       IN THE COMMONWEALTH COURT OF PENNSYLVANIA


Mission Pennsylvania, LLC,            :
                        Petitioner    :
                                      :
            v.                        :   No. 185 C.D. 2018
                                      :
Wallace McKelvey and PennLive         :
and The Patriot-News,                 :
                      Respondents     :

Terrapin Investment Fund 1, LLC,      :
                        Petitioner    :
                                      :
            v.                        :   No. 186 C.D. 2018
                                      :
Wallace McKelvey and PennLive         :
and The Patriot-News, and The         :
Pennsylvania Department of Health,    :
                        Respondents   :

SMPD Manufacturing, LLC               :
and SMPB Retail, LLC,                 :
                      Petitioners     :
                                      :
            v.                        :   No. 187 C.D. 2018
                                      :
Wallace McKelvey, PennLive            :
and The Patriot-News,                 :
                      Respondents     :

Cresco Yeltrah, LLC,                  :
                        Petitioner    :
                                      :
            v.                        :   No. 188 C.D. 2018
                                      :
Wallace McKelvey, PennLive            :
and the Patriot-News,                 :
                      Respondents     :
Pennsylvania Department                        :
of Health,                                     :
                       Petitioner              :
                                               :
               v.                              :    No 189 C.D. 2018
                                               :
Wallace McKelvey and PennLive,                 :
                      Respondents              :

KW Ventures Holdings, LLC,                     :
                       Petitioner              :
                                               :
               v.                              :    No. 190 C.D. 2018
                                               :    Argued: February 12, 2019
Wallace McKelvey and Pennlive                  :
and the Patriot-News,                          :
                      Respondents              :

BEFORE:        HONORABLE MARY HANNAH LEAVITT, President Judge
               HONORABLE RENÉE COHN JUBELIRER, Judge
               HONORABLE ROBERT SIMPSON, Judge
               HONORABLE P. KEVIN BROBSON, Judge
               HONORABLE MICHAEL H. WOJCIK, Judge
               HONORABLE CHRISTINE FIZZANO CANNON, Judge
               HONORABLE ELLEN CEISLER, Judge


OPINION
BY JUDGE SIMPSON                               FILED: June 4, 2019

               These consolidated appeals arising from an access dispute under the
Right-to-Know Law (RTKL)1 involve complex procedural and substantive questions,
including the public nature of applications under the Medical Marijuana Act (Act).2
We are also presented with requests to supplement the record developed before the
Office of Open Records (OOR), thus enlisting this Court’s fact-finding functions.


      1
          Act of February 14, 2008, P.L. 6, 65 P.S. §§67.101-67.3104.
      2
          Act of April 17, 2016, P.L. 84, 35 P.S. §§10231.101-10231.2110.
              The Department of Health (DOH) and five successful applicants for
medical marijuana grower/processor or dispensary permits (collectively, Permittees),3
challenge OOR’s final determination, granting in part and denying in part the request
of Wallace McKelvey, PennLive and The Patriot-News (collectively, Requester)
seeking unredacted copies of their six permit applications pursuant to the RTKL.
OOR directed DOH to disclose Permittees’ applications with minimal redaction of
personal identifiers and proven trade secrets.


              We decline to supplement the record. On the record developed below,
we reverse OOR’s final determination in part to allow redaction of specified facility
and systems security information, and we affirm in all other respects.


                                      I. Background
                                  A. Legal Framework
              The General Assembly enacted the Act, effective as of May 17, 2016,
to establish a framework for legalization of medical marijuana in the Commonwealth.
DOH is the Commonwealth agency responsible for administering the Act, including
promulgating temporary regulations necessary to perform this function. Section 301
of the Act, 35 P.S. §10231.301; Section 1107 of the Act, 35 P.S. §10231.1107.
Attendant to this authority, DOH promulgated temporary regulations and established
an application process for businesses seeking permission to operate as medical
marijuana organizations. See 28 Pa. Code §§1131.1–1191.33.

       3
         In addition to the appeal filed by the Department of Health (DOH) (No. 189 C.D. 2018),
Permittees filed petitions for review as follows: Mission Pennsylvania, LLC (Mission) (No. 185
C.D. 2018); Terrapin Investment Fund 1, LLC (No. 186 C.D. 2018) (Terrapin); SMPD
Manufacturing, LLC and SMPB Retail, LLC (Harvest) (No. 187 C.D. 2018); Cresco Yeltrah, LLC
(Cresco) (188 C.D. 2018); and KW Ventures Holdings, LLC (KW Ventures) (No. 190 C.D. 2018).

