Ameriquest Mortgage Co. v. Office of Attorney General

J.M. Johnson, J. ¶ 1 This is the second time we have considered this controversy over records Ameriquest Mortgage Company disclosed to the Washington State Office of the Attorney General (AGO). During its investigation of 474 Ameriquest’s lending practices, the AGO obtained a number of e-mail messages from Ameriquest that Ameriquest employees had created while processing consumer loans. The AGO wants to disclose redacted versions of a subset of these e-mails to Melissa A. Huelsman, an attorney who has requested the records in accordance with the Public Records Act (PRA), chapter 42.56 RCW. Ameriquest claims that we decided in Ameriquest Mortgage Co. v. Office of Attorney General, 170 Wn.2d 418, 241 P.3d 1245 (2010), that the Gramm-Leach-Bliley Act of 1999 (GLBA), 15 U.S.C. §§ 6801-6809, and its accompanying regulations prohibit the disclosure of any e-mails containing nonpublic personal information, even after redaction. Ameriquest also claims that the e-mails are shielded by the PRA’s investigative records exemption, RCW 42.56.240, and the Consumer Protection Act (CPA), chapter 19.86 RCW, which shields materials produced in response to a civil investigative demand (CID). Additionally, Ameriquest claims it should be afforded the opportunity to conduct discovery into why the AGO is not invoking the investigative records exemption. ¶ 2 The trial court held that the GLBA did not prevent disclosure, that the PRA exemption and CPA shield were inapplicable, and that Ameriquest does not get discovery. We reverse the trial court in part, holding that the GLBA prevents the AGO from newly redacting and disclosing those e-mails that contain nonpublic personal information, even when the redaction process removes all of the nonpublic personal information. We affirm the trial court’s holding that the PRA investigative records exemption and the CPA’s shield do not apply and that Ameriquest does not get discovery. Facts and Procedural History ¶ 3 In 2003, the AGO began its investigation under the CPA into Ameriquest’s lending practices. In early 2004, the AGO joined together with attorneys general and financial 475 regulators from a handful of other states in its investigation, which eventually expanded to include 49 states and the District of Columbia (Multistate). ¶ 4 In May 2004, Minnesota Assistant Attorney General Prentiss Cox, on behalf of the Multistate, sent a letter to Ameriquest seeking information regarding Ameriquest’s operations. Attached to this letter, Cox sent interrogatories and document requests. Cox wrote that the Multistate was sending this letter “in lieu” of a formal CID in anticipation of Ameriquest’s voluntary cooperation. Clerk’s Papers (CP) at 178. Cox further stated that if Ameriquest preferred a formal CID, Multistate would reissue its demand “under [its] formal investigative authority.” Id. The letter gave Ameriquest 30 days to respond and identified a contact person in each state to whom Ameriquest was to produce the requested information. In response, Ameriquest produced roughly 314,000 employee e-mails and 181,000 email attachments.1 The e-mails vary in form and content but as a whole contain information about Ameriquest’s customers. ¶ 5 In March 2006, the parties reached a settlement and entered a consent decree in Ring County Superior Court. Ameriquest, 170 Wn.2d at 427. The decree contained a provision relating to the PRA: “ ‘If the State receives a request for documents provided by an Ameriquest Party..., the State shall comply with applicable public disclosure laws and promptly provide notice to the Ameriquest Parties ....’” Id. (alteration in original) (quoting clerk’s papers). ¶ 6 In February 2007, Huelsman filed a PRA request for “ ‘[a] 11 records relating to [the] investigation of Ameriquest.’ ” Id. (alterations in original). In discussion with the AGO, Huelsman agreed to narrow her initial request with the expectation that she would seek and receive additional information. The AGO notified Ameriquest of its intention to produce the documents. 476 ¶ 7 After receiving notice, Ameriquest sought to enjoin disclosure and Huelsman joined the suit as an intervenor. The trial court denied the motion, concluding that the federal GLBA did not preempt the PRA and ordered the AGO to redact exempt personal and confidential information from the records before releasing them. The Court of Appeals reversed the trial court, holding that the GLBA did preempt the PRA and prohibited disclosure. Ameriquest Mortg. Co. v. Att’y Gen., 148 Wn. App. 145, 159, 199 P.3d 468 (2009), aff’d on other grounds, 170 Wn.2d 418 (2010). We granted the AGO’s petition for review only on the issue of whether the GLBA preempted or precluded the AGO’s proposed disclosure. Ameriquest, 170 Wn.2d at 428-29. ¶ 8 We held that the GLBA and its accompanying regulations applied to the AGO’s proposed disclosure of nonpublic personal information to Huelsman and do not preempt the PRA because they fall within the PRA’s “other statute” exemption. Id. at 440. We remanded the case to the trial court with the instruction that the trial court apply the GLBA, as we had interpreted it, to determine what records the AGO could disclose. Id. at 441. ¶ 9 On remand, the AGO notified Ameriquest that it would still be disclosing a redacted version of a small subset of the documents. This subset consists of 49 pages of e-mail messages, created by Ameriquest employees processing consumer loans, specifically relating to income falsification and the Blackstone Title Company (E-mails). Ameriquest objected and moved that the disclosure be prohibited on the grounds that (1) the GLBA prohibits disclosure of the aggregated2 and redacted E-mails, (2) the E-mails are covered by the PRA’s investigative record exemption, and (3) the CPA shields the E-mails from disclosure because Ameriquest produced them in response to a CID. Ameri 477 quest also argued it was entitled to discovery to probe the AGO’s rationale behind its decision not to assert the PRA’s investigative records exemption. ¶ 10 After reviewing the E-mails in camera, with the proposed redactions highlighted for its review, the trial court ordered the AGO to produce the E-mails. The trial court held that the GLBA did not prohibit redaction or disclosure in this case, that Ameriquest did not produce the E-mails in response to a CID, and that the PRA’s investigative record exemption did not apply because there was “no law enforcement or investigative function to be protected” by prohibiting disclosure. CP at 378. The trial court stayed its order for 60 days to allow Ameriquest the opportunity to obtain a stay from the Court of Appeals. The Court of Appeals issued its stay, and the parties stipulated to filing the E-mails with the Court of Appeals under seal. ¶ 11 In July 2012, the Court of Appeals certified the case to us pursuant to RAP 4.4 and RCW 2.06.030. We accepted the certification. Ruling Accepting Certification, Ameriquest Mortg. Co. v. Office of Att’y Gen., No. 87661-4 (Wash. July 26, 2012). Issues 112 (1) Whether the GLBA prevents the AGO from redacting the nonpublic personal information in the Emails that the Ameriquest employees created while processing loans and then producing them for public disclosure pursuant to a PRA request. ¶ 13 (2) Whether Ameriquest can enjoin disclosure because the E-mails are covered by the PRA’s investigative records exemption and Ameriquest has shown that either it or a vital government function would be substantially and irreparably harmed by disclosure. ¶ 14 (3) Whether Ameriquest is entitled to discovery to probe the rationale behind the AGO’s decision not to invoke the PRA’s investigative records exemption. 