 (D.C. Cir. 2011)); see also Havens Realty Corp. v. Coleman, 455 U.S. 363, 379 (1982) (finding organizational injury where there is an “injury to the organization’s activities” and “[a] consequent drain on the organization’s resources.”). The Public Health Plaintiffs fail to satisfy this first prong, and thus fail to prove organizational, and well as informational, standing.

To satisfy the first prong, the organization “must plausibly allege that the challenged conduct ‘perceptibly impaired [its] ability to provide services’ by causing an ‘inhibition of [the organization’s] daily operations.’” Texas Low-Income Hous. Information Service v. Carson, 427 F. Supp. 3d 43, 52 (D.D.C. 2019) (quoting Food & Water Watch, Inc., 808 F.3d 905 at 919). *14 “[T]he Court’s task is to differentiate between ‘organizations that allege that their activities have been impeded’—which suffices for standing purposes—‘from those that merely allege that their mission has been compromised’—which does not.” Citizens for Responsibility & Ethics in Washington v. U.S. Office of Special Counsel, No. 19-cv-3757 (JEB), 2020 WL 4530647, at *5 (D.D.C. Aug. 6, 2020) (quoting Abigail All. for Better Access to Developmental Drugs v. Eschenbach, 469 F.3d 129, 133 (D.C. Cir. 2006)).

The Public Health Plaintiffs fail to show that the organizations’ daily operations are “inhibit[ed] . . . in a concrete way” by Defendants’ actions. See Citizens for Responsibility and Ethics in Washington, 2020 WL 4530647 at *5 (D.D.C. August 6, 2020) (citing PETA, 797 F.3d at 1094). They allege that they “have lost access to an important source of timely, establishmentspecific information” that is otherwise unavailable, see Public Health Pls. Compl. ¶ 7, but they have failed to show this deprivation has directly inhibited their daily operations. Nor could they. The Public Health Plaintiffs essentially argue that they are being deprived of an anticipated benefit—the data from Forms 300 and 301. And in so doing, they can only describe how they “intended to use” or “would have used” the data “that would have been available” under the Electronic Filing Rule. Civil Action No. 19-166, ECF No. 16-2 (“Benjamin Decl.”), ¶ 4; Carome Decl. ¶ 3; Civil Action No. 19-166, ECF No. 16-3 (“Harrison Decl.”), ¶ 9. This data never played a role in the Public Health Plaintiffs’ ability to provide services or their daily operations. Thus, the Revised Rule, which effectively withholds this data from them, could not have perceptively impaired their ability to provide those services or inhibited those daily operations. And the Public Health Plaintiffs do not point to any case in which a court has held that an organization’s interest suffered injury for standing purposes in a similar situation.

For similar reasons, the Public Health Plaintiffs have not shown that they meet the second prong of the organizational standing test: that they expended resources to counteract their alleged injuries. To satisfy this requirement, an organization must expend resources in response to the impairment of its ability to provide services. Litigation or advocacy expenses do not satisfy this requirement. See Food & Water Watch, 808 F.3d at 919 (“Our precedent makes clear that an organization’s use of resources for litigation, investigation in anticipation of litigation, or advocacy is not sufficient to give rise to an Article III injury.”). And a plaintiff organization “cannot convert its ordinary program costs into an injury in fact.” Nat’l Taxpayers Union, Inc. v. United States, 68 F.3d 1428, 1434 (D.C. Cir. 1995).

