FOR PUBLICATION

UNITED STATES COURT OF APPEALS

FOR THE NINTH CIRCUIT

CIVIL BEAT LAW CENTER FOR THE 

PUBLIC INTEREST, INC.,

Plaintiff-Appellant,

v.

CENTERS FOR DISEASE CONTROL &

PREVENTION,

Defendant-Appellee.

No. 16-16960

D.C. No.

1:16-cv-00008-

JMS-KSC

OPINION

Appeal from the United States District Court

for the District of Hawai’i

J. Michael Seabright, Chief District Judge, Presiding

Argued and Submitted October 9, 2018

Honolulu, Hawai’i

Filed July 10, 2019

Before: Kim McLane Wardlaw, Marsha S. Berzon,

and Johnnie B. Rawlinson, Circuit Judges.

Opinion by Judge Berzon
2 CIVIL BEAT LAW CTR. V. CDC

SUMMARY*

Freedom of Information Act

In a case involving disclosures under the Freedom of 

Information Act (“FOIA”), the panel dismissed as moot that 

part of the appeal pertaining to the disclosure of the specific 

regulatory violations and vacated those portions of the 

district court’s order; affirmed the district court’s grant of 

summary judgment as to the withholding under FOIA 

Exemption 6 of the identity and contact information of 

certain Centers for Disease Control & Prevention (“CDC”) 

employees; reversed the district court’s grant of summary 

judgment to the CDC on a Public Health Security and 

Bioterrorism Preparedness and Response Act of 2002 

(“BPRA”) public endangerment exemption; and remanded 

to the district court for further proceedings.

Plaintiff sought disclosure under FOIA of two 

documents from the CDC concerning its inspection of the 

University of Hawaii’s biolab. CDC provided redacted 

versions of the requested records. 

FOIA Exemption 6 allows agencies to withhold 

personnel and medical files that would constitute an 

unwarranted invasion of privacy. FOIA Exemption 3 

applies to any material that is specifically exempted from 

disclosure by statute. BPRA exempts certain federal 

agencies from disclosing specified types of information 

 * This summary constitutes no part of the opinion of the court. 

It has been prepared by court staff for the convenience of the reader.
CIVIL BEAT LAW CTR. V. CDC 3

regarding biological agents and toxins in response to a FOIA 

request. 

Concerning Exemption 3, the panel held as an initial 

matter that BPRA was a qualifying statute under Exemption 

3. The CDC relied on two enumerated BPRA exemptions to 

justify the redactions in the requested information: the sitespecific exemption and the public endangerment exemption. 

The panel held that it did not have jurisdiction to address the 

CDC’s redactions of the specific regulatory violations found 

at the biolab, that were justified under BPRA’s site-specific 

exemption, because plaintiff’s claims are moot. Turning to 

the BPRA public endangerment exemption, the panel held 

that Congress intended the public endangerment 

determination to be made on a case-by-case basis. The panel 

further held that on the current record, the CDC did not

justify its complete withholding of identity and location 

information, and the district court erred in granting summary 

judgment to the agency. The panel also held that plaintiff 

was not entitled to judgment as a matter of law on its crossmotion for summary judgment. The panel remanded for 

further proceedings on this issue.

Concerning Exemption 6, the panel held that the CDC 

satisfied its burden of establishing a nontrivial privacy 

interest, and plaintiff provided no reason why disclosure of 

CDC employees’ identities and contact information would 

further the public interest. The panel concluded, therefore, 

that the CDC’s withholding of this information under 

Exemption 6 was proper.
4 CIVIL BEAT LAW CTR. V. CDC

COUNSEL

R. Brian Black (argued), Civil Beat Law Center for the 

Public Interest Inc., Honolulu, Hawaii, for PlaintiffAppellant.

Anne Murphy (argued) and Matthew Collette, Appellate 

Staff; Kenji M. Price, United States Attorney; Civil 

Division, United States Department of Justice, Washington, 

D.C.; for Defendant-Appellee.

OPINION

BERZON, Circuit Judge:

Anonymous letters containing deadly anthrax spores 

were mailed to several media companies and congressional 

offices in September 2001. Five individuals were killed; 

seventeen others were sickened. U.S. Dep’t of Justice, 

Amerithrax Investigative Summary 1–3 (2010), 

https://www.justice.gov/archive/amerithrax/docs/amx-inves

tigative-summary.pdf. In the wake of these attacks, Congress 

moved “to improve the ability of the United States to 

prevent, prepare for, and respond to bioterrorism and other 

public health emergencies.” H.R. Rep. No. 107-481, at 1 

(2002) (Conf. Rep.), reprinted at 2002 U.S.C.C.A.N. 464, 

464. The resulting legislation is the Public Health Security 

and Bioterrorism Preparedness and Response Act of 2002 

(BPRA), Pub. L. No. 107-188, 116 Stat. 594 (codified as 

amended at scattered sections of 7, 18, 21, 29, 38, 42, and 47 

U.S.C.).

Title II of BPRA is directed at improving the safety and 

security of dangerous biological agents and toxins located 
CIVIL BEAT LAW CTR. V. CDC 5

throughout the United States. Toward this goal, BPRA 

directed the federal Department of Health and Human 

Services (HHS) to “establish and maintain a list of each 

biological agent and each toxin that has the potential to pose 

a severe threat to public health and safety,” 42 U.S.C. 