478 ¶ 15 (4) Whether Ameriquest’s voluntary production of materials in response to the Multistate’s letter should be deemed a response to a CID, thereby exempting the E-mails from disclosure. Standard of Review ¶ 16 The application of a statute to a fact pattern is a question of law fully reviewable on appeal. Lobdell v. Sugar ’N Spice, Inc., 33 Wn. App. 881, 887, 658 P.2d 1267 (1983). The interpretation of case law is reviewed de novo. State v. Willis, 151 Wn.2d 255, 261, 87 P.3d 1164 (2004). Agency action taken or challenged under the PRA is reviewed de novo. RCW 42.56.550(3). Appellate courts stand in the shoes of the trial court when reviewing declarations, memoranda of law, and other documentary evidence. See Spokane Police Guild v. Wash. State Liquor Control Bd., 112 Wn.2d 30, 35-36, 769 P.2d 283 (1989). ¶ 17 Trial court discovery rulings are subject to review for abuse of discretion. In re Det. of Halgren, 156 Wn.2d 795, 802, 132 P.3d 714 (2006). A trial court abuses its discretion if its decision is manifestly unreasonable or based on untenable grounds or untenable reasons. In re Marriage of Littlefield, 133 Wn.2d 39, 46-47, 940 P.2d 1362 (1997). Analysis A. The GLBA Prevents the AGO from Redacting and Producing the E-mails 1. Brief Overview of the GLBA ¶ 18 The policy of Congress is that “each financial institution has an affirmative and continuing obligation to respect the privacy of its customers and to protect the security and confidentiality of those customers’ nonpublic personal information.” 15 U.S.C. § 6801(a). To give effect to 479 this policy, the GLBA prohibits a “financial institution” from “disclosing] to a nonaffiliated third party any nonpublic personal information, unless such financial institution provides or has provided to the consumer a notice” and the opportunity to opt out of the disclosure. 15 U.S.C. § 6802(a); 16 C.F.R. § 313.10(a)(1).3 A “nonaffiliated third party” is “any entity that is not an affiliate of, or related by common ownership or affiliated by corporate control with, the financial institution.” 15 U.S.C. § 6809(5). ¶ 19 Several exceptions apply to this prohibition, including one that allows disclosure “to comply with Federal, State, or local laws, rules, and other applicable requirements” or “to comply with a properly authorized, civil, criminal, or regulatory investigation.” 15 U.S.C. § 6802(e)(8); 16 C.F.R. § 313.15(a)(7)(i)-(ii). When a financial institution lawfully discloses nonpublic personal information to a non-affiliated third party pursuant to an exception, the GLBA imposes limits on the nonaffiliated third party’s use or redisclosure of the information. The receiving third party may not reuse or redisclose the nonpublic personal information to another nonaffiliated third party unless it would be lawful for the financial institution to reuse or redisclose the information in that manner. 15 U.S.C. § 6802(c); 16 C.F.R. § 313.11(c)-(d). ¶ 20 In Ameriquest, the parties to the present case agreed that Ameriquest “is a ‘financial institution’ and that the AGO received ‘nonpublic personal information’ from Ameriquest.” 170 Wn.2d at 429. We determined that Ameriquest was authorized to disclose the information to the AGO, a nonaffiliated third party, through the GLBA’s exception for 480 authorized investigations. Id.; see also 15 U.S.C. § 6802(e)(8); 16 C.F.R. § 313.15(a)(7)(h). We also decided that the AGO and Huelsman were not affiliates, so the AGO could not freely share with Huelsman any GLBA-protected information it had received from Ameriquest unless other grounds existed for doing so. Ameriquest, 170 Wn.2d at 430. ¶ 21 In the present case, the parties remain in the same GLBA-defined positions. Ameriquest is still a financial institution that gave records (the E-mails) containing at least some nonpublic personal information to the AGO, a nonaffiliated third party, and since neither the AGO nor Huelsman have become companies, they remain unaffiliated. Consequently, it is necessary to proceed through the remainder of the GLBA framework as detailed in our Ameriquest decision. 2. Defining “Nonpublic Personal Information” ¶ 22 The regulations define “nonpublic personal information” as (1) “[personally identifiable financial information” (PIFI) or (2) “[a]ny list, description, or other grouping of consumers (and publicly available information pertaining to them) that is derived using any personally identifiable information that is [(3)] not publicly available.” 16 C.F.R. § 313.3(n)(l)(i)-(ii). In Ameriquest, we stated that it is through these three definitional filters that information must pass before it can be properly classified as GLBA protected. 170 Wn.2d at 431. f23 We explained that the first filter, PIFI, is any information given in the context of the provision of a financial product or service (1) that a consumer gives to a financial institution (2) about a consumer resulting from any transaction involving a financial product or service, or (3) that a financial institution obtains about a consumer. Id. (citing 16 C.F.R. § 313.3(o)(l)). “ ‘[Information that does not identify a consumer, such as aggregate information or blind data that does not contain personal identifiers such as account numbers, names, or addresses’ ” is not PIFI. Id. 481 (quoting 16 C.F.R. § 313.3(o)(l), (2)(ii)(B)). We held that consumer names, addresses, and phone numbers in the Ameriquest case were PIFI due to the fact that they were personal identifiers and revealed that the individual was an Ameriquest customer. Id. at 431-32. Importantly, we noted that information is defined as PIFI based on its nature and not on the vessel in which it is carried. Id. at 432. In other words, it does not matter if the information is contained in loan files, e-mails, or in the AGO’s internal work product; if it is PIFI, it is PIFI. Id. ¶ 24 As for the second filter, we stated that if the information included in lists, descriptions, or other groupings of consumers was “ ‘derived using any nonpublic personal information,’ ” then it is “automatically protected.” Id. at 435 (quoting 15 U.S.C. § 6809(4)(C)(i) and citing 16 C.F.R. § 313.3(n)(l)(ii)). “Even if some publicly available information is included in such a grouping, all of the information in the list or grouping is deemed nonpublic personal information.” Id. (citing 15 U.S.C. § 6809(4)(C); 16 C.F.R. § 313.3(n)(2)(i)). We held that any list, description, or other grouping the AGO proposed to produce must be nonpublic personal information because the AGO “necessarily must [have] derive[d] the grouping using [PIFI], such as the fact that the consumer is or was an Ameriquest customer.” Id. ¶ 25 We defined the third filter, publicly available information, as that which the financial institution has “a reasonable basis to believe” is publicly available through other sources like government records or the media. Id. at 432-34 (emphasis omitted). We held that nonaffiliated third parties, like the AGO, are prohibited by the GLBA from recasting nonpublic personal information as exempt publicly available information. Id. at 434. We reasoned that consumers have consented in giving their information to financial institutions, but not to nonaffiliated third parties. Id. Therefore, allowing nonaffiliated third parties to “rummage through the consumer’s information” to determine if it is public “would conflict with the carefully drawn [GLBA] 482 limits on a third party’s use and redisclosure of the protected information.” Id. We concluded that any information provided by Ameriquest that meets this definition of “publicly available information” is not nonpublic personal information, “even if the information would otherwise meet the definition of [PIFI].” Id. at 432 (citing 15 U.S.C. § 6809(4)(A); 16 C.F.R. § 313.3(n)(l), (2), (o)(1)). ¶ 26 In the present case, the vast majority of the E-mails contain PIFI. The E-mails that contain PIFI carry an assortment of consumer names and loan numbers, as well as an occasional consumer phone number, e-mail address, or name of a consumer’s employer. As we acknowledged in Ameriquest, the fact that the PIFI is located in an e-mail “vessel” does not change its PIFI nature. 170 Wn.2d at 432. ¶ 27 As for the second filter, the AGO does not appear to be proposing to release any list, description, or other grouping of consumers. In regard to the third, nowhere has Ameriquest determined that the information in question is publicly available.4 3. Redaction and Reuse ¶ 28 A nonaffiliated third party may “ ‘disclose and use’ ” nonpublic personal information only “ ‘in the ordinary course of business to carry out the activity covered by the exception under which [it] received the information.’ ” Id. at 435 (alteration in original) (quoting 16 C.F.R. § 313.11(c)(3)). This is because “ ‘consumers have a privacy interest in the initial use of their nonpublic personal information for the creation of aggregate data.’ ” Id. (quoting Individual Reference Servs. Grp., Inc. v. Fed. Trade Comm’n, 145 F. Supp. 2d 6, 38 (D.D.C. 2001), aff’d sub nom. Trans Union LLC v. Fed. Trade Comm’n, 353 U.S. App. D.C. 42, 295 F.3d 42 (2002)). ¶ 29 Consequently, in Ameriquest we held that since the AGO had obtained the nonpublic personal information 483 under the GLBA exception for government investigations, it was not permitted to “use” any of it for the purposes of public disclosure. 170 Wn.2d at 436. “Public disclosures,” we said, “are not an ordinary part of an investigation.” Id. We further held that “ ‘use’ includes redactions and repackaging of information because the AGO is required to leave the information — and the consumer’s privacy — undisturbed unless the AGO needs to use it in the ordinary course of [its] investigation.” Id. We emphasized that if Ameriquest produced any records to the AGO that did not contain nonpublic personal information, the AGO could disclose those records “because no additional use of protected information [would be] necessary” to disclose them. Id. ¶ 30 We gave the example of a “memorandum analyzing the interest rates given to certain income groups, with no names or addresses included.” Id. The information in such a memorandum would not be nonpublic personal information because it would not include personal identifiers or reveal that any individual was an Ameriquest customer, so it would not contain PIFI, nor, as Ameriquest’s creation, would it be the product of the AGO’s use of PIFI. See id. at 432. ¶ 31 Here, the AGO stands in the same position in which it stood in our Ameriquest decision. The AGO is a nonaffiliated third party that received the E-mails and the nonpublic information they contain through the GLBA’s exception for investigations. Accordingly, the AGO is not permitted to “use” the nonpublic personal information for something besides its investigation. In Ameriquest, we held quite clearly that the definition of “use” includes redaction.5 484 170 Wn.2d at 436. Therefore, simply by redacting the personal identifiers in the E-mails, the AGO has “used” the information, regardless of what is left behind in the messages. Moreover, public disclosure of the nonpublic personal information in question would presumably not be in the ordinary course of the AGO’s long-closed investigation. Consequently, the AGO is not permitted under the GLBA to release the E-mails it received from Ameriquest as part of its investigation when they contain nonpublic personal information, even with its proposed redactions.6 To allow otherwise would violate “ ‘consumers [’] ... privacy interest in the initial use of their nonpublic personal information____’ ” 485 Id. at 435 (quoting Individual Reference Servs. Grp., Inc., 145 F. Supp. 2d at 38).7,8 ¶ 32 The fact that we hold the AGO may not redact and disclose the E-mails containing even one piece of GLBA-protected information does not eliminate the need to examine the PRA and the CPA issues that follow. To the extent there are E-mails that do not contain any GLBAprotected information, they may be released unless the PRA exemption or CPA shield apply. B. The E-mails Are Not Exempt from Disclosure under the Investigative Records Exemption of the PRA, So Ameriquest Cannot Meet Its Burden 1. Brief Overview of the PRA ¶ 33 The PRA requires state and local agencies to “make available for public inspection and copying all public re 486 cords, unless the record falls within the specific exemptions of [the PRA] or other statute which exempts or prohibits disclosure of specific information or records.” RCW 42.56-.070(1). The PRA defines “public record” broadly to include “any writing containing information relating to the conduct of government or [a governmental function]” that is “prepared, owned, used, or retained by any state or local agency.” RCW 42.56.010(3). The PRA is to be “liberally construed and its exemptions narrowly construed ... to assure that the public interest will be fully protected.” RCW 42.56.030. ¶ 34 The PRA requires agencies to facilitate the full disclosure of public records to interested parties through published methods and rules of disclosure. RCW 42.56-.040(1). If an agency withholds requested public records, it must justify its actions. RCW 42.56.070(1), .210(3), .520. Any challenges to agency action involving the PRA are subject to de novo review, and a successful challenger is awarded costs and fees and, at the discretion of the court, a statutory penalty. RCW 42.56.550. 