OSHA DATA/CIH, INC., Appellant, v. UNITED STATES DEPARTMENT OF LABOR, 220 F.3d 153

OPINION OF THE COURT RENDELL, Circuit Judge. In this appeal, we are asked to determine whether the projected $1.7 million cost of notifying companies affected by two requests seeking potentially confidential information under the Freedom of Information Act (“FOIA”), and of evaluating those companies’ responses, were properly chargeable to a commercial use requester as “review costs.” This is an issue of first impression in the courts of appeals.

The United States District Court for the District of New Jersey dismissed two counts of a four-count FOIA suit on the basis that plaintiff-appellant, OSHA Data/CIH, Inc., who had requested the data in question, was responsible for paying such costs to defendant-appellee, the United States Department of Labor, but that OSHA Data had indicated it was unable to pay these costs. OSHA Data now appeals from the District Court’s dismissal of these two counts (Counts I and II) of its action.

We agree with the District Court that the costs of notification were “review costs” that OSHA Data was required to pay in connection with the agency’s determination of the appropriate disposition of the FOIA requests, and will affirm the dismissal of Counts I and II. The District Court also dismissed the remaining two counts of the suit on mootness grounds. OSHA Data concedes that Count IV was moot but argues that Count III was incorrectly dismissed. We agree that Count III was properly dismissed as moot and will affirm the dismissal of this count as well. I.

Facts and Procedural History The facts of this case are largely undisputed. OSHA Data is a private business that collects regulatory compliance and enforcement information from various federal government agencies, repackages that information into computer databases and customized reports, and then sells the information to its clients. See OSHA Data web site, Who We Are (visited June 1, 2000) <http://www.oshadata.com>; see also A. at 172 (statement of Philip D. Stern, counsel for OSHA Data).

Among the governmental information gathered by OSHA Data is data from the DOL concerning workplace compliance with Occupational Safety and Health Administration (“OSHA”) requirements. The DOL routinely supplies this information to OSHA Data in the form of 9-track computer tapes, provided in response to OSHA Data’s FOIA requests. At issue here are three separate FOIA requests for information from the DOL, which form the basis of the three counts in OSHA Data’s complaint.

Counts I and II seek certain records maintained by the DOL for calculating Lost Work Day Injury and Illness (“LWDII”) rates for individual work sites. The LWDII rate for a particular workplace is the ratio of the number of incidences of serious injuries and illnesses to the number of employee work hours performed at that work site during a given time period. The information needed to calculate the LWDII rate is generated by the private employers themselves. OSHA Data’s first FOIA request (Count

I) sought data collected by the DOL in its 1996 “Data Collection Initiative,” a massive information-gathering endeavor covering approximately 80,000 establishments in the manufacturing sector and in other industries; these industries were chosen on the basis either of high injury and illness rates or previous DOL inspection history. See A. at 5-6, 12, 16.

The information obtained through the Data Collection Initiative included each establishment’s name and address, the average number of employees who worked at that establishment in 1995, total employee work hours for 1995, numbers and kinds of occupational injuries and illnesses at the establishment in 1995, and whether those injuries and illnesses resulted in deaths or lost work days. See A. at 146^19. The DOL would use this information to calculate injury and illness rates such as the LWDII rate. See A. at 19.

Much, but not all, of the data collected in the Data Collection Initiative paralleled information that employers had already been recording on a form called “OSHA Form 200” or “Log 200.” In the FOIA request that is the subject of Count I, OSHA Data requested the following: [A] copy of all Log 200 data gathered from approximately 80,000 employers under the so-called “Data Collection Initiative” which began in February 1996.

We specifically request the data include all captured fields of information such as the establishment name and address, name and telephone number of person who provided the data, average employment, hours worked, reporting period and the calculated LWDI [sic] value itself. A. at 12 (Letter from Matthew M. Carmel, OSHA Data President, to DOL official Steve Newell, Oct. 29, 1996); see also A. at 5-6 (Complaint, First Count). OSHA Data’s second request also sought information on LWDII rates.

In contrast to the Count I request, which targeted information obtained via the Data Collection Initiative survey, the Count II request concerned information obtained during the DOL’s inspections of approximately 7000 individual work sites.

In addition to conducting the inspection, DOL compliance officers were directed to record injury and illness data from the establishments’ Log 200 forms; this data was then recorded in a centralized DOL database, the Integrated Management Information System (“IMIS”)- The database software would automatically calculate each establishment’s LWDII rate from the information collected.

OSHA Data sought the following information in its Count II request: [A] copy of the Lost Work Day Injury and Illness (LWDI [sic]) data calculated during OSHA enforcement inspections and entered into the Integrated Management Information System (IMIS) and current through September 30, 1996.... We specifically request the data include all captured fields of information associated with calculation of the LWDII such as the inspection activity number, number of work hours, reporting period and the LWDII value itself. A. at 32 (Letter from Matthew M.

Carmel, OSHA Data President, to DOL official Bruce Beverage, Oct. 24, 1996); see also A. at 6-7 (Complaint, Second Count). The Count III request sought certain computerized information relating to the DOL onsite inspections themselves. The Count III request is limited to information collected in the 30 days immediately prior to creation of the computer file tape.

OSHA Data alleges that this FOIA request “was targeted specifically to address[DOL]’s new policy of withholding the most recent 30 days of information from the computer ‘derived’ file supplied to FOIA requesters.” OSHA Data Br. at 9; see also A. at 8-9 (Complaint, Third Count). The DOL does not admit that it has such a policy. See A. at 63 (Answer, Third Count); DOL Br. at 51-53. The Count III request seeks the following information: [A] copy of the sequential IMIS derived file.

We specifically request the file contain all available data elements including the inspection, violation, administrative payment,' hazardous substance, accident, related activity, debt, event history and optional segments for all inspection records up to and including the date of file tape creation. The requested file period of coverage is 30 days. A. at 46 (Letter from Matthew M. Carmel, OSHA Data President, to DOL official Bill Wright, Sept. 12, 1997); see also A. at 8-9 (Complaint, Third Count).