§ 262a(a)(1)(A), and to create a system for “registration with 

[HHS] of the possession, use, and transfer of listed agents 

and toxins,” id. § 262a(d)(1). Registered entities must 

comply with “appropriate safeguard[s] [established by HHS] 

. . . for persons possessing, using, or transferring a listed 

agent or toxin.” Id. § 262a(e)(1).

In addition to these safeguards, BPRA exempts certain 

federal agencies from disclosing specified types of 

information regarding biological agents and toxins in 

response to a Freedom of Information Act (FOIA) request. 

See id. § 262a(h)(1). Relying on this exemption, the Centers 

for Disease Control and Prevention (CDC) withheld 

information from a FOIA response pertaining to a biological 

research laboratory (“biolab”) located at the University of 

Hawai’i. Much of the withheld information was already 

publicly available. The primary question before us is 

whether the CDC properly refused to disclose the requested 

information.

I

The University of Hawai’i at Mānoa (UH) maintains a 

biolab that is “the only facility of its kind for researchers in 

the entire State.” UH publicizes the biolab’s location at “the 

Biosciences Building” on “the Kaka‘ako campus, near 

downtown Honolulu.” Facilities, Dep’t Tropical Med., Med. 

Microbiology & Pharmacology, http://manoa.hawaii.edu/tr

opicalmedicine/?page_id=925 (last updated June 20, 2014). 

According to the UH website, researchers at the UH biolab 

study a number of highly dangerous biotoxins, including 
6 CIVIL BEAT LAW CTR. V. CDC

botulinum neurotoxins, the Ebola virus, Tetrodotoxin, 

Brucella abortus, Brucella melitensis, Brucella suis, 

Burkholderia pseudomallei, Burkholderia pseudomallei, the 

Nipah virus, Ralstonia solanacearum, and Xanthomonas 

oryzae.

News reports in 2014 revealed that the CDC had 

uncovered “widespread regulatory noncompliance” at the 

UH biolab, relating to UH’s failure to meet certain standards 

for biotoxin safety and security. In response to these reports, 

Civil Beat Law Center, a government watchdog group in 

Hawai’i, filed a FOIA request with the CDC seeking two 

documents: (1) a May 2014 CDC inspection report detailing 

the regulatory violations found at the UH biolab; and (2) a 

May 2014 letter from the CDC demanding that UH “show 

cause” for why the UH biolab’s registration to possess, use, 

and transfer biological agents and toxins should not be

suspended or revoked. The CDC denied both requests, 

maintaining that the records sought were “specifically 

exempted from disclosure by 42 U.S.C. § 262a(h)(1)(C) and 

(E).” Civil Beat requested reconsideration, which the CDC 

also denied.

Seeking to compel disclosure of the two disputed 

documents, Civil Beat filed suit under FOIA. The parties 

filed cross-motions for summary judgment, with the CDC 

continuing to assert that no disclosure at all of the requested 

documents was required.

A few weeks later, the CDC changed positions. In 

response to Civil Beat’s motion for summary judgment, the 

CDC included redacted versions of the requested records. 

The redactions in the newly disclosed documents fell into 

three categories:
CIVIL BEAT LAW CTR. V. CDC 7

The first two categories of redactions were based on 

exemptions found in BPRA. First, the CDC redacted 

information concerning the specific regulatory violations 

found at UH, asserting that “public disclosure of the redacted 

information . . . would endanger public health or safety 

because it could assist unauthorized individuals to obtain 

illegal access to listed agents.” See 42 U.S.C. 

§ 262a(h)(1)(E) (“No Federal agency . . . shall disclose . . . 

[a]ny portion of an evaluation or report of an inspection . . . 

that identifies the listed agent or toxin possessed by a 

specific registered person or that discloses the identity or 

location of a specific registered person if the agency 

determines that public disclosure of the information would 

endanger public health or safety.”). Second, the CDC 

redacted all references to UH, its employees, and the 

laboratory, because revealing any of that information “would 

inform individuals with nefarious intentions of site-specific 

weaknesses in the safeguards and/or security measures 

employed by the particular registered entity at a particular 

location.” See 42 U.S.C. § 262a(h)(1)(C) (“No Federal 

agency . . . shall disclose . . . [a]ny portion of a record that 

discloses the site-specific or transfer-specific safeguard and 

security measures used by a registered person to prevent 

unauthorized access to listed agents and toxins.”).

Third, the CDC redacted “[t]he names and telephone 

numbers of individual [Division of Select Agents and 

Toxins] staff members” who conducted the UH inspection, 

based on “the sensitive nature of the select agent information 

that these staff members possess and process.” These 

redactions were based on FOIA Exemption 6, covering 

“personnel and medical files and similar files the disclosure 

of which would constitute a clearly unwarranted invasion of 

personal privacy.” 5 U.S.C. § 552(b)(6).
8 CIVIL BEAT LAW CTR. V. CDC

Unsatisfied, Civil Beat opposed all three categories of 

redactions. It also argued, in the alternative, that if the 

district court determined that the BPRA exemptions were 

possibly applicable, the district court should conduct in 

camera review of the unredacted documents to determine 

whether the redactions were in fact proper.

The district court granted the CDC’s summary judgment 

motion in nearly all respects. Civil Beat Law Ctr. for the Pub. 