Each of the Public Health Plaintiffs claim that the loss of data they would have received from Forms 300 and 301 will set back their efforts, but none assert that they spent any money to counteract this harm. See Carome Decl. ¶ 11 (concluding OSHA’s rescission of the Electronic Filing Rule substantially curtails the type and amount of workplace injury data HRG will be able to use to conduct research); Benjamin Decl. ¶ 6 (explaining without this data it is significantly harder to identify workplace hazards and to develop policies accordingly); Harrison Decl. ¶ 9 (alleging the 2019 Final Rule has caused CTSE and its members to lose access to an important source of injury and illness information). Instead, they represent that their failure to receive this data will require them to “continue to use data available from other sources, [but] such data is not as complete and is more difficult to gather.” Public Health Pls. Opp. at 8. But simply maintaining their current operational costs cannot help them stablish organizational injury. See Nat’l Taxpayers Union, 68 F.3d at 1434 (finding no injury without any evidence that organization was subject “to operational costs beyond those normally expended”). Thus, they *16 have failed to show the “consequent drain on the organization’s resources” necessary to establish organizational injury. Havens Realty Corp., 455 U.S. at 379.

Since the Public Health Plaintiffs have failed to show an impairment of their ability to provide services, nor expenditures to counteract that impairment, they do not have an injury to support organizational standing. Thus, the Court must dismiss their complaint for lack of subject-matter jurisdiction.5

B. Defendants’ and the State Plaintiffs’ Motions for Summary Judgment on the State Plaintiffs’ APA Claim

The State Plaintiffs argue that the Revised Rule violates APA for three broad reasons: (1) OSHA’s calculation of the costs of collecting Forms 300 and 301 was arbitrary and capricious; (2) OSHA’s calculation of the benefits of collecting Forms 300 and 301 was also arbitrary and capricious; and (3) OSHA’s reasoning was internally consistent regarding the Revised Rule’s costs and benefits.

1. OSHA’s Assessment of the Costs of Collecting Forms 300 and 301

A. Changes to OSHA’s Privacy Risk Assessment

First, the State Plaintiffs argue that OSHA’s privacy risk assessment in the Revised Rule is “contrary to the evidence before the agency and not supported by sufficient reasoning.” State Pls. MSJ at 18. And it is true that agency action “based on a factual premise that is flatly contradicted by the agency’s own record does not constitute reasoned administrative decisionmaking, and cannot survive review under the arbitrary and capricious standard.” City of

5 The Public Health Plaintiffs point out that in Public Citizen I, in denying Defendants’ motion to dismiss for lack of subject-matter jurisdiction, this Court found that they had organizational standing to pursue substantially similar claims, a ruling at odds with the one here. Public Citizen I, 363 F. Supp. 3d at 12. The Court notes that for whatever reason, Defendants in that case only contested redressability and not injury-in-fact, so the Court did not have the benefit of the briefing on the injury-in-fact requirement that the parties have provided here. And in any event, that case was eventually dismissed for lack of subject-matter jurisdiction on other grounds.

Kansas City, Mo. v. Dep’t of Hous. & Urban Dev., 923 F.2d 188, 194 (D.C. Cir. 1991). State Plaintiffs argue that the change in how OSHA treated privacy risks from the Electronic Reporting Rule to the Revised Rule is evidence of such contradiction. See Civil Action No. 19-166, ECF No. 1 (“State Pls. Compl.”), ¶ 103; see also Ass’n of Priv. Sector Colls. & Univs. v. Duncan, 681 F.3d 427, 441 (D.C. Cir. 2012) (“An agency’s departure from past practice can . . . if unexplained, render regulations arbitrary and capricious.”). And the State Plaintiffs note that “OSHA carefully considered [privacy issues] when it promulgated the Electronic [Filing] Rule in 2016” and “identified numerous actions it would take” to mitigate privacy concerns. State Pls. MSJ at 16. They insist that the Revised Rule “cites no new evidence” to support OSHA’s “abrupt change of position.” Id. at 17. For that reason, the State Plaintiffs argue, this new position is insufficiently justified and contrary to the evidence before the agency. Id.