The DOL denied the Count I and Count II requests and, thereafter, OSHA Data lodged administrative appeals of these denials. See A. at 5, 7. After awaiting resolution of the appeals for over a year, OSHA Data filed a three-count complaint in the United States District Court for the District of New Jersey, requesting an injunction preventing the DOL from withholding the records — in effect, an injunction compelling the DOL to produce the records pursuant to FOIA. The complaint also contained a request for reasonable attorney’s fees and litigation costs.

The DOL moved to stay the matter as to Counts I and II, arguing that, because of potential issues of confidentiality, the agency was required to implement a process of notifying affected companies before it could finally determine whether the requested records were subject to disclosure under FOIA.

The DOL asserted that this procedure was mandated by its own regulations, see 29 C.F.R. § 70.26(d), and that these costs, incurred in order to make a determination of whether disclosure was appropriate, were “review costs.” The DOL further contended that OSHA Data, as a “commercial use” requester of FOIA records, was required by statute to pay all “review costs” in connection with the request, and that these “review costs” would include the costs of notifying the companies and evaluating their responses.

After an interim grant of the stay requested by the DOL, the District Court ruled on the merits of OSHA Data’s Motion for

Summary Judgment as to Counts III and IV, and on the DOL’s Cross-Motion to Dismiss, or in the Alternative, for

Summary Judgment as to all counts. See A. at 321-50 (unpublished Letter-Opinion and Order of District Court, May 10, 1999). The District Court granted the DOL Motion to Dismiss as to all counts, and denied the OSHA Data Motion for

Summary Judgment. The District Court found that OSHA Data, by stating its inability and/or unwillingness to pay the estimated $1.7 million “review costs,” had demonstrated that it was not able to meet the conditions required for the lifting of the stay. The District Court found that OSHA Data was required to pay the costs of notification in order to pursue its claim, and dismissed Counts I and II based on OSHA Data’s stated inability to pay. See A. at 340-41. The District Court dismissed- Counts III and IV as moot, reasoning that OSHA Data had already received the information requested in those counts.

Although OSHA Data conceded that it had received the Count III information as a result of subsequent FOIA requests, OSHA Data had alleged that Count III presented a scenario that was “capable of repetition, yet evading review,” A. at 343, and as such should be exempted from the application of the mootness doctrine. The District Court found that OSHA Data had not met its burden of showing an exception to the mootness doctrine. See A. at 347. OSHA Data now appeals the District Court’s order. II.

Jurisdiction and Standard of Review The District Court had subject matter jurisdiction over this case pursuant to FOIA, 5 U.S.C. § 552(a)(4)(B), and pursuant to Congress’s grant of federal question jurisdiction, 28 U.S.C. § 1331. We have appellate jurisdiction pursuant to 28 U.S.C. § 1291. We review the District Court’s dismissals of Counts I, II, and III de novo. See Ditri v. Coldwell Banker Residential Affiliates, Inc., 954 F.2d 869, 871 (3d Cir.1992) (exercising plenary review over dismissal for failure to state a claim); Northeast Women’s Center, Inc. v.

McMonagle, 939 F.2d 57, 61 (3d Cir.1991) (exercising plenary review over a district court’s decision that a case is moot). III. FOIA and Its Allocation of Responsibility for Costs The Freedom of Information Act, 5 U.S.C. § 552, was enacted in 1966 in response to Congress’s perception that

section 3 of the original Administrative Procedure Act, 5 U.S.C. § 1002 (1964 ed.), did not provide for adequate governmental disclosure of information to the public. See, e.g., Chrysler Corp. v. Brown, 441 U.S. 281, 293 & n. 15, 99 S.Ct. 1705, 60 L.Ed.2d 208 (1979). Congress therefore structured FOIA to reflect “a general philosophy of full agency disclosure unless information is exempted under clearly delineated statutory language.” S.Rep. No. 89-813, at 3 (1965), quoted in Department of the Air Force v. Rose, 425 U.S. 352, 360-61, 96 S.Ct. 1592, 48 L.Ed.2d 11 (1976).

As the District Court for the District of Columbia has succinctly described: “An agency may withhold documents responsive to a FOIA request only if the responsive documents fall within one of nine enumerated statutory exemptions. The agency bears the burden of justifying the withholding, and the [district] court reviews the agency claims of exemption de novo.” Winterstein v. United States Dep’t of Justice, 89 F.Supp.2d 79, 80 (D.D.C.2000) (citations omitted).

An agency can be sued for refusing to disclose information that it should have disclosed pursuant to FOIA, see 5 U.S.C. § 552(a)(4)(B); this is the type of suit that is before us in this case. However, an agency can also be sued through the vehicle of the Administrative Procedure Act for allowing disclosure of information that was in fact covered by one of the nine exemptions to FOIA. See Chrysler Corp. v. Brown, 441 U.S. at 317-18, 99 S.Ct. 1705. This latter type, of suit is commonly referred to as a “reverse FOIA” suit.

FOIA contains provisions governing the circumstances under which a requester will be required to pay the costs of producing the records it has requested. As amended in 1986, FOIA delineates three types of costs — ’“search costs,” “duplication costs,” and “review costs” — and places re-questers into three categories that determine which of these costs a given requester must pay. If a requester wants the information for a “commercial use,” it must pay for all three types of costs incurred.

In contrast, educational institutions and the news media are required to pay only duplication costs, and all other requesters are required to pay search and duplication costs but not review costs. See 5 U.S.C. § 552(a)(4)(A)(ii). OSHA Data agrees that it is making a request for “commercial use,” and therefore is liable for all three categories of costs, including review costs. See OSHA Data Br. at 29. Prior to 1986, FOIA did not require commercial users to pay “review costs,” and in fact the pre 1986 statute did not differentiate between requests for commercial use and requests for non-commercial use.