Interest, Inc. v. CDC, 204 F. Supp. 3d 1132, 1134 (D. Haw. 

2016). The court held the redactions justified under BPRA 

appropriate, and the withholding of the names and contact 

information of CDC employees proper under FOIA 

Exemption 6. Id. at 1144–48. Civil Beat timely appealed.

II

Congress enacted FOIA “to pierce the veil of 

administrative secrecy and to open agency action to the light 

of public scrutiny.” U.S. Dep’t of State v. Ray, 502 U.S. 164, 

173 (1991) (quoting Dep’t of Air Force v. Rose, 425 U.S. 

352, 361 (1976)). Providing information to the public under 

FOIA, it was hoped, would “ensure an informed citizenry, 

vital to the functioning of a democratic society, needed to 

check against corruption and to hold the governors 

accountable to the governed.” NLRB v. Robbins Tire & 

Rubber Co., 437 U.S. 214, 242 (1978).

Toward this goal, FOIA “requires federal agencies to 

make Government records available to the public, subject to 

nine exemptions for specific categories of material.” Milner 

v. Dep’t of Navy, 562 U.S. 562, 564 (2011). “These 

exemptions are ‘explicitly made exclusive,’ and must be 

‘narrowly construed.’” Id. at 565 (citations omitted) (first 

quoting EPA v. Mink, 410 U.S. 73, 79 (1973); then quoting 

FBI v. Abramson, 456 U.S. 615, 630 (1982)). Given FOIA’s 
CIVIL BEAT LAW CTR. V. CDC 9

overarching purpose, “the strong presumption in favor of 

disclosure places the burden on the agency to justify the 

withholding of any requested documents.” Ray, 502 U.S. at 

173.

This case concerns two FOIA exemptions, Exemption 3 

and Exemption 6. Exemption 3 applies to any material that 

is “specifically exempted from disclosure by statute” if, as 

relevant here, the statute “establishes particular criteria for 

withholding or refers to particular types of matters to be 

withheld.” 5 U.S.C. § 552(b)(3)(A)(ii). Exemption 6 allows 

agencies to withhold “personnel and medical files and 

similar files the disclosure of which would constitute a 

clearly unwarranted invasion of personal privacy.” Id.

§ 552(b)(6). We consider each exemption in turn.

A

Exemption 3 does not itself provide the standards for an 

exemption from disclosure but instead incorporates other 

applicable statutory exemptions. See id. § 552(b)(3)(A)(ii).

We use a two-step inquiry in considering whether 

withholding under Exemption 3 is proper. “First, we 

determine whether the withholding statute meets the 

requirements of Exemption 3. Then, we determine whether 

the requested information falls within the scope of the 

withholding statute.” Carlson v. U.S. Postal Serv., 504 F.3d 

1123, 1127 (9th Cir. 2007).

The parties here agree, correctly, that BPRA is a 

qualifying statute under Exemption 3. BPRA exempts 

certain federal agencies, including the CDC, from disclosing 

certain categories of information relating to biological 
10 CIVIL BEAT LAW CTR. V. CDC

agents and toxins. See 42 U.S.C. § 262a(h)(1).1 Thus, the 

statute “clearly identif[ies] the types of material to be 

 1 BPRA exempts five categories of information from disclosure:

(A) Any registration or transfer documentation 

submitted under [42 U.S.C. § 262a(b) and (c)] for 

the possession, use, or transfer of a listed agent or 

toxin; or information derived therefrom to the 

extent that it identifies the listed agent or toxin 

possessed, used, or transferred by a specific 

registered person or discloses the identity or 

location of a specific registered person.

(B) The national database developed pursuant to 

[42 U.S.C. § 262a(d)], or any other compilation of 

the registration or transfer information submitted 

under [42 U.S.C. § 262a(b) and (c)] to the extent 

that such compilation discloses site-specific 

registration or transfer information.

(C) Any portion of a record that discloses the sitespecific or transfer-specific safeguard and 

security measures used by a registered person to 

prevent unauthorized access to listed agents and 

toxins.

(D) Any notification of a release of a listed agent or 

toxin submitted under [42 U.S.C. 262a(b) and 

(c)], or any notification of theft or loss submitted 

under such subsections.

(E) Any portion of an evaluation or report of an 

inspection of a specific registered person 

conducted under [42 U.S.C. 262a(f)] that 

identifies the listed agent or toxin possessed by a 

specific registered person or that discloses the 

identity or location of a specific registered person 

if the agency determines that public disclosure of 
CIVIL BEAT LAW CTR. V. CDC 11

withheld under their scope as required by 5 U.S.C. 

§ 552(b)(3), and therefore qualif[ies] as” an Exemption 3 

statute. Minier v. CIA, 88 F.3d 796, 801 (9th Cir. 1996).

As to “whether the requested information falls within the 

scope of the withholding statute,” Carlson, 504 F.3d at 1127, 

the CDC relied on two of the enumerated BPRA exemptions 

to justify the redactions in the requested information. First, 

the CDC redacted all references to the specific regulatory 

violations found at UH, relying on the exemption for “[a]ny 

portion of a record that discloses the site-specific or transferspecific safeguard and security measures used by a 

registered person to prevent unauthorized access to listed 

agents and toxins.” 42 U.S.C. § 262a(h)(1)(C). We refer to 

this first exemption as the “site-specific exemption.” 