2. The PRA Exemptions ¶ 35 As indicated above, the PRA contains exemptions that protect certain information or records from disclosure.9 See RCW 42.56.070, .230-.480, .600-.610. The exemptions are intended to “exempt from public inspection those categories of public records most capable of causing substantial damage to the privacy rights of citizens or damage to vital functions of government.” Limstrom v. Ladenburg, 136 Wn.2d 595, 607, 963 P.2d 869 (1998). The burden of proof is on the party seeking to prevent disclosure to show that an exemption applies. Id. at 612; RCW 42.56.540, .550(1); see also Ames v. City of Fircrest, 71 Wn. App. 284, 296, 857 P.2d 1083 (1993). Thus, if an agency is 487 claiming an exemption, the agency bears the burden of proving it applies. RCW 42.56.550(1). If it is another party, besides an agency, that is seeking to prevent disclosure, then that party must seek an injunction. RCW 42.56.540. In such a case, the party must prove (1) that the record in question specifically pertains to that party, (2) that an exemption applies, and (3) that the disclosure would not be in the public interest and would substantially and irreparably harm that party or a vital government function. Id.; see Soter v. Cowles Publ’g Co., 162 Wn.2d 716, 757, 174 P.3d 60 (2007); see also Seattle Times Co. v. Serko, 170 Wn.2d 581, 591, 243 P.3d 919 (2010). ¶ 36 Courts should construe exemptions narrowly to allow the PRA’s purpose of open government to prevail where possible. RCW 42.56.030. If there is information in a public record that is exempt and redaction and disclosure is possible, then it is required. See Progressive Animal Welfare Soc’y v. Univ. of Wash., 125 Wn.2d 243, 261, 884 P.2d 592 (1994) (PAWS) (“Portions of records which do not come under a specific exemption must be disclosed.”). A court may even allow for the inspection and copying of exempt records if it finds “that the exemption of such records is clearly unnecessary to protect any individual’s right of privacy or any vital government function.” RCW 42.56.210(2); Oliver v. Harborview Med. Ctr., 94 Wn.2d 559, 567-68, 618 P.2d 76 (1980) (burden shifts to the party seeking disclosure to establish that the exemption is clearly unnecessary). 3. Investigative Records Exemption ¶ 37 The PRA has an exemption for investigative, law enforcement, and crime victim information. RCW 42.56.240. The exemption prohibits the inspection and copying of specific intelligence information and investigative records “compiled by investigative [and] law enforcement . . . agencies . . . , the nondisclosure of which is essential to effective law enforcement or for the protection 488 of any person’s right to privacy.” RCW 42.56.240(1). This exemption is not limited in application to only when law enforcement would cease to function were the documents in question disclosed. Koenig v. Thurston County, 175 Wn.2d 837, 861, 287 P.3d 523 (2012) (J.M. Johnson, J., dissenting). The legislature’s inclusion of the word “effective” allows for a broader application.10 Id. ¶ 38 Deciding whether nondisclosure is essential to effective law enforcement is a question of fact. See Ames, 71 Wn. App. at 295 (citing Cowles Publ’g Co. v. Wash. State Patrol, 109 Wn.2d 712, 715-18, 729-30, 748 P.2d 597 (1988)). When making this factual determination, courts will consider the testimony, declarations, and affidavits of those with knowledge of and responsibility for investigations of that nature. Newman v. King County, 133 Wn.2d 565, 573-75, 947 P.2d 712 (1997); see also Cowles Publ’g Co., 109 Wn.2d at 730-31; Koenig, 175 Wn.2d at 862 (J.M. Johnson, J., dissenting). Appellate courts review a trial court’s decision that relies exclusively on affidavits, declarations, and other documents in making its determination de novo. Bainbridge Island Police Guild v. City of Puyallup, 172 Wn.2d 398, 407, 259 P.3d 190 (2011) (citing PAWS, 125 Wn.2d at 252-53). ¶ 39 For example, in Newman a freelance journalist submitted a public records request in 1994 for the files of the ongoing investigation into the 1969 murder of civil rights leader Edwin Pratt. 133 Wn.2d at 568-69. The King County Department of Public Safety denied most of the request. Id. The trial court held that the investigation file could not have a blanket exemption from disclosure. Id. at 569-70. We granted the county’s request for discretionary review. Id. at 570. 489 ¶ 40 Acknowledging the inherent clash between Washington’s former public disclosure act’s (former chapter 42.17 RCW) preference for open government and the law enforcement exemption’s seemingly broad language, we held this active file exempt in its entirety.11 Id. at 573-75. We recognized that “a court can make a determination about what constitutes an open file or unsolved case and ‘effective law enforcement,’ as required by the exemption, by applying certain standards to proof offered by the agency about the status of the investigation, without reviewing the documents in the file itself.” Limstrom, 136 Wn.2d at 613 (quoting Newman, 133 Wn.2d at 573). Examining the declarations of law enforcement personnel involved, it was apparent to us that “[t]he ongoing nature of the investigation naturally provides no basis to decide what is important.” Newman, 133 Wn.2d at 574. We reversed the trial court, finding that “[t]he determination of sensitive or nonsensitive documents often cannot be made until the case has been solved.” Id. We held that the exemption, therefore, “allows the law enforcement agency, not the courts, to determine what information, if any, is essential to solve a case.” Id. ¶ 41 In Cowles, journalists sought access to the names of police officers against whom complaints had been sustained after the completion of internal investigations. 109 Wn.2d at 713. The relevant agencies consented to providing copies in which they had removed the names of the officers involved and the complaining parties and witnesses. Id. at 714. The newspapers sought unedited versions of the records. Id. at 715. A psychologist gave testimony on behalf of the agencies that if they had to disclose names, officers would adopt a “ ‘code of silence’ ” and instances of misconduct would go unreported. Id. at 716. 490 ¶ 42 Relying on this “ ‘code of silence’ ” testimony, the plurality agreed with the trial court, finding that nondisclosure was essential to law enforcement. Id. at 729. It reasoned that releasing the unedited versions would subject those involved to potential public harassment, embarrassment, and even violence. Id. at 730-31. Given that the agencies relied primarily on voluntary cooperation and on information from informants in these investigations, it concluded that disclosure would seriously hinder future law enforcement efforts. Id. at 732-33. Two justices concurred only in the result on the basis that they thought they could not substitute their judgment for that of the trial court in resolving this factual issue. Id. at 733-34 (Andersen, J., concurring in the result). ¶ 43 In the present case, Ameriquest argues that the investigative records exemption applies and prevents disclosure. The parties agree that the E-mails are investigative records that have been compiled by a law enforcement agency. The parties’ dispute instead centers on whether nondisclosure is essential to effective law enforcement.12 As the party seeking