Thus, by their very existence, the 1986 amendments reflect a desire to treat commercial uses differently from other uses, requiring that commercial users shoulder more of the costs of FOIA requests, rather than having taxpayers bear costs incurred in processing these commercial requests. See 5 U.S.C. § 552(a)(4)(A)(ii)(I) (reflecting language added via the Freedom of Information Reform Act of 1986, Pub.L. No. 99-570, § 1803, 100 Stat. 3207).

FOIA defines review costs as “only the direct costs incurred during the initial examination of a document for the purposes of determining whether the documents must be disclosed under this

section and for the purposes of withholding any portions exempt from disclosure under this section.” 5 U.S.C. § 552(a)(4)(A)(iv). The DOL argues that the costs of notifying the affected businesses and evaluating their responses were “review costs,” since they were part of the process of the initial review of the records in order to make the determination as to the applicability of Exemption 4, the FOIA provision that exempts confidential commercial information from FOIA’s disclosure requirements. IV. Discussion A.

Issues Raised on Appeal The essential issues before us are: whether the costs of notification and evaluation were appropriately considered “review costs” by the DOL such that the DOL could assess these costs to OSHA Data, and could withhold the records based on nonpayment of these costs; whether the resort to notification was proper; and whether Count III was moot. We conclude that the District Court correctly held that the costs of notification and evaluation were “review costs” which DOL would properly incur and for which OSHA Data was responsible, and that Count III was moot. B. Applicable Law 1.

Review Costs The District Court determined that the anticipated costs of notification and evaluation were “review costs.” OSHA Data argues that these are not the types of costs that are covered by the statutory and regulatory

definitions of “review costs.” FOIA itself contains a definition of “review costs”: Review costs shall include only the direct costs incurred during the initial examination of a document for the purposes of determining whether the documents must be disclosed under this

section and for the purposes of withholding any portions exempt from disclosure under this section. 5 U.S.C. § 552(a)(4)(A)(iv). The DOL regulations give further substance to this definition of review costs, terming them the “costs associated with ... [reviewing records to determine whether any materials are exempt.” 29 C.F.R. § 70.40(a).

The regulations define “direct costs” as “those expenditures which an agency actually incurs in searching for and duplicating (and in the case of a commercial requester, reviewing) documents to respond to an[sic] FOIA request,” and further specify that these costs include employee salaries. Id. § 70.38(b).

The regulations lay out a general rule as to when review costs can be charged to the requester: [C]harges may only be assessed for review at the initial level, i.e. the review undertaken the first time the documents are analyzed to determine the applicability of specific exemptions to the particular record or,portion of the record. Thus a requester would not be charged for review at the administrative appeal level with regard to the applicability of an exemption already applied at the initial level. Id. § 70.40(d)(3).

The regulations do not specifically make reference to, or provision for, the type of costs at issue here. 2. Confidentiality and Notification Procedures The DOL argues that it had to follow the notification procedure, and incur the costs at issue, in order to determine whether any of the requested records fell within Exemption 4 to FOIA. Exemption 4 provides that an agency is not required to disclose “trade secrets and commercial or financial information obtained from a person and privileged or confidential.” 5 U.S.C. § 552(b)(4).

If the information requested is “confidential commercial information” as described by the exemption, the agency need not release it pursuant to FOIA. Therefore, the determination that the DOL would ultimately have to make is whether the information was “confidential” so as to be exempt from disclosure under the statute. The issue presently before us, however, is whether the notification costs that the agency anticipates incurring in furtherance of this ultimate determination would be properly incurred by the DOL, and properly charged to OSHA Data.

In this case, of course, the DOL is not arguing that the requested information can ultimately be withheld as confidential commercial information under Exemption 4; the DOL is merely arguing that it cannot provide the requested information without first ascertaining whether it is confidential commercial information within the meaning of Exemption 4.

The DOL asserts that, as part of its process of determining whether the statutory exemption was applicable, it was required by its own regulations to undertake the notification procedures at issue, and that FOIA and these regulations permit the agency to charge the commercial requester the costs of these procedures. These regulations mandate notification whenever the DOL “has reason to believe that disclosure of the information could reasonably be expected to cause substantial competitive harm,” 29 C.F.R. § 70.26(d)(2)(ii).

The DOL concluded, and the District Court agreed, that the possibility of substantial competitive harm was sufficient to trigger the regulations mandating notification of the business submitters. That is, the DOL believed that it had to pursue notification so it could determine whether information requested by OSHA Data would ultimately qualify as “confidential” under Exemption 4. The notification procedures that are to precede the disclosure of potentially confidential information have as their genesis a presidential order.

In 1987, President Ronald Reagan signed Executive Order 12,600 (“E.0.12,600”), entitled “Predisclo-sure Notification Procedures for Confidential Commercial Information.” Exec. Order No. 12,600, 62 Fed.Reg. 23,781 (1987). E.O. 12,600’s stated purpose is “to provide predisclosure notification procedures under the Freedom of Information Act concerning confidential commercial information, and to make existing agency notification provisions more uniform.” Id. at 23,781 (preamble).

The Executive Order directs agency heads to “establish procedures to notify submitters of records containing confidential commercial information.” Id. (§ 1).

Section 3(

b) of E.O. 12,600 provides that each agency head “shall ... provide the submitter notice ... whenever the department or agency determines that it máy be required to disclose records ... the disclosure of which the department or agency has reason to believe could reasonably be expected to cause substantial competitive harm.” Id. at 23,781-82 (§ 3(b)).

The Executive Order further states that the agency procedures should afford the submitter an opportunity to “object to the disclosure of any specified portion of the information and to state all grounds upon which disclosure is opposed,” id. at 23,782 (§ 4), that the agency “shall give careful consideration to all such specified grounds for nondisclosure” prior to making a final determination whether the information is subject to disclosure, id. (§ 5), and that, in the event the agency shall decide to disclose information following a submitter’s objection, the agency shall provide the submitter with a written statement explaining its decision to disclose, see id.