But the Revised Rule’s conclusion about the privacy risks at stake is not based on a factual premise “flatly contradicted by the agency’s own record.” City of Kansas City, 923 F.2d at 194. Both the Electronic Filing Rule and the Revised Rule reflect OSHA’s concern with the privacy risks associated with the collection of Forms 300 and 301. Compare 81 Fed. Reg. at 29,632 with 84 Fed. Reg. at 385. The Revised Rule merely reflects a change in the level of risk to privacy that OSHA found acceptable, rather than new information about those risks. And, for what it’s worth, OSHA characterized that change as merely “restor[ing] OSHA’s historical emphasis on protecting the privacy of workers and its longstanding practice of releasing sensitive data on a case-by-case basis only to those with a ‘need to know.’” See 84 Fed. Reg. at 384. The State Plaintiffs evidently disagree with that change. But that hardly makes OSHA’s changed position contrary to the record before it.

In addition, despite the State Plaintiffs’ suggestions otherwise, OSHA need not meet a special burden to adjust the level of risk to privacy that it found acceptable. See F.C.C. v. Fox Television Stations, Inc., 556 U.S. 502, 514 (2009) (there is “no basis in the Administrative Procedure Act or in [Supreme Court] opinions for a requirement that all agency change be subjected to more searching review.”). Of course, an agency should “display awareness that [the agency] is changing position,” but “the APA imposes no special burden when an agency elects to change course.” Home Care Ass’n of Am. v. Weil, 799 F.3d 1084, 1094–95 (D.C. Cir. 2015). But the Revised Rule acknowledges that OSHA changed its position about the level of risk to privacy it found acceptable. Indeed, the Revised Rule describes how “OSHA considered the issue of worker privacy in the 2016 final rule and included protections to reduce the likelihood of sensitive information being made public.” 84 Fed. Reg. at 385. But OSHA concluded that it “no longer views such protections as sufficient,” given the effectiveness of PII-removing software, as well as the risk of reidentification. Id.

Similarly, the State Plaintiffs’ argument that OSHA must provide “a more detailed justification than what would suffice for a new policy created on a blank slate” because the “new policy rests upon factual findings that contradict those which underlay its prior policy” fails. Fox Television, 556 U.S. at 515. As already discussed, the Revised Rule does not stem from new factual findings, but a change in the level of risk to privacy that the agency found acceptable. Thus, it is enough that OSHA has shown awareness of and a reasoned explanation for its change. See Home Care Ass’n, 799 F.3d at 1095.

B. OSHA’s Privacy Standard

Next, the State Plaintiffs argue that OSHA’s determination that manual review of Forms 300 and 301 is required is unsupported by the record in two ways. State Pls. MSJ at 18. They *19 contend that OSHA adopted a standard for handling PII that is a “100 percent privacy guarantee[]” and that is “an unreasonable and unrealistic standard for any entity to set.” Id. at 19. They also assert that the record does not support OSHA’s privacy concerns nor the need for a two-tiered manual review process. Id. Of course, if OSHA’s action is arbitrary, capricious, and unsupported by the record, it would violate the APA. See 5 U.S.C. § 706. But it complies with the statute if is supported by “such relevant evidence as a reasonable mind might accept as adequate” to do so. See Sage IT, Inc. v. Cissna, 314 F. Supp. 3d 203, 207 (D.D.C. 2018) (quoting Consolo v. Fed. Mar. Comm’n, 383 U.S. 607, 620 (1966)).

To begin with, OSHA did not, as the State Plaintiffs say, require the manual review of Forms 300 and 301 to reduce the privacy risk to zero. Instead, the comments that the State Plaintiffs string together in their brief merely reflect that OSHA considered the relevant privacy risks. See 84 Fed. Reg. at 385 (“Although OSHA previously thought to address this issue with software, de-identification software is not 100% effective, and OSHA believes that some PII could be released even after being processed through the software.”). Specifically, the Revised Rule reflects that OSHA decided that manual review of the forms was needed to avoid “expos[ing] sensitive worker information to a meaningful risk of disclosure”—not no risk. Id. at 387 (emphasis added). Otherwise, inasmuch as the State Plaintiffs again question the level of privacy risk that OSHGA found acceptable, for reasons already explained, OSHA did not violate the APA by prioritizing privacy interests as it did; making such a value judgment is well within its discretion. State Farm, 463 U.S. at 43 (“[A] court is not to substitute its judgment for that of the agency.”).6