nondisclosure, Ameriquest has the burden of proof. See RCW 42.56.540. ¶ 44 In response to Ameriquest’s contention that the investigative records exemption applies, the AGO submitted the declaration of Douglas D. Walsh, the division chief of the consumer protection division. CP at 302. Walsh stated that in pursuing CPA cases the AGO “primarily relies on evidence” obtained through CIDs and not through voluntary production.13 Id. at 303 (Decl. Walsh ¶ 5). Walsh declared that consequently, public disclosure of the information Ameriquest voluntarily produced will not nega 491 tively impact the AGO’s CPA enforcement activity. Id. Walsh also stated that he personally reviewed the E-mails and was unable to locate any information that must be kept confidential as essential to effective law enforcement. Id. (Decl. Walsh ¶ 6). Specifically, Walsh affirmed that the E-mails do not contain the identity of a confidential informant and do not divulge the AGO’s investigative strategies or practices. Id. at 303-04 (Deck Walsh ¶¶ 7, 8). ¶ 45 Moreover, Walsh stated that disclosing the E-mails would not discourage other defendants from entering into settlement negotiations with the AGO. Id. at 304 (Deck Walsh ¶ 10). Walsh said that this is because settlement is the only means by which a target can control litigation risk. Id. (Deck Walsh ¶ 11). “A final judgment or decree in any [CPA] action brought by the AGO is prima facie evidence against the defendant in any private [CPA] action ... unless the judgment is a consent judgment or decree.” Id. (emphasis omitted) (citing RCW 19.86.130). If a private plaintiff prevails in a CPA action, the trial court may award damages, including treble damages up to $25,000 per consumer. Id. (citing RCW 19.86.090). Also, settlements avoid the risk that a court will impose severe injunctions against certain business practices or higher civil penalties. Id. (Deck Walsh ¶ 12). A fear that documents will be disclosed will not eliminate these incentives. See id. (Deck Walsh ¶ 10). ¶ 46 Additionally, Walsh declared that targets are interested in maintaining the confidentiality of the information they provide and that is why the AGO issues CIDs pursuant to RCW 19.86.110. Id. at 305 (Deck Walsh ¶ 14). CID responses are exempt from public disclosure. Id. (citing RCW 19.86.110(7)). Walsh further stated that assistant attorneys general are instructed not to promise confidentiality unless a specific exemption applies and that defendants typically do not expect that documents will be categorically exempt from public disclosure. Id. (Deck Walsh ¶ 16). Walsh concluded his declaration by noting that the 492 most sensitive documents, the settlement correspondence and materials,14 are subject to public disclosure and the fact that they can be disclosed still does not chill cooperation or settlement. Id. (Decl. Walsh ¶ 17). The trial court considered Walsh’s declaration as well as the declaration of Diane Tiberend15 for Ameriquest when determining that nondisclosure was not essential to effective law enforcement. Id. at 392-93. ¶ 47 Given this evidence, and acknowledging that the trial court relied exclusively on declarations, we affirm the trial court’s finding that the investigative records exemption does not apply. Unlike Newman, this is not an ongoing investigation, so at the very least a blanket application of the exemption is inappropriate. See Newman, 133 Wn.2d at 569, 574-75. Unlike Cowles, Ameriquest has not provided any truly persuasive reason as to why disclosure would harm the AGO’s future law enforcement efforts. See Cowles, 109 Wn.2d at 728-33. Ameriquest attempts to provide a reason by making a broad policy argument, supported with federal authorities, that there is the possibility that disclosure will dissuade future targets from cooperating with the AGO. It is unclear, however, why the disclosure of these particular E-mails will harm Ameriquest. The E-mails do not contain proprietary or trade secret information.16 It is also unclear why disclosure, even if it would harm Ameriquest, would destroy the incentives for settlement that Walsh identified. Furthermore, any concern future parties may have that the documents they provide will be 493 disclosed can easily be allayed by their requesting a CID, which the AGO is willing to provide. See CP at 178. In fact, that is apparently what happens most of the time. Ameriquest has failed to meet its burden. ¶ 48 Ameriquest has failed to demonstrate how an exemption applies or how it or a vital government function would be substantially and irreparably damaged. See RCW 42.56.540. Moreover, Ameriquest has produced no authority or evidence to prove that the public lacks a legitimate interest in monitoring agency investigations. Id. There is case law directly to the contrary. See Bainbridge, 170 Wn.2d at 416 (the public has a legitimate interest to know how a law enforcement agency conducts investigations). C. Ameriquest Is Not Entitled to Discovery To Probe the AGO’s Decision To Not Invoke the Investigative Records Exemption ¶ 49 The trial court deemed Walsh’s declaration sufficient to conclude that the PRA investigative records exemption does not apply, so it effectively denied Ameriquest’s discovery motion. CP at 393. Ameriquest claims that Walsh’s declaration is too conclusory. Ameriquest attempts to bolster this argument by claiming that the AGO treated two other similarly situated targets, Countrywide and Wells Fargo, differently in the past. Ameriquest argues this helps prove nondisclosure is essential to effective law enforcement. The AGO counters that Walsh’s declaration contained sufficient detail and that both of those agreements17 contained provisions similar to the one provided to 494 Ameriquest,18 providing that the information will be kept confidential except as required by law. The AGO further argues that it necessarily is limited by what the law enables it to do with regard to confidentiality. In other words, even if it had promised Ameriquest or anyone else absolute confidentiality, the AGO could not override the PRA with its promises. ¶ 50 We affirm the trial court’s ruling that Ameriquest is not entitled to discovery. Walsh’s declaration is detailed enough in its description of the AGO’s investigative procedures and the incentives affecting targets’ willingness to cooperate and settle. Moreover, the agreements offered to Ameriquest, Wells Fargo, and Countrywide appear similar enough in that they each acknowledge the AGO’s obligations under laws like the PRA. The trial court likely did not abuse its discretion when it denied Ameriquest discovery. D. Ameriquest’s Production of the E-mails Was Not in Response to a CID, So the E-mails Are Not Protected from Disclosure under the CPA ¶ 51 The Washington CPA authorizes the AGO, prior to the initiation of a civil proceeding, to issue a CID. RCW 19.86.110(1); see Steele v. State, 85 Wn.2d 585, 595, 537 P.2d 782 (1975) (finding that the AGO has some latitude in embarking upon investigations without absolute assurances that the CPA has been violated). A CID requires the person upon whom it is served to produce