                                              2
              Section 302(b) of the Act (relating to public disclosure) provides that
applications “are public records and shall be subject to the [RTKL].”                  35 P.S.
§10231.302(b). DOH’s temporary regulation as to the same subject mirrors the Act by
listing applications as “public records … subject to disclosure under the [RTKL] .…”
28 Pa. Code §1141.22 (Temporary Regulation). However, the Temporary Regulation
states: “the following information is considered confidential, is not subject to the
[RTKL], and will not otherwise be released … unless pursuant to court order …
information regarding the physical features of, and security measures installed in, a
facility.” 28 Pa. Code §1141.22(b)(9) (emphasis added).


              Further, in the application instructions, DOH advised all applicants to
submit redacted and unredacted copies of their applications with the understanding
that redacted copies would be posted on its public website. Although the instructions
state all submissions would be subject to disclosure under the RTKL, they also quote
the Temporary Regulation which extended protection to “information regarding
physical features of and security measures installed in a facility, information in the
electronic tracking system” and other information subject to protection by the RTKL
or as proprietary under another law. Reproduced Record4 (R.R.) at 46a.


              DOH received dozens of applications comprised of thousands of pages,
both grower/processor (GP) applications and dispensary (DS) applications. DOH
received all applications by March 2017. In late June 2017, DOH announced the
award of 12 GP permits and 27 DS permits, including those of Permittees.

       4
         The reproduced record does not comply with Pa. R.A.P. 2173 in either its printed or
electronic form; notably, the two versions differ. Complicating our review and references to the
record, parts of the reproduced record lack any pagination, and numbering is completely absent
for hundreds of fully redacted pages. In such instances, we cite the certified record.

                                               3
                               B. Procedural History
             In May 2017, Requester initially sought all applications for GP permits
and all successful applications for DS permits (Request). In July, DOH denied the
Request in part, referring Requester to the redacted copies of GP applications posted
on its website, and denying access to DS applications that were not posted yet. DOH’s
denial grounds included the right to privacy in personal information as well as RTKL
exceptions contained in Section 708(b), 65 P.S. §67.708(b), as to personal identifiers,
trade secrets and confidential proprietary information, and records revealing
infrastructure or computer security information. DOH explained that its redactions,
as opposed to Permittees’ redactions it allowed, were marked as “DOH redacted.”


             Requester appealed to OOR only as to Permittees’ six applications, both
GP and DS applications from Cresco, the GP application from Terrapin, and DS
applications from KW Ventures, Mission and Harvest (collectively, Applications).
Requester asserted DOH lacked a legal basis for its redactions, emphasizing the
disparity of redaction among Permittees. It argued the Applications were public
records as a matter of law under the Act. Requester also noted the legislative intent
and public interest in disclosure of the redacted information. See Certified Record
(C.R.), Item No. 1 (Verified Appeal, Requester Mem. at 4-5, 9-10).


             OOR requested evidence and directed DOH to notify third parties under
Section 1101(c) of the RTKL, 65 P.S. §67.1101(c). Once notified, all Permittees asked
to participate, submitting argument in support. Cresco also submitted an affidavit of its
General Counsel John Figone (Figone Affidavit), and Harvest and Terrapin submitted
unverified exemption logs.



                                           4
              In its position statement, DOH admitted to some improper redaction.5
C.R., Item No. 4 (August Submission, at 3); R.R. at 37a. DOH also submitted an
affidavit of Program Director John Collins generally describing the varied redactions
(Director Affidavit). R.R. at 48a-49a. It contained a citation to DOH’s Temporary
Regulation, 28 Pa. Code §1141.22(b)(9), and a general reference to the RTKL.


              Director explained DOH’s redaction process, attesting DOH only
redacted as follows: information marked as confidential proprietary by Permittees if
not otherwise redacted; personal and financial information; and information related
to building and infrastructure security. Director did not connect these redactions to
specific parts of the Applications or differentiate between Permittees’ Applications.
He also alleged no harm related to disclosure. Nonetheless, DOH redacted entire
parts of the Applications including: Section 10 (security/surveillance); Section 11C
(transport plans); Section 12B (storage plans); Section 14C (inventory management);
Section 15 of the DS and Section 16B of the GP applications (diversion prevention);
Section 15B of the GP application (waste disposal); and Attachment D (site and
facility plans) of both GP and DS applications. R.R. at 43a.


              Significantly, DOH did not review any of the redacted material before
preparing its August Submission. Instead, DOH reviewed the already redacted
applications, relying on Permittees’ redactions, as evinced by the Director Affidavit.
DOH claimed it could not review the unredacted Applications based on the volume
of records initially sought in the Request.