Second, the CDC redacted all references to UH and to the 

specific lab at issue, reasoning that this information fell 

under the exemption for “[a]ny portion of an evaluation or 

report of an inspection of a specific registered person . . . that 

discloses the identity or location of a specific registered 

person if the agency determines that public disclosure of the 

information would endanger public health or safety.” Id.

§ 262a(h)(1)(E). We refer to this second exemption as the 

“public endangerment exemption.”

1

We begin with the CDC’s redactions of the specific 

regulatory violations found at the UH biolab, justified under 

BPRA’s site-specific exemption. For the reasons discussed 

 the information would endanger public health or 

safety.

42 U.S.C. § 262a(h)(1).
12 CIVIL BEAT LAW CTR. V. CDC

below, we do not have jurisdiction to address these 

redactions.

While this appeal was pending, the CDC discovered that 

it had, in response to a separate 2015 FOIA request, 

disclosed a version of the CDC’s May 2014 letter to UH that 

included—without redactions—the regulatory violations 

found at UH. Accordingly, the CDC provided Civil Beat 

with both the unredacted May 2014 letter and a version of 

the inspection report with those regulatory violations

revealed. The CDC contends that this disclosure mooted 

Civil Beat’s challenge to the CDC’s redactions of regulatory 

violations under § 262a(h)(1)(C). We agree.

Generally, “after the agency produces all non-exempt 

documents . . . , the specific FOIA claim is moot because the 

injury has been remedied.” Hajro v. U.S. Citizenship & 

Immigration Servs., 811 F.3d 1086, 1103 (9th Cir. 2016); see 

also Papa v. United States, 281 F.3d 1004, 1013 (9th Cir. 

2002). An exception exists, however, when a FOIA 

requester alleges “that an agency policy or practice will 

impair the party’s lawful access to information in the future.” 

Hajro, 811 F.3d at 1103 (quoting Payne Enters., Inc. v. 

United States, 837 F.2d 486, 491 (D.C. Cir. 1988)). That 

exception has no application here.

Civil Beat’s complaint sought relief only for the FOIA 

request at issue—that is, a request for the two specific 

documents the CDC had refused to provide. Because the 

CDC has now produced versions of the documents revealing 

one category of the information Civil Beat sought—the 

regulatory violations uncovered at the UH biolab—Civil 

Beat’s claim is moot as to that information. See id.; Papa, 

281 F.3d at 1013.
CIVIL BEAT LAW CTR. V. CDC 13

Civil Beat’s contention that the CDC has not 

“abandoned” its interpretation of BPRA does not, on its own, 

give rise to a pattern-or-practice claim. To establish such a 

claim, a plaintiff must show that “the plaintiff himself has a 

sufficient likelihood of future harm by the policy or 

practice.” Hajro, 811 F.3d at 1103. A plaintiff’s allegations 

that he regularly files FOIA requests with a certain agency 

but that agency consistently fails to respond to those requests 

in a timely fashion would, for example, support a pattern-orpractice claim. See id. at 1104. Here, however, apart from 

vague allusions in Civil Beat’s briefs to “the next Law 

Center request for inspection results,” nothing in the record 

suggests that Civil Beat will be affected by the CDC’s 

invocation of the site-specific BPRA exemption to FOIA. 

“Past exposure to illegal conduct does not in itself show a 

present case or controversy regarding injunctive relief . . . if 

unaccompanied by any continuing, present adverse effects.” 

O’Shea v. Littleton, 414 U.S. 488, 495–96 (1974). Civil 

Beat’s claim as to the site-specific exemption is therefore 

moot.

Because this mootness “result[ed] from the unilateral 

action of the party who prevailed in the lower court,” we 

vacate the district court’s decision pertaining to the 

redactions CDC justified on the site-specific exemption. 

U.S. Bancorp Mortg. Co. v. Bonner Mall P’ship, 513 U.S. 

18, 23 (1994); see also United States v. Munsingwear, Inc., 

340 U.S. 36, 39 (1950); All. for the Wild Rockies v. U.S. 

Forest Serv., 907 F.3d 1105, 1121 (9th Cir. 2018).2

 2 We decline Civil Beat’s invitation to declare that the district court’s 

opinion has “no persuasive authority” as to the mooted issues. “No

matter what we conclude, the opinion of the district court will not be 

ripped from Federal Supplement [3]d. It will still be available and will 
14 CIVIL BEAT LAW CTR. V. CDC

2

We turn to the second BPRA exemption at issue—the 

public endangerment exemption, under which an agency 

may withhold “[a]ny portion of an evaluation or report of an 

inspection of a specific registered person . . . that discloses 

the identity or location of a specific registered person if the 

agency determines that public disclosure of the information 

would endanger public health or safety.” 42 U.S.C. 

§ 262a(h)(1)(E).3 Relying on this exemption, the CDC 

withheld all references to the registered entity—that is, the 

University of Hawai’i at Mānoa—as well as the names of 

UH’s employees and the location of the specific biolab at 

issue.

(a) At this juncture, these redactions seem rather trivial. 

It is now publicly known that the biolab is located at the 

University of Hawai’i at Mānoa and that researchers use the 

biolab to study several biological agents and toxins. The 

CDC nonetheless contends that public health and safety 

would be endangered were it to publish any information 

concerning the “identity or location” of the registered entity 

in conjunction with the regulatory violations already 

disclosed.