the requested documentary material, answer written interrogatories, give oral testimony, or any combination of such demands. RCW 19.86.110(1). Each CID has to be in writing and (1) state the statute and section or sections the alleged violation of which is under investigation and state the general subject matter of the investigation; and (2) if it asks for documen 495 tation, describe it with reasonable specificity, (3) prescribe a return date; and (4) identify someone on the AGO’s staff to whom the material should be produced. RCW 19.86.110(2). If the recipient refuses to respond to the CID, then the AGO can bring an action in superior court to enforce it and the court can award sanctions for the recipient’s failure to comply. RCW 19.86.110(9). Any documents, answers, or testimony produced in response to a CID cannot be publicly disclosed without the producing party’s consent.19 RCW 19.86.110(7). The CPA is an “other statute” under the PRA that can exempt public records from disclosure. See RCW 42.56.070(1). ¶ 52 In his May 13, 2004, letter to Ameriquest’s general counsel, Cox requested Ameriquest’s voluntary cooperation in the Multistate’s investigation. CP at 178. The letter was accompanied by 23 interrogatories and 24 document requests targeted at Ameriquest’s operations and business practices, including information concerning Ameriquest’s employees and customers. Id. at 172 (Decl. Tiberend ¶ 3), 182-93. Nowhere in the letter are there statutory citations or even a reference to the general subject matter of the investigation, besides what can be gleaned from the references to Ameriquest’s operations and business practices. Id. at 178. The letter does, however, prescribe a return date and provides the contact information and mailing address of Dave Huey of the consumer protection division at the AGO as the designated individual to whom the material should be produced. Id. at 178,181. In the letter, Cox wrote that the Multistate was sending the letter “in lieu” of a formal CID and that if Ameriquest preferred a formal CID, the Multistate would reissue its demand “under [its] formal investigative authority.” Id. at 178. 496 ¶ 53 Ameriquest argues that we should focus on substance over form and recognize that the AGO did in fact issue a CID, despite the language in the letter to the contrary. Ameriquest is correct when it argues that RCW 19.86.110 does not require a CID to be labeled as “formal” or explicitly say that the AGO can strip a CID of its status by simply saying that it is not “formal.” What Ameriquest forgets, however, is that the statutory requirements must be met. Nowhere in Cox’s letter is a statutory citation to the CPA or a description of the general subject matter of the investigation. ¶ 54 To address the lack of statutory citation or description of general subject matter of the investigation, Ameriquest argues that it was in communication with the AGO prior to the receipt of Cox’s letter, so it knew that a CPA investigation was underway. Ameriquest argues that this should be enough to satisfy that element of the statutory requirements. In support of this argument, Ameriquest again points us to federal authorities,20 citing Maccaferri Gabions, Inc. v. United States, 938 F. Supp. 311, 314-15 (D. Md. 1995), in which the district court held that a CID issued by the antitrust division of the Department of Justice (DO J) sufficiently described the nature of the investigation when it used a terse statement that referenced the Sherman Antitrust Statutes.21 In ruling the DOJ’s CID valid, the Maccaferri court found it significant that there were other meetings and communications between counsel for Mac 497 caferri and the antitrust division at which adequate detail was provided as to the nature of the investigation. Id. at 314. Ameriquest’s reliance on Maccaferri, however, is misplaced because the DOJ had actually intended to issue a CID, not request voluntary production and because, despite its being terse, the DOJ’s statement contained a statutory reference, something required by RCW 19.86.110(2) and totally absent in Cox’s letter. ¶ 55 Ameriquest also cites A. Michael’s Piano, Inc. v. Federal Trade Commission, 18 F.3d 138, 140 (2d Cir. 1994), in which the plaintiff sought access, through the Freedom of Information Act (FOIA), 5 U.S.C. § 552, to the records the Federal Trade Commission (FTC) had obtained through requests for voluntary production from a piano manufacturer it was investigating. As an exemption from FOIA, 15 U.S.C. § 57b-2(f) provides that any material the FTC receives during an investigation “which is provided pursuant to any compulsory process ... or which is provided voluntarily in place of such compulsory process shall be exempt from disclosure . . . .” 18 F.3d at 143. The court held that pursuant to 15 U.S.C. § 57b-2(f), as long as the records were relevant to an ongoing investigation within the FTC’s jurisdiction and could have been subpoenaed had the target refused to comply, they were exempt from disclosure. Id. at 145-46. Acknowledging the fact that RCW 19.86.110 lacks any reference to voluntary production, Ameriquest argues that the policy considerations behind protecting voluntary production and the CPA’s instruction for us to be guided by federal law should control. In other words, Ameriquest argues, we should look past the form of the request and look to its substance. ¶ 56 A. Michael’s Piano is unpersuasive. The lack of reference to voluntary production in RCW 19.86.110 is controlling. The PRA is a “strongly worded mandate for broad disclosure of public records.” Hearst Corp. v. Hoppe, 90 Wn.2d 123, 127, 580 P.2d 246 (1978). We are to liberally construe the PRA’s disclosure requirements and narrowly 498 construe its exemptions. RCW 42.56.030. This direction applies to our examination of RCW 19.86.110, an “other statute” under the PRA. See RCW 42.56.070(1). RCW 19.86.110 exempts only materials produced in response to a CID. We should not write an exemption for voluntary production into the statute. See PAWS, 125 Wn.2d at 262 (the “other statute” exemption applies only to exemptions explicitly defined in other statutes; courts should not imply exemptions (citing Brouillet v. Cowles Publ’g Co., 114 Wn.2d 788, 800, 791 P.2d 526 (1990))). This deviation from federal law is firmly “rooted in our own statutes.” Blewett v. Abbott Labs., 86 Wn. App. 782, 788, 938 P.2d 842 (1997). ¶ 57 Bringing the focus back to Washington cases, Ameriquest cites to Steele, 85 Wn.2d at 587, in which the plaintiff employment agency sought to set aside a CID, in part on the ground that the demand violated the Fourth Amendment. We found that where “(1) the inquiry is within the authority of the agency; (2) the demand is not too indefinite; and (3) the information sought is reasonably relevant,” there is no violation of the Fourth Amendment to the United States Constitution. Id. at 594. Ameriquest argues the AGO’s request meets all of these requirements, so it is a CID. The fact that the AGO’s request likely satisfies the Steele test means that the request does not violate the Fourth Amendment, not that it was