Pursuant to E.O. 12,600, see id. (§ 7), the DOL enacted regulations to govern predisclosure notification for requests that potentially triggered Exemption 4. These regulations contain language similar to that in the Executive Order. The regulations provide that the DOL “shall provide a business submitter with notice of a FOIA request,” 29 C.F.R. § 70.26(d)(2), whenever the DOL or its component agency “has reason to believe that disclosure of the information could reasonably be expected to cause substantial competitive harm,” id. § 70.26(d)(2)(ii).

The regulations also state that the agency “shall afford a business submitter a reasonable period within which to provide ... a detailed statement of any objection to disclosure”; such statement must “specify all grounds for withholding any of the information under Exemption 4.” Id. § 70.26(e).

According to the DOL, these regulations required it to notify the 80,000 affected businesses of OSHA Data’s FOIA request so that the DOL could fulfill its responsibility to determine whether the information in question was subject to disclosure or whether it instead came under the confidential commercial information exemption to FOIA. C. Resolution of Issues Raised on Appeal OSHA Data argues that the District Court’s assessment of the costs to OSHA Data was erroneous for two reasons: first, because these costs were not the type of costs encompassed by the statutory and regulatory

definitions of “review costs,” and second, because the agency had not shown a need for the notification procedures that led to the imposition of these projected costs. In furtherance of its first claim, OSHA Data asserts that the “initial examination of a document,” for which review costs can be charged, 5 U.S.C. § 552(a)(4)(A)(iv), should be narrowly construed, and that the predisclosure notification and evaluation are not part of this initial examination. The construction urged by OSHA Data, in effect, equates “initial examination” with an “initial step” in the process.

The DOL argues that the “initial examination” includes all relevant steps taken by the agency culminating in its decision as to whether the information is subject to disclosure or is instead exempt. DOL asserts that “initial examination” refers to the entire process leading to the disclosure decision, and that the word “initial” is used primarily to distinguish this process from the process of “reviewing the materials again for purposes of applying the same exemption on an administrative appeal.” DOL Br. at 21.

While FOIA does not set forth a definition of “initial examination,” we conclude that its language does not support OSHA Data’s

interpretation. The statute refers to “initial examination of a document for the purposes of determining whether the documents must be disclosed under this

section and for the purposes of withholding any portions exempt from disclosure under this section.” 5 U.S.C. § 552(a)(4)(A)(iv). It cannot be doubted that DOL proposes to undertake predisclosure notification and evaluation for exactly the purpose stated in the statute: to determine whether the documents must be disclosed or whether they are exempt from disclosure. Without complying with these notification procedures, the agency would have great difficulty engaging in any meaningful “review” so as to make that determination.

Thus, we conclude that the statute suggests a broader reading of “initial examination,” sufficiently broad to encompass the contested steps in the predisclosure decision making process. In addition, the DOL regulations described above are available to fill in the interstices in the statute; these regulations clearly suggest an

interpretation of “initial examination” that mirrors the meaning suggested by the DOL. The regulations specifically state that costs may be assessed for “review at the initial level, i.e. the review undertaken the first time the documents are analyzed to determine the applicability of specific exemptions to the particular record or portion of the record,” and clarify that, therefore, “a requester would not be charged for review at the administrative appeal level with regard to the applicability of an exemption already applied at the initial level.” 29 C.F.R. § 70.40(d)(3).

The regulatory language clearly supports the view that “initial examination” was being contrasted to “subsequent review on appeal,” not the view that “initial examination” consists only of an agency’s first internal look at the requested records. OSHA Data has not challenged the validity of these regulations, and we will adopt the meaning apparent to us under the regulations’ plain language. We therefore conclude that the expenses of predisclosure notification and evaluation are the types of expenses to' which the term “review costs” was meant to apply.

OSHA Data next contends that, regardless of whether notification costs fall within the general ambit of “review costs,” the costs in this case should not be charged to OSHA Data because it was unnecessary for the agency to incur them.

OSHA Data claims that the DOL had no reason to notify — that is, that there is no basis for the DOL’s determination that the information in question might give the agency “reason to believe that disclosure of the information could reasonably be expected to cause substantial competitive harm,” the trigger for mandatory notification specified by the applicable regulations. 29 C.F.R. § 70.26(d)(2)(H). OSHA Data is, in essence, contesting the propriety of the agency’s resort to the notification procedures.

FOIA explicitly provides a right of action for requesters to contest an agency’s ultimate decision to withhold data. See 5 U.S.C. § 552(a)(4)(B) (giving the district court jurisdiction, “[o]n complaint,” to “enjoin the agency from withholding agency records and to order the production of any agency records improperly withheld”). It is well established that requesters can challenge the costs charged to them. See, e.g., 5 U.S.C. § 552(a)(4)(A)(vii) (referring to an “action by a requester regarding the waiver of fees”).

We construe OSHA Data’s argument, then, as an argument that the assessment of “review costs” includes within it some determination that these review costs were reasonably or appropriately incurred.

We will accordingly examine, as did the District Court, the DOL’s basis for its decision to incur the notification and evaluation costs that it claims as “review costs.” As the District Court recognized, the DOL has provided several justifications for its decision to pursue predisclosure notification, all of which go toward assessing the risk of “substantial competitive harm.” The DOL gives several reasons why it believed that some of this specific information might" eventually be deemed to qualify as confidential under Exemption 4.

First, the DOL had previously represented to submitters that it would maintain the confidentiality of their responses. See A. at 18-25. The DOL has also presented evidence that legislators and businesses consider Information of this sort to be confidential' because of its risk of causing “substantial competitive harm” if disclosed. See, e.g., A. at 143-44 (Letter from Rep.