6 In addition, OSHA’s determination of the privacy risk it found acceptable was of course not the end of the story; it then considered that risk as part of a “balancing test to weigh the value of

Moreover, OSHA’s privacy concerns, and its determination that a manual review process was necessary to remove PII from Forms 300 and 301, are not contrary to or lacking support in the record. As for OSHA’s privacy concerns, the Revised Rule explains that employers often submit PII, even though Forms 300 and 301 do not require it. 84 Fed. Reg. at 384. Citing comments in the administrative record, the rule then explains that automated software may be able to eliminate some of this inadvertently submitted PII, but that it is not capable of the level of review needed to prevent re-identification. Id. And as for OSHA’s determination that a manual review process is necessary, the State Plaintiffs also argue that automated review is enough—and even that two-tier manual review is potentially less effective. State Pls. MSJ at 19–20. They cite evidence in the administrative record for the proposition that automated processes “have been shown to allow for high accuracy” and that the problems they have “are also shared with manual de-identification approaches.” Id. at 20. But the authorities cited by the State Plaintiffs refer to the removal of PII in clinical medical records. See Civil Case No. 19-621, ECF No. 26-1 at 78 (explaining that de-identification targets specific identifiers like “personal names and social security numbers”). Instead, the Revised Rule focuses on the risk of re-identification because of non-PII information contained in Forms 300 and 301. And on that score, OSHA determined that “even if PII could be completely removed from the data, concerns about re-identification would remain.” 84 Fed. Reg. at 384. Moreover, the Revised Rule states that “particularly in a small town,” information like “what was the employee doing just before the incident occurred, what happened, and what was the injury or illness” could allow re-identification. Id. (cleaned up). The articles cited by the State Plaintiffs do not discuss the efficacy of software in removing this

worker privacy against the usefulness of releasing the data.” 84 Fed. Reg. at 384; see also Civil Case No. 19-621, ECF No. 25 (“Defs. Reply”) at 12–13.

kind of contextual information. Thus, neither OSHA’s privacy concerns nor its assessment that manual review is necessary to prevent re-identification is unsupported by or contrary to the record. Both are supported by “such relevant evidence as a reasonable mind might accept as adequate.” Sage IT, Inc., 314 F. Supp. 3d 203 at 207 (quoting Consolo, 383 U.S. at 620).

C. Notice of OSHA’s Cost Assessment

The State Plaintiffs’ final cost-related argument is procedural. They argue that OSHA failed to provide notice and the opportunity to be heard about the two-tier manual review process described in the final Revised Rule. State Pls. MSJ at 20–22. “Notice requirements are designed (1) to ensure that agency regulations are tested via exposure to diverse public comment, (2) to ensure fairness to affected parties, and (3) to give affected parties an opportunity to develop evidence in the record to support their objections to the rule and thereby enhance the quality of judicial review.” Int'l Union, United Mine Workers of Am. v. Mine Safety & Health Admin., 407 F.3d 1250, 1259 (D.C. Cir. 2005). Thus, a proposed rule and the final rule may only differ to the extent that the final rule is a “logical outgrowth” of the proposal. Envtl. Integrity Project v. E.P.A., 425 F.3d 992, 996 (D.C. Cir. 2005); see also 5 U.S.C. § 553(c). “A final rule is a logical outgrowth of a proposed rule only if interested parties should have anticipated that the change was possible, and thus reasonably should have filed their comments on the subject during the notice-and-comment period,” United Mine Workers of Am., 407 F.3d at 1259 (quotations omitted).