       5
         For example, DOH initially redacted labeling processes from DS applications when it did
not redact the same information from GP applications.

                                               5
             Realizing that DOH did not review the Applications in unredacted form
before asserting exemptions, in September 2017, OOR stayed the matter to allow
DOH to evaluate the propriety of Permittees’ redactions, to assert any applicable
exemptions and to submit supporting evidence.          R.R. at 72a-84a (September
Opinion). OOR asked DOH to estimate the time for reviewing the Applications, and
accepted DOH’s verified estimate of 60 days. See R.R. at 95a-98a (DOH Estimate).


             Requester sought reconsideration of the stay because only “2,844 pages”
remained at issue, and because the stay allowed DOH a second opportunity to
support exceptions asserted months before. R.R. at 97a (quoting DOH). OOR
denied reconsideration.


             DOH submitted its response early, noting it kept Permittees’ redactions
for confidential proprietary/trade secrets and security information. R.R. at 104a-37a
(November Submission). Specifically, DOH represented it:

             lifted clearly improper redactions … maintained [Permittees’]
             redactions that were proper and appropriately cited … [and]
             redactions that may not have been properly cited, but were
             clearly exempt under another subsection. [It] further maintained
             redactions where [Permittees] asserted confidential proprietary,
             trade secret or personal safety and security exemptions, as
             [DOH] is unable to stand in the shoes of the individual or entity
             claiming such exemptions. Rather, [DOH] defers to the OOR’s
             determination as to the propriety of these redactions.

R.R. at 104a (emphasis added). DOH also submitted an exemption log as to each
Application. See R.R. at 114a-36a (DOH Logs). The DOH Logs were verified by
its open records officer attesting the “records withheld are described in the preceding
exemption log” without additional description in the verification. R.R. at 115a,


                                          6
121a, 124a, 129a, 131a, 137a. DOH did not submit affidavits describing the
information redacted, or explaining the risks (if any) implicated by disclosure.


             DOH’s November Submission was similar to its August Submission.
DOH asserted its Temporary Regulation and the infrastructure security exception in
Section 708(b)(3) of the RTKL, as to several sections of the Applications in their
entirety. However, in addition to those set forth in its August Submission, DOH also
listed sections of the Applications corresponding to sanitation and safety (Section 16
of DS, Section 20 of GP), and recordkeeping (Section 17 of DS, Section 22 of GP)
as protected on security grounds. Compare R.R. at 43a, with R.R. at 110a.


             Requester responded to DOH’s November Submission, outlining the
deficiencies in the exemption logs submitted by DOH and Permittees to date. R.R.
at 3615a-32a. OOR then granted Permittees’ requests to participate, allowing them
to submit additional evidence. Only Terrapin did so. R.R. at 3636a-74a.


             In December 2017, Terrapin submitted another brief and four affidavits
to support its redactions. As to the confidential nature of its financial information,
Terrapin submitted the affidavit of Director of Government Affairs Shawn Coleman
(Coleman Affidavit). R.R. at 3651a-56a. As to infrastructure and physical security,
it submitted the affidavit of Director of Information Technology James Wenzl (Wenzl
Affidavit). R.R. at 3658a-62a. As to trade secrets, Terrapin submitted two affidavits
regarding their secrecy. It submitted the affidavit of Director of Cultivation Ian Peak
as to its growing and harvesting processes (Peak Affidavit), R.R. at 3664a-68a, and
of Director of Infused Product Manufacturing Jef Frick, as to its extraction and



                                          7
production processes (Frick Affidavit). R.R. at 3670a-74a. In its brief, Terrapin
adopted DOH’s arguments as to personal identifiers and argued the Applications do
not qualify as “financial records” under the RTKL.


             Cresco, Mission and KW Ventures relied on their prior submissions.
Harvest attempted to submit additional argument and more detailed exemption logs,
but OOR did not consider the submission because it was untimely and unsworn.


             Based on the evidence submitted, OOR issued its final determination
granting access to most of the Applications, upholding minimal redaction of personal
information under the constitutional right to privacy and as enumerated in Section
708(b)(6)(i) of the RTKL, 65 P.S. §67.708(b)(6)(i), and allowing Terrapin’s
redaction of trade secrets. See McKelvey v. Dep’t of Health, OOR Dkt. No. AP
2017-1443 (issued January 12, 2018) (Final Determination). As a matter of law,
OOR construed the Act to allow redaction of the Applications in accordance with
the RTKL. OOR also concluded KW Ventures, Mission and Harvest did not prove
any exemptions because their unsworn submissions were not competent evidence.