Cass Ballenger, Chairman, Subcommittee on Workforce Protections, Committee on' Economic and Educational Opportunities, to Charles Bowsher, Comptroller General of the United States, Nov. 12, 1996) (outlining confidentiality concerns stemming from the specific Data Collection Initiative at issue in this case); A. at 196, 200-01 (Declaration of DOL official Emily Sheketoff, Apr. 27, 1998) (describing the basis for the confidentiality concerns expressed by representatives of Goodyear, one of the companies submitting Data Initiative Collection data).

More important, as the District Court noted, at least one federal court has held that information similar to the workplace data in question here was competitively sensitive and therefore confidential within the meaning of Exemption 4. See Westinghouse Elec. Corp. v. Schlesinger, 392 F.Supp. 1246, 1249 (E.D.Va.1974), aff'd, 542 F.2d 1190 (4th Cir.1976) (superseded by statute on other grounds, see CNA Fin. Corp. v. Donovan, 830 F.2d 1132, 1141 & n. 62 (D.C.Cir.1987)).

The District Court concluded that Westinghouse provided support for DOL’s contention that “[t]he information sought by OSHA Data could give a submitter’s competitors insight into the productivity, hours worked, market share and production,” and that the disclosure of such information could cause the submitter “substantial competitive harm.” A. at 337 n.7. We agree.

In Westinghouse, the District Court for the Eastern District of Virginia held that information appearing in a business’s equal employment opportunity workforce report and affirmative action plan, could, if disclosed, enable competitors to calculate (via “reverse engineering”) that business’s labor costs and profit margins. See Westinghouse, 392 F.Supp. at 1249.

Similarly, argues the DOL, a competitor could use information about a business’s number of employees and employee work-hours to calculate estimates of that company’s labor costs and productivity, which would give that competitor valuable inside information to assist its pricing strategies. In fact, previous litigation concerning the Data Collection Initiative itself has touched on confidentiality concerns. See American Trucking Assocs. v. Reich, 955 F.Supp. 4, 6 (D.D.C.1997) (noting employers’ concerns about the confidentiality of the Data Collection Initiative).

The DOL maintains that the District Court’s order for injunctive relief in American Trucking depended in part upon OSHA’s assurance that it would keep the survey data for internal use only. See DOL Supp.App. at 3 (District Court order granting injunction, American Trucking Assocs. v. Reich, D.D.C. Civ. No. 96-552(TPJ), Mar. 18, 1997); see also A. at 200 (Declaration of DOL official Emily Sheketoff, Apr. 27, 1998). The issue before us as we examine this early stage of the DOL’s process is whether disclosure of the information sought could lead to substantial competitive harm.

The evidence produced was sufficient for this purpose. We are not faced with the ultimate issue for the agency, namely whether the information in the Count I and II requests was actually confidential and therefore covered by Exemption 4, and we take no position on this question. However, as the District Court found, the evidence is clearly sufficient to surpass the much less onerous threshold of showing that the DOL acted appropriately in concluding that it had “reason to believe that disclosure of the information could reasonably be expected to cause substantial competitive harm,” 29 C.F.R. § 70.26(d)(2)(h).

This standard for triggering mandatory predisclosure notification is obviously much less burdensome than the standard for justifying an ultimate withholding of information under Exemption 4. See supra note 24 (describing National Parks standard).

The DOL need not show that the disclosure of the information requested would cause substantial competitive harm, but must show only that the DOL had “reason to believe that disclosure ... could reasonably be expected to cause substantial competitive harm.” The totality of the evidence of the potential for substantial competitive harm that was available to the DOL at the time it assessed the need for predisclosure notification was sufficient to give the DOL reason to believe that substantial competitive harm might reasonably result from some of the disclosures in question. In

summary, we conclude that the estimated $1.7 million costs for notification and evaluation were “review costs” properly chargeable to OSHA Data in connection with the notification procedure authorized by agency regulations, and that the District Court correctly dismissed Counts I and II of the Amended Complaint based on OSHA Data’s inability to pay these costs. D. Mootness of Count III OSHA Data concedes that it has received the specific data that were the subject of the Count III request. Ordinarily, the receipt of the data would render Count III moot. See, e.g., National Resources Defense Council, Inc. v.

NRC, 680 F.2d 810, 814 (D.C.Cir.1982) (stating that a federal court “is not empowered to decide moot questions ... or to declare, for the government of future cases, principles or rules of law which cannot affect the result as to the thing in issue in the case before it”) (quoting California v. San Pablo & Tulare R.R. Co., 149 U.S. 308, 314, 13 S.Ct. 876, 37 L.Ed. 747 (1893)) (internal quotation marks omitted).

However, OSHA contends that Count III falls into the narrow category of controversies that are “capable of repetition, yet evading review” and thus constitute an exception from the application of the mootness doctrine. See Press-Enterprise Co. v. Superior Ct. of Cal., 478 U.S. 1, 6, 106 S.Ct. 2735, 92 L.Ed.2d 1 (1986).

In order to qualify for this exception, OSHA Data has the burden of meeting both parts of the following test: “(1) the challenged action was in its duration too short to be fully litigated prior to its cessation or expiration, and (2) there was a reasonable expectation that the same complaining party would be subjected to the same action again.” United States v. Criden, 675 F.2d 550, 553 (3d Cir.1982) (quoting Murphy v. Hunt, 455 U.S. 478, 482, 102 S.Ct. 1181, 71 L.Ed.2d 353 (1982)) (additional citation and internal quotation marks omitted).

For much the same reasons as the District Court, we conclude that OSHA Data has not satisfied the second part of that test. OSHA Data alludes in its brief to a DOL “policy” of withholding the last 30 days of information from the computer file tapes provided in response to FOIA requests for data on violations uncovered during workplace inspections. See OSHA Data Br. at 9. However, the only record evidence that might point to such a policy consists of two letters from OSHA Data to DOL officials. See A. at 41 (Letter from Matthew M.