State Plaintiffs argue that OSHA violated the APA when it determined, for the first time in the final Revised Rule, that a two-tiered manual review process was necessary to protect PII. State Pls. MSJ at 21. The NPRM had anticipated use of an automated process to remove PII from Forms 300 and 301. 83 Fed. Reg. at 36,503. OSHA thus determined that it would save *22 $53,000 to $64,000 per year if it no longer collected Forms 300 and 301. Id. But the final Revised Rule determined that a manual review process would be necessary to adequately protect privacy. Thus, the Revised Rule added roughly $7.5 million to its proposed savings to account for the manual review process. 84 Fed. Reg. at 402.

Despite its impact on OSHA’s expected savings, the final Revised Rule is a logical outgrowth of the proposed rule with respect to the methods OSHA proposed to use to protect PII. Therefore, the notice the State Plaintiffs received was adequate. “[C]ases finding that a rule was not a logical outgrowth have often involved situations where the proposed rule gave no indication that the agency was considering a different approach, and the final rule revealed that the agency had completely changed its position.” CSX Transp., Inc. v. Surface Transp. Bd., 584 F.3d 1076, 1081 (D.C. Cir. 2009). Here, the NPRM conveyed that OSHA was assessing the proposed automated review of the forms to determine whether that review was adequate to protect PII. The NPRM even asked for comment on the issue. See 83 Fed. Reg. at 36,500 (“What risks to worker privacy are posed by the electronic collection of information from Forms 300 and 301[?] How could OSHA make [these risks] less likely, and what resources would be required?” Id. (“[W]hat other agencies and organizations in the public and private sectors use automated de-identification systems to remove PII from text data before making the data available to the public? What challenges have they faced in using those systems to keep PII protected?”). This was enough to put interested parties on notice that OSHA was reconsidering its approach and weighing alternatives to the automated review process. See CSX Transp., 584 F.3d at 1081 (“[A] final rule represents a logical outgrowth where the NPRM expressly asked for comments on a particular issue or otherwise made clear that the agency was contemplating a *23 particular change.”) Thus, the final Revised Rule is a logical outgrowth of the NPRM, and this change did not violate the APA’s notice requirements.

2. OSHA’s Assessment of the Benefits of Collecting Forms 300 and 301

The State Plaintiffs also argue that OSHA did not properly consider evidence of potential benefits of the collection of Forms 300 and 301. State Pls. MSJ at 22–26. “[A]n agency rule would be arbitrary and capricious if the agency . . . entirely failed to consider an important aspect of the problem.” State Farm, 463 U.S. at 43. And while “an agency’s decision need not be a model of analytic precision to survive a challenge,” Frizelle v. Slater, 111 F.3d 172, 176 (D.C. Cir. 1997) (cleaned up), it must be clear to the Court that an agency has “grapple[d] with” evidence contradicting its position, see Aragon v. Tillerson, 240 F. Supp. 3d 99, 112 (D.D.C. 2017).

State Plaintiffs argue that Defendants failed to consider, or “blithely dismissed” the benefits to three types of entities: (1) state programs addressing worker safety, (2) workers, their representatives, and advocacy groups, and (3) researchers. State Pls. MSJ at 22. As evidence of these benefits, they point to comments in the administrative record discussing the potential use of Form 300 and 301 data for public health and occupational safety studies and efforts. Id. at 22, 23, 25.

The benefits at issue, however, would never accrue to these outside organizations (the State Plaintiffs cite no benefits to OSHA) unless these entities successfully sued to receive Form 300 and 301 data through FOIA. This is so because even before the rulemaking process related to the Revised Rule, OSHA decided not to make the data publicly available. 84 Fed. Reg. at 391 (noting OSHA “determined publishing the data would do more harm than good” and did not intend to release it.). And it is OSHA’s view that the data would be exempt from public disclosure under FOIA, so it will not produce them voluntarily in response to a FOIA request. *24 Thus, the Revised Rule concluded that “many of the benefits discussed by commenters would not materialize.”7 84 Fed. Reg. at 391.