The district court agreed, reasoning that “there is no 

exception in [BPRA] allowing the CDC to produce exempt 

 

still be citable for its persuasive weight.” NASD Dispute Resolution, Inc. 

v. Judicial Council, 488 F.3d 1065, 1069 (9th Cir. 2007).

3 BPRA refers to “registered persons,” which includes “person[s] 

other than . . . individual[s],” as permissible registrants with HHS.

42 U.S.C. § 262a(e)(6)(B); see also 42 C.F.R. § 73.7(a) (discussing 

registration for “an individual or entity”). Because the “registered 

person” at issue here is a university, we use the term “registered entity.”
CIVIL BEAT LAW CTR. V. CDC 15

information that has already entered the public domain 

through other means.” Civil Beat Law Ctr., 204 F. Supp. 3d 

at 1145. Because the CDC “has never ‘officially 

acknowledged’ or made any documented disclosure of the 

redacted information,” the district court concluded, “the 

CDC has satisfied its burden for redacting any references to 

the University of Hawai’i in the Documents.” Id. In reaching 

this conclusion, the district court relied on cases establishing 

a principle termed the “official-acknowledgment doctrine.” 

That doctrine has no application here.

Under the official acknowledgment doctrine, “[i]f the 

government has officially acknowledged information, a 

FOIA plaintiff may compel disclosure of that information 

even over an agency’s otherwise valid exemption claim.” 

ACLU v. U.S. Dep’t of Def., 628 F.3d 612, 620 (D.C. Cir. 

2011); see also Pickard v. Dep’t of Justice, 653 F.3d 782, 

786 (9th Cir. 2011). “For information to qualify as ‘officially 

acknowledged,’ it must satisfy three criteria: (1) the 

information requested must be as specific as the information 

previously released; (2) the information requested must 

match the information previously disclosed; and (3) the 

information requested must already have been made public 

through an official and documented disclosure.” ACLU, 

628 F.3d at 620–21. The public availability of the requested 

information does not, on its own, trigger application of the 

official-acknowledgment doctrine. “[I]nstead, the specific

information sought by the plaintiff must already be in the 

public domain by official disclosure.” Id. at 621 (quoting 

Wolf v. CIA, 473 F.3d 370, 378 (D.C. Cir. 2007)).

The official-acknowledgment doctrine, however, applies 

only as to waiver to an “otherwise valid” assertion of a FOIA 

exemption. ACLU, 628 F.3d at 620. In that context, official 

acknowledgement functions as a waiver—that is, the 
16 CIVIL BEAT LAW CTR. V. CDC

government, by officially acknowledging information it 

could otherwise have withheld, waives its right to withhold 

it. See Wolf, 473 F.3d at 379 (referring to the doctrine as the 

“official acknowledgment waiver”). Here, Civil Beat 

contests the availability of a FOIA exemption at step one—

that is, it asserts the CDC was not permitted to rely on 

BPRA’s exemption for information that “endanger[s] public 

health or safety.” 42 U.S.C. § 262a(h)(1)(E). If Civil Beat is 

correct that the CDC never had the right to withhold the 

requested information in the first place, no waiver concept is 

pertinent, and the official-acknowledgment doctrine has no 

application.

(b) Our question, then, is simply whether the CDC has 

met its burden of showing that the public endangerment 

exemption applies. That is, we must determine whether the 

CDC correctly “determine[d] that public disclosure of the 

information would endanger public health or safety.” 

42 U.S.C. § 262a(h)(1)(E).4

 4 The CDC argues that we should accord deference to the agency’s 

interpretation of the statute, but our case law is to the contrary. We have 

explicitly rejected the applicability of “a more deferential, administrative 

law standard of review” in determining the scope of an Exemption 3 

statute. Carlson, 504 F.3d at 1126–27; see also Lessner v. U.S. Dep’t of 

Commerce, 827 F.2d 1333, 1335 (9th Cir. 1987); Long v. IRS, 742 F.2d 

1173, 1178 n.12 (9th Cir. 1984). But see Tax Analysts v. IRS, 117 F.3d 

607, 613 (D.C. Cir. 1997); Aronson v. IRS, 973 F.2d 962, 965 (1st Cir. 

1992). By contrast, we do “accord substantial weight to an agency’s 

declarations regarding the application of a FOIA exemption.” 

Shannahan v. IRS, 672 F.3d 1142, 1148 (9th Cir. 2012). Still, even if we 

were to apply a deferential standard, we would reject the CDC’s 

interpretation, for the reasons stated in the text.

We reject the CDC’s contention that special deference is accorded 

to agencies in determining the scope of a FOIA exemption relating to 
CIVIL BEAT LAW CTR. V. CDC 17

The CDC’s essential contention in its briefing to us is 

that disclosure of a registered entity’s identity or location 

will always endanger public health or safety. That 

categorical position cannot be squared with BPRA’s text, 

structure, and legislative history. Instead, BPRA requires 

that the CDC justify the applicability of the exemption on a 

case-by-case basis.

The statute clearly contemplates that, in some

circumstances, disclosure of an identity or location would 

not endanger public health or safety. Otherwise, the 

qualification that the exemption apply only “if the agency 

determines that public disclosure of the information would 

endanger public health or safety,” 42 U.S.C. 

§ 262a(h)(1)(E), would be meaningless.