Carmel, President of OSHA Data, to DOL official Cathryn Goedert, Aug. 5, 1997); A. at 46 (Letter from Matthew M. Carmel to DOL official Bill Wright, Sept. 12, 1997). The first letter states that a DOL employee had informed OSHA Data that there was a “new policy” of not providing inspection records for establishments that were issued violations during the 30 days prior to the tape creation date. A. at 41. OSHA Data has not provided any direct documentation of such a policy.

Although OSHA surely need not prove, at the complaint stage, that such a policy exists, the mere allegation of an agency policy does not satisfy OSHA Data’s burden of showing that it is reasonably likely to be subject to the 30-day blackout period in the future. Similarly, the second letter, which alludes to a previous DOL “offer” to exclude most requested information within the 30-day period, does not satisfy this burden. OSHA Data does not include in the record the letter from the DOL in which this offer was allegedly made.

As the District Court observed: OSHA Data argues there are, and will continue to be, quarterly requests for information contained in the derived file. OSHA Data further argues that because the Department of Labor has not stated it will cease the practice of withholding the thirty day data, there is a reasonable expectation OSHA Data “will be subject to the same action.” Accordingly, OSHA Data asserts Count Three is not moot.

OSHA Data, however, has failed to demonstrate that any of its future information requests will be denied as a result of the operation of the alleged thirty day exclusionary period. * * * * * * OSHA Data commenced this matter on 22 January 1998. Since the commencement of this matter and the filing of the OSHA Data Motion for

Summary Judgment, several quarters have passed. No argument has been presented by OSHA Data to suggest that any of the intervening quarterly requests for information were impacted by the operation of the alleged thirty day exclusionary policy. A. at 344-46 (District Court Letter Opinion, May 10, 1999). Thus, the District Court concluded, OSHA Data had not shown a reasonable expectation that it would be subjected to the alleged blackout period. See id. at 346-47. We agree with the District Court’s assessment.

OSHA Data has not satisfied its burden of establishing that Count III falls under the category of claims that are “capable of repetition, yet evading review.” We will therefore affirm the District Court’s dismissal of Count III as moot. V. Conclusion For the foregoing reasons, we will affirm the judgment of the District Court. . 5 U.S.C. § 552 (1994). . The United States Department of Labor sought to undertake this notification process in order to determine whether any of the requested records might qualify as "confidential commercial information” within the meaning of Exemption 4 to FOIA.

See 5 U.S.C. § 552(b)(4). . To avoid confusion between the name of the appellant and the name of the agency, we will refer to the Department of Labor or any of its subdivisions, including OSHA (the Occupational Safety and Health Administration), as "the DOL” or "the agency” rather than "OSHA.” . As we mention below, we will also leave undisturbed certain intermediate rulings made by the District Court, including the District Court's affirmance of a stay issued by the Magistrate Judge. See infra n.20. . OSHA Data is a New Jersey corporation with its primary place of business in Maple-wood, New Jersey.

See A. at 4-5. . Although OSHA Data filed a First Amendment to Complaint adding a fourth count reflecting a fourth FOIA request, see A. at 49-50, the parties have since agreed that the records sought in this fourth request have been produced, rendering Count IV of the complaint moot. See OSHA Data Br. at 5; DOL Br. at 3. . These records are maintained by OSHA (the Occupational Safety and Health Administration), which is a subdivision of the Department of Labor. . The information at issue in Count I was requested by OSHA Data in a letter dated October 29, 1996.

The information at issue in Counts II and III was requested on October 24, 1996, and September 12, 1997, respectively. Strictly chronologically speaking, therefore, Count I is the second request rather than the first; but we will refer to the Count I request as the "first request” and Count II as the "second request,” to track the language in the parties’ papers. .The industries that underwent these inspections were different from the industries covered by the Data Collection Initiative. Compare A. at 33 with A. at 16-17.

See also DOL Supp.App. at 1. .The DOL initially asserted grounds for withholding the records that are different from the grounds it now asserts. However, the agency may justify the withholding of documents under any applicable exemption to FOIA, even if it is not the exemption that was initially asserted. Cf. 5 U.S.C. § 552(a)(4)(B) (describing district court review of agency's FOIA decision). . The DOL did not rule on the Count III request, because the DOL maintains that it has provided the data in question in response to'later FOIA requests by OSHA Data. .

OSHA Data later filed an amended complaint that included the now-moot fourth count mentioned above. . The DOL projected these costs to total approximately $1.7 million. For the Count I request, the DOL estimated a cost of $1,554,-250 — $24,000 in mailing costs ($0.32 x 75,-000 companies), $6,250 in preparing letters for mailing ($ 10/person/hour x 75,000 -s- 120 envelopes/hour/person), $1,500,000 for staff time reviewing the submitters’ responses ($20/person/hour x 75,000 4- 1 response/hour/person), and $24,000 for a second mailing.

For the Count II request, the DOL estimated a cost of $145,063, using the same hourly rates for a base of 7,000 submitters. See DOL Supp.App. at 1. It is worth noting that these are projected rather than actual costs. Should it occur that many of the companies contacted would not wish to object to disclosure of the requested information, the actual costs might be much lower, and of course OSHA Data would be responsible only for the actual costs. .

The DOL sought this stay to allow the agency the opportunity to contact the submitters of the information requested, so that the agency could determine whether this information fell under one of FOIA’s nine exemptions to disclosure. This Motion to Stay was referred to Magistrate Judge Dennis M. Cava-naugh pursuant to 28 U.S.C. § 636(b)(1)(A); Judge Cavanaugh granted the motion, ruling that the DOL was required to undertake the notification and that it was appropriate to charge OSHA Data the costs of notification and mailing, as well as the costs of evaluating responses, as "review costs.” See A. at 224-234.