a CID. Nothing in Steele supports Ameriquest’s argument that a voluntary request receives the same legal status as a compelled process that satisfies all of the requirements under RCW 19.86.110. ¶ 58 Ameriquest attempts to make much of the fact that the AGO allegedly promised that the documents would remain privileged and confidential. Ameriquest argues that these promises amounted to the AGO saying that its request for voluntary production would be given the same protection as a CID. The AGO denies making such promises of confidentiality. Regardless of whether the AGO did make such promises, if the request did not meet the statutory 499 requirements to qualify as a CID, then, pursuant to the PRA’s preference for disclosure, the documents would not be protected from disclosure. As discussed above, the AGO’s request did not amount to a CID. ¶ 59 Finally, Ameriquest argues that to not apply the confidentiality provisions of RCW 19.86.110 to the E-mails would render the statute meaningless. To the contrary, to hold that the AGO’s request for voluntary production amounted to a CID when the request lacked the necessary elements to qualify as a CID, and the request explicitly said it was not a CID, would render the statute meaningless. If the AGO sends a letter to a party asking it to voluntarily produce documentation and in that letter expressly states that the request is not a CID and the party refuses to cooperate, the AGO has no right to judicially enforce the request or to seek sanctions. The fact that the AGO would inevitably follow up a request for voluntary cooperation that is rebuffed with a CID does not change the nature of the initial request. We hold that the AGO’s request for voluntary production was not a CID. Conclusion ¶ 60 The AGO may not disclose the E-mails that contain GLBA-protected information, even after redacting out the protected information. As we held the first time this case was before us, the very act of redaction qualifies as “use” that is prohibited under the GLBA. ¶ 61 However, Ameriquest has failed to meet its burden for an injunction under RCW 42.56.540. The PRA exemption for investigative records does not apply to these records because their nondisclosure is not essential for effective law enforcement. Moreover, Ameriquest has failed to show how the release of the E-mails would harm it or a vital government function in a substantial and irreparable way. Furthermore, the trial court did not abuse its discretion when it ruled that Ameriquest is not entitled to conduct discovery 500 into why nondisclosure is not essential to effective law enforcement. The declaration of Walsh provided the trial court with a sufficient basis for its decision. ¶ 62 Finally, Ameriquest’s production of materials is not shielded from disclosure because it was not in response to a CID. The AGO made it very clear that it was requesting Ameriquest’s voluntary cooperation and was not issuing a CID. Moreover, the AGO’s request did not qualify as a CID under the CPA’s requirements. In obedience to the PRA’s strong policy favoring disclosure, we decline to write a protection for voluntary productions into the CPA. ¶ 63 Accordingly, we reverse the trial court’s decision regarding redaction and disclosure and affirm its holding that the PRA investigative records exemption and the CPA’s shield for CID productions are inapplicable. We remand to the superior court to determine if any of the E-mails are totally devoid of “nonpublic personal information,” as defined by the GLBA. Only E-mails completely devoid of nonpublic personal information, including personally identifying information, may be disclosed in a nonaggregated format. Madsen, C.J.; C. Johnson, Owens, Fairhurst, Stephens, Wiggins, and González, JJ.; and Chambers, J. Pro Tem., concur. Footnotes [1] This is in addition to loan files and other forms of documentation. [2] The AGO produced the E-mails in an aggregated format, apparently due to the fact that Ameriquest gave them to the AGO in an electronic format compatible with the AGO’s Concordance litigation management software, and the printout the Concordance database generates is an aggregation. [3] Pursuant to the rule making authority it possessed at the time, the Federal Trade Commission (FTC) adopted Privacy of Consumer Financial Information, 16 C.F.R. § 313, providing additional direction. The Dodd-Frank Wall Street Reform and Consumer Protection Act, Pub. L. No. 111-203,124 Stat. 1376 (July 21,2010), which included amendments to the GLBA, gave the FTC’s rule making authority in this area to the newly created Bureau of Consumer Financial Protection. See Dodd-Frank Act § 1093,124 Stat. at 2095-96. The relevant regulations in 16 C.F.R. § 313, however, are unchanged and remain in force. [4] The AGO and Huelsman nowhere argue that Ameriquest has made this determination. [5] The AGO points to paragraph 38 of the Ameriquest decision in an attempt to argue that redaction in the manner proposed is permitted. That paragraph states: As we have discussed, however, the GLBA and the FTC prohibit specific information, not entire records. These federal regulations are unconcerned with the containers in which the information is found. Thus, to the extent that a record contains unprotected information, the disclosure of which would not violate the GLBA or the FTC rule, the PRA is not preempted in requiring the record’s disclosure. 484 170 Wn.2d at 440. Taken out of context, the paragraph is somewhat confusing and appears to contradict our clear declaration that redaction constitutes impermissible “use.” See id. at 436. This paragraph immediately follows a discussion of how the PRA. requires redaction where possible but leaves room, through its “other statute” exemption, for other statutes like the GLBA to prohibit redaction. In context, it is clear that the paragraphs mean as follows: As we have discussed, however, the GLBA and the FTC rules control only the disclosure of “nonpublic personal information,” not a specific category or class of records like “records from financial institutions” or “loan processing documents.” This is made clear by the fact that the GLBA and FTC rules apply regardless of where “nonpublic personal information” is found. So, if there is a record that does not contain “nonpublic personal information,” even if that record is from a financial institution or involves the processing of loans, the GLBA and FTC rules will not apply and certainly will not trump the PRA’s requirement that the record be disclosed. Consequently, this paragraph does not stand for the proposition that redaction, as the AGO proposes, is permissible. [6] Accordingly, the AGO’s argument that it is not right to protect a whole chain of connected e-mails because one contains nonpublic personal information also fails. It is understood that each e-mail is an individual message, but when they are linked together in one e-mail as a chain and were produced as one unit to the AGO, they cannot be separated out and disclosed individually, as that would constitute redaction or repackaging. Along those same lines, Ameriquest also argues that