Our noncategorical understanding of the public 

endangerment exemption is reinforced by the history of the 

statute’s enactment. “[W]here ‘the language is ambiguous or 

is capable of more than one reasonable interpretation, we 

“consult the legislative history, to the extent that it is of 

value, to aid in [the] interpretation.”’” United States v. Lyle, 

742 F.3d 434, 436 (9th Cir. 2014) (alteration in original) 

(quoting United States v. Thompson, 728 F.3d 1011, 1015 

(9th Cir. 2013)).

The original version of BPRA, as passed by the House 

of Representatives, categorically barred agencies from 

disclosing an identity or location of a registered entity. That 

 national security. As in other FOIA cases, we determine for ourselves 

the scope of national security FOIA exemptions but give deference to the 

agency’s factual assertions. See Hamdan v. U.S. Dep’t of Justice, 

797 F.3d 759, 769 (9th Cir. 2015).
18 CIVIL BEAT LAW CTR. V. CDC

version provided that “[a]ny information in the possession of 

any Federal agency that identifies a person, or the 

geographic location of a person, who is registered pursuant 

to regulations under this section . . . shall not be disclosed 

under section 552(a) of title 5, United States Code.” H.R. 

3448, 107th Cong., § 201(a)(1) (as passed by House, Dec. 

12, 2001).5 The version of BPRA ultimately enacted, 

however, was less restrictive, allowing for the disclosure of 

an identity or location unless that disclosure “would 

endanger public health or safety.” 42 U.S.C.

§ 262a(h)(1)(E).

Notably, BPRA’s legislative history speaks directly to 

the role of public availability in making a public 

endangerment determination. While introducing the 

conference report for BPRA, Representative Billy Tauzin, 

the chief architect of BPRA, discussed the public 

endangerment exemption at length. He noted that the 

purpose of the exemption was to “protect site-specific 

information on inspection reports, provided that the agency 

determines public disclosure would endanger public health 

and safety.” 148 Cong. Rec. H2846 (May 22, 2002) 

(statement of Rep. Tauzin). “By adding this additional 

requirement for inspection documents,” Representative 

Tauzin explained, “we are striving to ensure a fair balance 

between public accountability and security.” Id. He provided 

an example:

When a registered person is publicly known 

to be working with select agents, public 

disclosure of an inspection report is less 

 5 This language did not change after the Senate passed an amended 

version of the bill. See H.R. 3448, 107th Cong., § 201(a)(1) (as passed 

by Senate, Dec. 20, 2001).
CIVIL BEAT LAW CTR. V. CDC 19

likely to endanger public health or safety 

(provided that security-specific information 

is redacted), and may improve it by ensuring 

public accountability. But when the activities 

of a registered person are not publicly known, 

revealing the identity and location of a 

registered person would more likely 

endanger public health or safety. The 

agencies will need to consider such matters 

on a case-by-case basis.

Id. (emphasis added).

The CDC’s position in its brief—that it may always

redact the identity or location of a registered entity, even if 

the identity or location are publicly known—borders on the 

categorical exemption Congress considered and rejected.6

 6 At oral argument, the CDC suggested for the first time that 

disclosure could be permissible if the requested “evaluation or report of 

an inspection” reported a clean bill of health for the registered entity. See

Oral Argument at 21:09–22:10, Civil Beat Law Ctr. for the Pub. Interest, 

Inc. v. Ctrs. for Disease Control & Prevention, No. 16-16960 (9th Cir. 

Oct. 9, 2018), https://www.ca9.uscourts.gov/media/view_video.php?pk

_vid=0000014323. But the public endangerment concern regarding 

disclosure of identity and location of individuals working with toxins 

presumably is that knowing where the toxins are and who is working 

with them could make it easier to find, take, and use the toxins for 

nefarious purposes. That concern does not correlate with whether a 

particular laboratory violates rather than follows applicable safety and 

use regulations.

Moreover, as this litigation shows, the public interest in 

accountability is at its peak when the requested record does contain 

regulatory deficiencies. Given that the stated purpose of the exemption 

was “to ensure a fair balance between public accountability and 

security,” 148 Cong. Rec. H2846 (May 22, 2002) (statement of Rep. 

Tauzin), it would make little sense for Congress to prohibit disclosure in 
20 CIVIL BEAT LAW CTR. V. CDC

Moreover, the CDC offers no explanation for how its 

position can be reconciled with Representative Tauzin’s 

instruction that “public disclosure of an inspection report is 

less likely to endanger public health or safety” when the 

requested information is “publicly known” and, to the 

contrary, “may improve [public health and safety] by 

ensuring public accountability.” 148 Cong. Rec. H2846 

(May 22, 2002) (statement of Rep. Tauzin).

In sum, Congress intended the public endangerment 

determination to be “consider[ed] . . . on a case-by-case 

basis.” Id. That principle applies to publicly available 

information as well as to information not known to the 

public.

(c) The case-by-case approach under the BPRA public 

endangerment exemption is consistent with our general 

FOIA requirement that, “[t]o justify withholding, the 

government must provide tailored reasons in response to a 

FOIA request. It may not respond with boilerplate or 

conclusory statements.” Shannahan, 672 F.3d at 1148. Here, 

the CDC offered only cursory statements explaining how 

public health and safety would be endangered by FOIA 

disclosure. These “boilerplate” and “conclusory” statements 

did not establish that the CDC conducted an adequate caseby-case inquiry in reaching its public endangerment 

determination.