The Court can think of no reason why the APA required OSHA, when promulgating the Revised Rule, to consider benefits that would accrue to outside entities only if those entities successfully sued the agency for the information under FOIA. Regardless of the likelihood those entities would be successful, such a holding would effectively require OSHA to consider FOIA a reason why the information needed to be collected or created in the first place. That stretches the effect of the statute too far. “[O]nly the Federal Records Act, and not the FOIA, requires an agency to actually create records.” Kissinger v. Reporters Comm. for Freedom of the Press, 445 U.S. 136, 152 (1980). FOIA itself “does not obligate agencies to create or retain documents; it only obligates them to provide access to those which it in fact has created and retained.” Id.

Moreover, even if OSHA had to consider the potential benefits accruing to these outside entities if they mounted a successful FOIA lawsuit, the Revised Rule hardly “entirely failed” to consider them. State Farm, 463 U.S. at 43. The rule acknowledged that commenters raised these potential benefits. See 84 Fed. Reg. at 392–93 (“Commenters pointed to OSHA’s statements in the 2016 final rule that collecting data from Forms 300 and 301 would allow the agency to leverage its resources to execute its mission by . . . providing data to employers, workers, unions and academics that would assist them in researching and innovating to improve

7 The State Plaintiffs also argue that OSHA committed to sharing data with state agencies through the Revised Rule. State Pls. MSJ at 23. But that argument misreads the plain language of the rule, which says “OSHA also notes, in response to a comment that some states have more limited surveillance capacity than others, that those states will have access to the summary data collected by OSHA.” 84 Fed. Reg. at 381. The phrase “summary data” refers to the information provided in Form 300A, “Summary of Work-Related Injuries and Illnesses,” which is still collected under the Revised Rule. See generally 84 Fed. Reg. at 380.

workplace safety and health.”); id. at 393 (“Although OSHA identified these potential benefits, OSHA never quantified them.”). But OSHA “d[id] not ignore . . . the possibility that benefits could result from collecting the data, but conclude[d] that the scope of any such benefits [was] uncertain.” Id. Ultimately, OSHA concluded that it “does not believe that these uncertain benefits justify the diversion of OSHA’s resources from other agency initiatives with a proven record of effectiveness.” Id.8 And a court should not substitute its judgment for that of the agency in such matters. See Burlington, 371 U.S. at 168.9 See also Envtl. Integrity Project v. McCarthy, 139 F. Supp. 3d 25, 47 (D.D.C. 2015) (holding that EPA’s decision not to collect information, so it could prioritize other enforcement tools, was not a clear error in judgment).

3. Internal Inconsistencies

Finally, the State Plaintiffs argue that OSHA’s weighing of the costs and benefits of the Revised Rule is internally inconsistent. They note that OSHA’s assessment of the costs of collecting Forms 300 and 301 presumes that the information in those forms will be released, while its assessment of the benefits assumes that the information will not. State Pls. MSJ at 14. And to be sure, “it would be arbitrary and capricious for [an] agency’s decision making to be ‘internally inconsistent.’” Nat. Res. Def. Council v. U.S. Nuclear Regul. Comm’n, 879 F.3d

8 State Plaintiffs also object to OSHA’s dismissal of the benefits of Form 300 and 301 data for research on the grounds “that researchers already have access to BLS data and severe injury data.” 84 Fed. Reg. at 391. But this remark does not mean that OSHA failed to recognize or consider these benefits. The Revised Rule does not say that BLS and other available data are perfect substitutes for the data collected from Forms 300 and 301. Instead, OSHA merely suggested that at least some of the benefits might be realized in other ways, such that lack of access to Form 300 and 301 data will not leave researchers in the dark. 9 The Electronic Filing Rule says that data from Forms 300 and 301 might be “of great use” to outside entities. 81 Fed. Reg. at 29,631. In contrast, the Revised Rule describes those benefits as “speculative.” But the preamble of the Electronic Filing Rule suggested that OSHA would publish the information gathered in the collection of Forms 300 and 301. Id. at 29,625. Afterward, OSHA decided to change course, which accounts for the change.