because the AGO produced the E-mails to the court as a Concordance printout, it engaged in improper aggregation in violation of the “use” restrictions because that is not exactly how Ameriquest produced the E-mails to the AGO. The AGO claims that the E-mails were in fact produced to the AGO in that way in the sense that they were on DVDs (digital video disks) that were formatted specifically for Concordance. The AGO, however, claims that it has all of the E-mails in their original format and can still produce them in that manner, so this is a moot point. Verbatim Report of the Proceedings (Aug. 12, 2011) at 14. [7] The AGO argues that if this court prohibits redaction and disclosure of these E-mails, it will “extend a shroud of secrecy” over corporate conduct. Br. of Resp’t at 13. What the AGO ignores is the fact that GLBA did not prevent it and other regulatory agencies from obtaining the documents for investigative purposes and that the GLBA would not prevent Huelsman from obtaining the documents through discovery in a lawsuit. See 15 U.S.C. § 6802(e)(8). Moreover, if the AGO had obtained the records like it typically does in such investigations, through a CID, then public disclosure under the PRA would not even be an option. See CP at 302-05; ROW 19.86.110(7). [8] The AGO’s additional argument that a state regulatory agency would be able to insulate records from public disclosure by “inserting nonpublic personal information about financial institution consumers” into the records is similarly unpersuasive. Br. of Resp’t at 18. The GLBA and FTC regulations prohibit nonaffiliated third party recipients of nonpublic personal information, like state regulatory agencies, from using such information outside the context of the “ordinary course of business” of the exception that allowed it to receive the information. 16 C.F.R. § 313.11(c)(3). To the extent the state agencies were inserting nonpublic personal information into random documents to insulate them from public disclosure, they would be violating the GLBA. To the extent they were inserting them into internal work product related to the business of the exception, like memoranda relating to an investigation, they would not be violating the GLBA, nor would they be allowed to disclose those memoranda. That is perfectly in line with our Ameriquest decision. Otherwise, the AGO could have just taken all of the information from the loan files that was nonpublic personal information and repackaged it in memoranda or charts without the personal identifiers to create blind data that then could be treated as public information. See 16 C.F.R § 313.3(o)(2)(ii)(B). This is something we expressly prohibited it from doing. Ameriquest, 170 Wn.2d at 435-36. [9] Including the “other statute” exemption that enables the GLBA’s protections to control where applicable. Ameriquest, 170 Wn.2d at 439-40; see also RCW 42.56.070(1). [10] Ameriquest argues that whether the investigative records exemption applies in this context is a matter of first impression because all previous cases have dealt with prosecutor or police records and confidential informants, so it is necessary to turn to external authorities for guidance. We disagree. It is possible to resolve this issue using our preexisting authorities. [11] Specifically, we looked to affidavits of those with direct knowledge of the investigation to determine whether resources were allocated to the investigation and whether enforcement proceedings were contemplated. Newman, 133 Wn.2d at 573. [12] Ameriquest also contends that the privacy prong of the investigative records exemption is met as to the E-mails containing GLBA-protected information. Because Ameriquest’s argument hinges on whether the GLBA applies to prohibit disclosure, it will not be discussed again here. See supra Part A. [13] Walsh has been negotiating CPA settlements on behalf of the. AGO as an assistant attorney general for 20 years and has served as the division chief since 2006. CP at 302, 304. [14] The settlement documents are the most sensitive because they provide a litigation road map for private plaintiffs. Id. at 305 (Decl. Walsh ¶ 17). [15] This declaration speaks broadly about all of the e-mails that Ameriquest produced, instead of specifically speaking about the subset we are dealing with here, and the type of GLBA and other trade secret and proprietary information they allegedly contain. Id. at 284 (Decl. Tiberend ¶¶ 4, 5). [16] If the E-mails did contain such information, Ameriquest could argue that the PRA exemption for financial, commercial, and proprietary information applies. See RCW 42.56.270. Ameriquest could also argue that the Uniform Trade Secrets Act, chapter 19.108 RCW, applies. [17] The Wells Fargo agreement states that the AGO “shall not disclose or use any confidential information without the prior written consent of the disclosing party, except to the extent required by law, regulation or court order (and in any of these circumstances, only upon prior written notice to Wells Fargo).” CP at 359. The Countrywide agreement states that the AGO “shall not disclose or use any confidential information without the prior written consent of the disclosing party, except to the extent required by law, regulation or court order (and in such case, only upon prior written notice to the disclosing party).” Id. at 364. [18] The decree entered into with Ameriquest states, in regard to the PRA, that “[i]f the State receives a request for documents provided by an Ameriquest Party . . . , the State shall comply with applicable public disclosure laws and promptly provide notice to the Ameriquest Parties____” Ameriquest, 170 Wn.2d at 427 (first alteration in original). [19] “No documentary material, answers to written interrogatories, or transcripts of oral testimony produced pursuant to a [CID], or copies thereof, shall ... be produced for inspection or copying by, nor shall the contents thereof be disclosed to [anyone else] without the consent of the person who produced such material, answered written interrogatories, or gave oral testimony....” RCW 19.86.110(7). [20] Ameriquest correctly notes that the CPA is modeled after federal antitrust statutes and that the legislature expressly provided that Washington courts should be guided by federal law when interpreting the CPA. RCW 19.86.920. This is because “the Legislature presumably intended to minimize conflict between the enforcement of state and federal antitrust laws to avoid subjecting Washington businesses to divergent regulatory approaches to the same conduct.” Blewett v. Abbott Labs., 86 Wn. App. 782, 788, 938 P.2d 842 (1997). Washington courts, consequently, have attempted to depart from federal law only when it is “rooted in our statutes or case law and not in . . . general policy arguments.” Id. [21] The CID said it was issued “to determine whether there is, has been or may be a violation of §§ 1, 2 of the Sherman Act; § 3 of the Clayton Act by conduct of activities of the following nature: Agreements and conduct restraining trade in the gabion and gabion fastening industries.” Maccaferri, 938 F. Supp. at 314.