For example, in a letter responding to Civil Beat’s FOIA 

request, the CDC wrote, “While it is clear that you already 

know the specific site and the registered person related to 

 the one circumstance in which the public is best able to hold a registered 

entity accountable and allow it categorically where the accountability 

interest is minimal.
CIVIL BEAT LAW CTR. V. CDC 21

your request, release of further details would hinder the 

prevention of unauthorized access to listed agents and 

toxins.” No explanation of this conclusion was provided, and 

the redactions appear to include the information already 

known. Likewise, in an affidavit filed with the district court, 

the CDC provided a one-sentence statement:

The fact that Plaintiff may know the identity 

and/or location of the registered person does 

not render as non-exempt the redacted 

information protected by FOIA Exemption 3 

and 42 U.S.C. § 262a(h)(1)(C) and/or (E); 

nor does it excuse the CDC from its duty not 

to disclose information protected by 

42 U.S.C. § 262a(h)(1).

That’s it. Nothing further was said to explain why the CDC 

redacted the already-known identity and location 

information.

The most detailed explanation the CDC offered is 

another affidavit, which asserts that “the release of specific 

locations (e.g., rooms in a building) where [agents and toxins 

are] stored or worked with . . . will increase the risk of 

unauthorized access to [agents and toxins] by increasing the 

chances that [agents and toxins] will be found when 

otherwise lost-in-the-crowd of the larger campus of the 

entity.” This explanation may have been plausible, were 

more explanation provided, as to redaction of “specific 

locations (e.g., rooms in a building).” But, again, the CDC 

redacted all references to identity or location, even though 

the identity (the University of Hawai’i at Mānoa) and 

general location (the on-campus biolab) are both publicly 

known. Nothing was said to explain how those broad 

redactions protected public health and safety.
22 CIVIL BEAT LAW CTR. V. CDC

In sum, the CDC was not entitled to rely on the officialacknowledgment doctrine, and on the current record, it did 

not otherwise justify its complete withholding of identity and 

location information. The district court therefore erred in 

granting summary judgment to the agency.

(d) Civil Beat cross-moved for summary judgment in its 

favor and has appealed the denial of its motion. “[S]ummary

judgment in favor of the FOIA plaintiff is appropriate” only 

“[w]hen an agency seeks to protect material which, even on 

the agency’s version of the facts, falls outside the proffered 

exemption.” Petroleum Info. Corp. v. U.S. Dep’t of Interior, 

976 F.2d 1429, 1433 (D.C. Cir. 1992). On the present record, 

we cannot conclude that the Civil Beat is entitled to 

judgment as a matter of law. See Fed. R. Civ. P. 56(a). For 

example, as we have just observed, the record does not 

negate the possibility that some of the more detailed redacted 

identity and location information is not publicly known and 

could, if disclosed, endanger public safety. Further record 

development could illuminate this point.

We therefore remand to the district court for further 

proceedings consistent with the principles outlined here. See

Animal Legal Def. Fund v. U.S. Food & Drug Admin., 

836 F.3d 987, 990 (9th Cir. 2016) (en banc) (per curiam). 

We emphasize that the CDC will be able justify withholding 

some of the identity and location information only if it 

“provide[s] tailored reasons,” not “boilerplate or conclusory 

statements,” for doing so. Shannahan, 672 F.3d at 1148.

B

In addition to information concerning the identity and 

location of the UH biolab, Civil Beat also sought the 

disclosure of parts of the requested documents that revealed 

the names and contact information of the CDC employees 
CIVIL BEAT LAW CTR. V. CDC 23

who conducted the 2014 inspection. The CDC maintains that 

this information comes within FOIA Exemption 6, which 

provides that FOIA “does not apply to . . . personnel and 

medical files and similar files the disclosure of which would 

constitute a clearly unwarranted invasion of personal 

privacy.” 5 U.S.C. § 552(b)(6).

To determine whether disclosure would result in a 

“clearly unwarranted invasion of personal privacy,” we 

“must balance the public interest in disclosure against the 

interest Congress intended the [e]xemption to protect.” U.S. 

Dep’t of Def. v. Fed. Labor Relations Auth., 510 U.S. 487, 

495 (1994) (alteration in original) (quoting U.S. Dep’t of 

Justice v. Reporters Comm. for Freedom of Press, 489 U.S. 

749, 776 (1989)).

Balancing these interests involves two steps. “First, we 

evaluate the personal privacy interest at stake to ensure ‘that 

disclosure implicates a personal privacy interest that is 

nontrivial or . . . more than [] de minimis.’” Cameranesi v. 

U.S. Dep’t of Def., 856 F.3d 626, 637 (9th Cir. 2017) 

(alterations in original) (quoting Yonemoto v. Dep’t of 

Veterans Affairs, 686 F.3d 681, 693 (9th Cir. 2012), 

overruled on other grounds by Animal Legal Def. Fund, 

836 F.3d 987). “Disclosures that would subject individuals 

to possible embarrassment, harassment, or the risk of 

mistreatment”—including disclosures of an individual’s 

identity—“constitute nontrivial intrusions into privacy under 

Exemption 6.” Cameranesi, 856 F.3d at 638.