The District Court (Judge Alfred J. Lechner, Jr.) then affirmed the stay, interpreting it as a stay specifically of Counts I and II. . The District Court denied

summary judgment to both parties, reasoning that there remained a genuine issue of fact as to whether the requested records did in fact fall under an exemption to FOIA. The District Court also rejected the DOL’s argument that Counts I and II should be dismissed on the ground that nonpayment constituted a failure to exhaust administrative remedies. The parties do not appeal these determinations. . Perhaps the classic example of such a scenario is Roe v. Wade. See Roe v. Wade, 410 U.S. 113, 125, 93 S.Ct. 705, 35 L.Ed.2d 147 (1973) (quoting Southern Pac. Terminal Co. v.

ICC, 219 U.S. 498, 515, 31 S.Ct. 279, 55 L.Ed. 310 (1911)). . OSHA Data conceded that Count IV was moot. See A. at 348. . FOIA explicitly provides that the district court shall review de novo the agency’s determination that records are not subject to disclosure. See 5 U.S.C. § 552(a)(4)(B). . Legislative history and agency

interpretations of the statutory language further flesh out the policies that are apparent from the language of the 1986 amendments themselves. The Office of Management and Budget, which is charged with issuing guidance on FOIA fees, see 5 U.S.C. § 552(a)(4)(A)(i), has commented as follows on the 1986 amendments: ''[I]t seems clear that the Congress intended to distinguish between reques-ters whose use of the information was for a use that furthered their business interests, as opposed to a use that in some way benefitted the public.

The amendment shifts some of the burden of paying for the FOIA to the former group and lessens it for the latter.” 52 Fed.Reg. 10,011, 10,013 (1987); see also 132 Cong. Rec. 29,616 (1986) (statement of Rep. English) ("[H]igher fees for commercial users will recover more of the costs of processing requests when one business uses the FOIA to seek information about another under circumstances in which there are no public interest aspects to the disclosure”). . OSHA Data lists four separate "issues presented” on appeal. OSHA Data Br. at 2.

Some involve procedural objections to intermediate decisions of the District Court, in-eluding the District Court's decision to affirm the stay and to affirm other orders of the Magistrate Judge. We will not address the procedural aspects of these interlocutory objections to the District Court’s intermediate orders, as these aspects do not affect the outcome on appeal; it is a well-known general principle that interlocutory orders merge in the final judgment of the District Court. See Cohen v. Beneficial Indus.

Loan Corp., 337 U.S. 541, 546, 69 S.Ct. 1221, 93 L.Ed. 1528 (1949) (stating that 28 U.S.C. §§ 1291 and 1292 do not “permit appeals, even from fully consummated decisions, where they are but steps towards final judgment in which they will merge”).

However, OSHA Data can of course attack the substance of the reasoning that underlies the District Court's order affirming the stay, since the substantive basis of this decision — i.e., that the DOL was justified in charging the costs of the notification to OSHA Data as "review costs” — is memorialized, and indeed specifically included, in the District Court’s final order of May 10, 1999. See A. at 336-37. To the extent that these objections implicate the substantive issues presented by this appeal, we will dispose of them via our discussion of the merits, see infra

section IV.C. . FOIA also allows an agency to require advance payment of part of the anticipated costs when those costs are predicted to exceed $250. See 5 U.S.C. § 552(a)(4)(A)(v). . The parties agree that the requested information qualified as "records” within the meaning of FOIA. See A. at 279-80 (DOL's responses to interrogatories); OSHA Data Br. at 10. . OSHA Data concedes that the information is commercial in character, and, with the exception of one piece of data (the LWDII rate), concedes that the information is obtained from a person. Employers are "persons” within the meaning of FOIA.

See 5 U.S.C. § 551(2) (defining "person” to include "an individual, partnership, corporation, association, or public or private organization other than an agency”). OSHA Data contends that the LWDII rate is not "obtained from a person” because it is a derived figure calculated by the DOL. See OSHA Data Br. at 18. However, as it appears that the LWDII rate is merely a ratio calculated from individual components all of which are obtained from employers, we find that the LWDII rate, like the other information sought by OSHA Data, is "obtained from a person." .

The leading case interpreting Exemption 4 is National Parks & Conservation Ass'n v. Morton, 498 F.2d 765 (D.C.Cir.1974).

National Parks lays out the following test governing the ultimate agency decision whether requested information is exempt from disclosure: [C]ommercial or financial matter is "confidential” for purposes of the exemption if disclosure of the information is likely to have either of the following effects: (1) to impair the Government's ability to obtain necessary information in the future; or (2) to cause substantial harm to the competitive position of the person from whom the information was obtained. Id. at 770 (footnote omitted). .

OSHA Data argues as an initial matter that the Log 200 and LWDII information cannot be considered "confidential” because this information is readily available elsewhere. See OSHA Data Br. alt 28-29; Reply Br. at 7-13. It is true that DOL regulations require employers to post an annual

summary of Log 200 data at the workplace itself, see 29 C.F.R. § 1904.5, and that some information about workplace safety for selected work sites has been posted on portions of the DOL's World Wide Web site, see OSHA News Releases & Statements: Combined National & Regional Index (visited June 19, 2000) <http://www.osha.gov/media/oshnews>. However, we reject OSHA Data’s argument that these limited disseminations of information render the Log 200 and LWDII data “officially made available to the public” such that predisclosure notification would not be required. 29 C.F.R. § 70.26(g)(2). As the DOL points out, see DOL Br. at 40-41, the posting of an annual injury and illness

summary at the work site itself is a limited disclosure to a limited audience, a disclosure which is surely insufficient to render the data publicly available; similarly, the DOL’s inclusion on its Web site of information on a few specific workplaces is not tantamount to a public dissemination of the entire Data Collection Initiative information. OSHA Data has not met its burden of producing evidence that the information it seeks in its FOIA requests has already been made public by the agency. See Occidental Petroleum Corp. v. SEC, 873 F.2d 325, 343 (D.C.Cir.1989). .