1202, 1214 (D.C. Cir. 2018) (quoting Air Transp. Ass’n of Am. v. Dep't of Transp., 119 F.3d 38, 43 (D.C. Cir. 1997)); see also Gen. Chemical Corp. v. United States, 817 F.2d 844, 854 (D.C. Cir. 1987) (concluding that agency must weigh evidence “in a rational and consistent manner”).

But OSHA’s response explains how it can simultaneously claim that it “would not make the data public even if collected,” 84 Fed. Reg. at 391, and that “collecting the data . . . would subject sensitive worker information to a meaningful risk of public disclosure.” 84 Fed. Reg. at 383. Before it engaged in the rulemaking that led to the Revised Rule, OSHA decided to change course and not voluntarily provide the data to the public. Thus, for the reasons already explained above, OSHA did not need to consider the benefits of voluntarily disclosing the information to the public, or even those benefits that could accrue if outside entities successfully sued for it under FOIA—and even if it had to do the latter, it did. 84 Fed. Reg. at 393. At the same time, again for reasons already explained above, even if OSHA did not voluntarily disclose the data to the public, it had to weigh the possibility—perhaps even the likelihood 10—that these outside entities might successfully sue to obtain the Form 300 and 301 data, so it had to consider the more ascertainable costs of reducing the privacy risk to the point it found acceptable. 11 See id. at

10 See Pub. Citizen I, 363 F. Supp. 3d at 17. 11 The State Plaintiffs briefly raise a second inconsistency argument. They argue that the Revised Rule is inconsistent as to whether OSHA plans to use data from Forms 300 and 301 in its enforcement efforts. See State Pls. MSJ at 36–37. They claim that the Revised Rule cites the need to protect the confidentiality of enforcement efforts as a reason not to release Form 300 and 301 data. However, they argue, this conflicts with OSHA’s suggestion that it would not use this data for enforcement. But OSHA did not cite the confidentiality of enforcement efforts as a reason why it ceased collection of Forms 300 and 301. The portions of the rule that the State Plaintiffs cite for this proposition address only Form 300A. See 84 Fed. Reg. at 383 (“OSHA has already taken the position that Form 300A is exempt from disclosure under FOIA and that OSHA will not make such data public for at least the approximately four years after its receipt that OSHA intends to use the data for enforcement purposes.”).

381 (assessing costs of PII stripping for potential FOIA release). Nothing about OSHA’s decision-making was logically inconsistent. In fact, this argument appears merely a rehashing of the State Plaintiffs’ earlier challenges to how OSHA assessed the benefits of the Revised Rule.

At bottom, “cost-benefit analyses epitomize the types of decisions that are most appropriately entrusted to the expertise of an agency.” Off. of Commc’n of United Church of Christ v. F.C.C., 707 F.2d 1413, 1440 (D.C. Cir. 1983). And despite the State Plaintiffs’ insistence, it was not arbitrary and capricious for OSHA to prioritize “other agency initiatives with a proven record of effectiveness” over those with “uncertain benefits.” 84 Fed. Reg. at 393. See In re Barr Labs., Inc., 930 F.2d 72, 76 (D.C. Cir. 1991) (“The agency is in a unique—and authoritative—position to view its projects as a whole, estimate the prospects for each, and allocate its resources in the optimal way. Such budget flexibility as Congress has allowed the agency is not for us to hijack.”).

Conclusion

For all the above reasons, Defendants’ Motion to Dismiss, ECF No. 17 in Civil Action No. 19-166, and Motion for Summary Judgment, ECF No. 20 in Civil Action No. 19-621, will be granted and Plaintiffs’ Motions for Summary Judgment, ECF No. 16 in Civil Action No. 19-166 and ECF No. 18 in Civil Action No. 19-621, will be denied. A separate order will issue.

/s/ Timothy J. Kelly TIMOTHY J. KELLY United States District Judge

Date: January 11, 2021