Second, “the requester ‘must show that the public 

interest sought to be advanced is a significant one and that 

the information [sought] is likely to advance that interest.’” 

Id. at 637 (alteration in original) (quoting Lane v. Dep’t of 

Interior, 523 F.3d 1128, 1137 (9th Cir. 2008)). For this 

second step, “the only relevant ‘public interest in disclosure’ 
24 CIVIL BEAT LAW CTR. V. CDC

to be weighed in this balance is the extent to which 

disclosure would serve the ‘core purpose of the FOIA,’ 

which is ‘contribut[ing] significantly to public 

understanding of the operations or activities of the 

government.’” Fed. Labor Relations Auth., 510 U.S. at 495 

(alteration in original) (emphases omitted) (quoting 

Reporters Comm., 489 U.S. at 775).

Civil Beat argues that the CDC’s employees will not be 

subject to embarrassment or harassment because their 

identities are already publicly available. As Civil Beat points 

out, the CDC maintains a public directory of the employees 

in the Division of Select Agents and Toxins, the office 

responsible for inspections, and identifies those employees 

as “inspectors.” We disagree.

Whether disclosure of an individual’s identity may result 

in embarrassment, harassment, or risk of mistreatment 

depends on context. We have previously recognized, for 

example, that “[government] agents retain an interest in 

keeping private their involvement in investigations of 

especially controversial events.” Lahr v. Nat’l Transp. 

Safety Bd., 569 F.3d 964, 977 (9th Cir. 2009); see also Forest 

Serv. Emps. for Envtl. Ethics v. U.S. Forest Serv., 524 F.3d 

1021, 1026 (9th Cir. 2008). Here, providing the identities of 

CDC employees in a public directory is somewhat different 

from disclosing the identities of the specific CDC employees 

who have knowledge of particular vulnerabilities involving 

dangerous biological agents and toxins at a single biolab, 

vulnerabilities that have garnered attention from the press 

and the public. The CDC notes that, as a result of the 

inspection, the employees “have knowledge of . . . highly 

sensitive, national security records.” That knowledge, the 

CDC explains, may result in the employees “being targeted 

by a person with nefarious intentions.”
CIVIL BEAT LAW CTR. V. CDC 25

Nor do we agree with Civil Beat that the privacy interests 

offered by the CDC are “impermissibly speculative.” “[T]he 

invasion of a personal privacy interest may be ‘clearly 

unwarranted’ even when the invasion of privacy is far from 

a certainty.” Prudential Locations LLC v. U.S. Dep’t of 

Hous. & Urban Dev., 739 F.3d 424, 432 (9th Cir. 2013) (per 

curiam), abrogated on other grounds by Animal Legal Def. 

Fund, 836 F.3d 987. “We have never held that an agency 

must document that harassment or mistreatment have 

happened in the past or will certainly happen in the future; 

rather, the agency must merely establish that disclosure 

would result in a ‘potential for harassment.’” Cameranesi, 

856 F.3d at 642 (quoting Forest Serv. Emps., 524 F.3d 

at 1026). Here, the CDC has provided a detailed affidavit 

explaining how the disclosure of its employees’ identities 

and contact information could potentially result in an 

invasion of privacy.

The threshold for meeting the first prong of the 

Exemption 6 inquiry is low—only a “nontrivial or . . . more 

than [] de minimis” privacy interest need be shown. Id. at 

637 (alterations in original) (quoting Yonemoto, 686 F.3d at 

693). With specific knowledge that particular CDC 

employees were involved in the UH biolab inspection, a 

nefarious person interested in the specific toxins handled at 

the UH biolab could choose to focus on those CDC 

employees—who would have knowledge of the layout and 

security measures at that lab—for harassment or threats. 

This additional location-specific risk is sufficient—albeit

barely, in light of the public availability of the names of CDC 

employees in the Division of Select Agents and Toxins—to 

meet the low, “nontrivial” privacy interest threshold. On this 

record, the CDC has satisfied its burden of establishing a 

nontrivial privacy interest.
26 CIVIL BEAT LAW CTR. V. CDC

As to whether disclosure would “‘appreciably further’ 

the public’s right to monitor the agency’s action,” Forest 

Serv. Emps., 524 F.3d at 1027 (quoting Fed. Labor Relations 

Auth., 510 U.S. at 497), Civil Beat has provided no reason 

why disclosure of the CDC employees’ identities and contact 

information would further this interest. Nor can we conceive 

of such a reason. As far as we can determine on this record, 

any errors in handling the toxic materials were made by the 

UH biolab and discovered by the CDC employees. The CDC 

employees have not been accused of any lack of diligence, 

and knowing their identity would provide no additional 

information about how the inspection was carried out. 

Withholding the identities and contact information of the 

CDC employees under Exemption 6 was therefore proper.

III

We dismiss as moot that part of the appeal pertaining to 

the disclosure of the specific regulatory violations and vacate 

those portions of the district court’s order. We affirm the 

district court’s grant of summary judgment as to the 

withholding under Exemption 6 of the identity and contact 

information of CDC employees involved in the UH biolab 

inspection. Finally, we reverse the district court’s grant of 

summary judgment to the CDC on the BPRA public 

endangerment exemption and remand to the district court for 

further proceedings consistent with this opinion.

DISMISSED in part, VACATED in part, 

AFFIRMED in part, REVERSED in part, and 

REMANDED.