The DOL regulations also require notification when "[t]he business submitter has in good faith previously designated the information as commercially or financially sensitive information.” 29 C.F.R. § 70.26(d)(2)(i). . OSHA Data states that "[i]n order to assert the need to notify business submitters, [the DOL] must have already conducted its 'initial examination’ " and thus cannot charge for any "additional” review costs. OSHA Data Br. at 30.

Although OSHA Data does not (and cannot) dispute the fact that commercial requesters, due to their responsibility to pay "review costs,” are generally required to shoulder more of the cost burden of FOIA requests than are other requesters, OSHA Data has not identified what costs incurred by the agency in this case would qualify as review costs.

Thus, while in theory OSHA Data seems willing to bear costs beyond the costs of duplication and search, OSHA Data has not suggested what would be the permissible "review costs” in this case if, as OSHA Data argues, the notification and evaluation costs are not such costs. . It is important to note that in this appeal, OSHA Data does not challenge the amount of the predisclosure costs estimated by the DOL; rather, OSHA Data challenges the agency’s determination that it was necessary to incur notification and evaluation costs at all. .

The district courts clearly have de novo review over the ultimate agency decision to withhold records. See 5 U.S.C. § 552(a)(4)(B). However, the parties have provided no guidance as to what standard of review a district court would employ in evaluating the reasonableness of the agency’s intermediate decision to pursue predisclosure notification. Is this & case of an agency interpreting its own regulations (here, the predis-closure regulations) that might entail Chevron deference? See Chevron v. Natural Resources Defense Council, Inc., 467 U.S. 837, 842-44, 104 S.Ct. 2778, 81 L.Ed.2d 694 (1984); Auer v.

Robbins, 519 U.S. 452, 461-63, 117 S.Ct. 905, 137 L.Ed.2d 79 (1997). Or is it a situation where the courts review an adverse agency action for arbitrariness or caprice as provided for by the Administrative Procedure Act? See 5 U.S.C. § 706(2)(A). Or does the de novo FOIA standard apply? We need not decide this question, for we cannot say that the agency erred, under any standard of review, in making the decision to undertake predisclosure notification. .

The DOL asserts that, if the requested information were deemed to have been provided voluntarily by submitters, rather than provided pursuant to a compulsory regulation, the DOL would have an even more heightened responsibility to keep the information confidential. See. DOL Br. at 33-34 (citing Critical Mass Energy Project v. NRC, 975 F.2d 871, 879-880 (D.C.Cir.1992) (en banc)).

Because we find that the DOL had ample justification for its decision to pursue predisclosure notification even under the assumption that the DOL compelled submitters to provide it, we need not reach the question whether the information was in fact provided voluntarily or by regulatory compulsion. . In addition, we cannot fault the agency’s decision to exercise caution in making its determination whether the requested information was exempt from disclosure. As the DOL points out, the consequences of an agency's wrongful disclosure of records can be serious.

The predisclosure notification regulations mandate notification and evaluation whenever the agency has "reason to believe that disclosure of the information could reasonably be expected to cause substantial competitive harm.” 29 C.F.R. § 70.26(d)(2)(ii). A submitter that believes that its information was wrongfully disclosed when that information should have been withheld can bring a "reverse FOIA” suit against the agency under the Administrative Procedure Act. See Chrysler Corp. v. Brown, 441 U.S. 281, 318, 99 S.Ct. 1705, 60 L.Ed.2d 208 (1979).

Wrongful disclosure of information protected under Exemption 4 can even lead to criminal liability for an agency under the Trade Secrets Act, 18 U.S.C. § 1905. See CNA Fin. Corp. v. Donovan, 830 F.2d 1132, 1151-52 (D.C.Cir.1987).

While the fact that wrongful disclosure can lead to agency liability cannot, standing alone, justify the agency's decision to undertake notification (under such a rationale, an agency could potentially justify mandatory notification whenever commercial information of any kind, no matter how innocuous, is requested), surely it is appropriate for the agency to consider its responsibility not to wrongfully disclose confidential information as well as its responsibility to disclose all information whose disclosure is mandated by FOIA. .

As Magistrate Judge Cavanaugh acknowledged, one can imagine information that is far more commercially sensitive than the information requested in Counts I and II. See A. at 188-89 (Transcript of Motion, Apr. 21, 1998, at 38-39). . We note that the breadth of the Count I and II requests — seeking information for over 80,000 companies — makes it difficult for the DOL to determine whether the information falls under Exemption 4 without going through predisclosure notification.

The inquiry into the likelihood of substantial competitive harm is a fact-based inquiry that evaluates the circumstances of the employer submitting the information. See CNA Fin. Corp. v. Donovan, 830 F.2d 1132, 1152-53 (D.C.Cir.1987). Particularly in a case where, as here, the agency collecting the information is collecting it for the first time, see DOL Supp.App. at 11 (Declaration of DOL official Miriam McD. Miller, May 12, 1998), it is unrealistic to expect the agency to be familiar with the competitive circumstances of each of 80,000 submitters without contacting those submitters for further information. .

It is clear that in order to prove that the agency had “reason to believe X,” the agency need show something less than "X is true.” (Here, "X” = “disclosure could reasonably be expected to cause substantial competitive harm.”) . On appeal, OSHA Data has moved to supplement the record with a letter from DOL official Cathryn Goedert to OSHA Data President Matthew M. Carmel. OSHA Data asserts that this letter demonstrates that the DOL has applied the 30-day blackout policy to subsequent OSHA Data quarterly FOIA requests. We will deny OSHA Data's motion to expand the record.

OSHA Data had ample opportunity to present this letter to the District Court, but failed to do so; the letter, which is dated December 4, 1998, came into OSHA Data's possession well before the District Court heard argument on OSHA Data's motion for

summary judgment on Count III in February 1999 and ruled on this motion in May 1999. Our role as a Court of Appeals is to review the decision made by the District Court; we will do so based on the evidence presented to the District Court.