             Overall, OOR noted deficiencies in the evidence submitted. As DOH’s
evidence lacked sufficient detail about security issues, OOR upheld redaction of only
“plans, specifications, including architectural drawings” in Attachment D as clearly
exempt under the Temporary Regulation. Id. at 50. OOR rejected Cresco’s Figone
Affidavit as vague and conclusory. It also rejected as insufficient Terrapin’s evidence
as to infrastructure security and the confidentiality of its financial information.




                                            8
                Ultimately, OOR directed DOH to disclose the Applications with few
redactions: specified parts of Attachment D; personal information (birth dates, street
addresses, personal identification numbers, bank account numbers, organ donor status
and photographs); and, as to Terrapin only, redaction of proven trade secrets.


                DOH filed a petition for review from the Final Determination, asserting
OOR erred in applying its Temporary Regulation and Section 708(b)(3) of the RTKL
so narrowly. It claimed all security-related redactions should have been upheld.


                Permittees filed their respective petitions for review. Mission alleged
OOR erred in applying the right to privacy and the RTKL exceptions. KW Ventures
argued OOR erred in not upholding all redactions under the Temporary Regulation.6
Terrapin asserted its affidavits and exemption log met its burden of proof as to its
extensive redaction. Cresco and Harvest, represented by the same counsel, contended
the Applications were proprietary in their entirety and alleged OOR erred in applying
the RTKL exceptions. Harvest claimed its unsworn exemption log provided sufficient
detail, whereas Cresco relied on the Figone Affidavit to prove its exemptions.


                Requester did not cross appeal as to the redactions OOR upheld.


                In addition, DOH asks this Court to supplement the record, claiming it
relied on Permittees’ redactions and so did not assert or support its own exemptions




      6
          KW Ventures did not file a brief or join any other party’s brief.



                                                  9
to the redacted information. Mission also seeks to supplement the record with an
affidavit from its principal regarding security measures taken in its facilities.7


                                        II. Discussion
               Before reaching the merits, we consider the requests to supplement the
record filed by DOH and Mission.


                    A. Additional Evidence/Requests to Supplement
               DOH asks this Court to allow it to supplement the record with a more
detailed exemption log. Mission asks to submit an affidavit. Neither party offers a
reason for neglecting to submit the evidence to OOR.


               Generally, this Court declines to serve as fact-finder, a “role ... best
reserved for unique occasions.” Dep’t of Labor & Indus. v. Heltzel, 90 A.3d 823, 834
(Pa. Cmwlth. 2014) (en banc). Where OOR’s “record contains no information on
[records’] nature and content,” we may supplement the record. Pa. State Police v.
Grove, 119 A.3d 1102, 1105-06 (Pa. Cmwlth. 2015), aff’d, 161 A.3d 877 (Pa. 2017).


               An appeals officer has discretion in developing the record, and may
request evidence or explanation from the parties. See Dep’t of Educ. v. Bagwell,
114 A.3d 1113 (Pa. Cmwlth. 2015). Nevertheless, “it is not incumbent upon OOR
to request additional evidence when developing the record. Rather, it is the parties’
burden to submit sufficient evidence to establish material facts.” Highmark Inc. v.
Voltz, 163 A.3d 485, 491 (Pa. Cmwlth. 2017) (en banc).

       7
        In their petitions for review, Harvest and Cresco requested this Court to accept additional
evidence or to remand to allow OOR to accept additional evidence as alternative relief.

                                               10
             To the extent the record developed before OOR is inadequate, DOH
and Permittees are at fault for that inadequacy. Lack of evidence, when the parties
and participants had a full opportunity to submit evidence to the fact-finder, is not a
valid reason for supplementing the record. Id.


             We are unmoved by DOH’s contention that it was unable to evaluate
the unredacted Applications based on the sheer volume of records. The time to submit
evidence supporting the redactions was the appeals officer stage, not the request stage.
As such, the alleged volume of records sought in the request stage offers no excuse.


             During the appeals officer stage, DOH had the onus to review only six
Applications. At that time, only “2,844 pages” were at issue. R.R. at 97a (DOH
Estimate, ¶11). Indeed, OOR allowed DOH to set its own time frame for a response.
By issuing a stay, OOR afforded DOH additional time and opportunity to raise any
applicable exemptions and remedy the identified deficiencies in its review process.
DOH neglected to do so. Instead, it responded early, and its November Submission
was substantially similar to its August Submission. Compare R.R. at 43a (August
Submission), with R.R. at 110a (November Submission).


             Critically, DOH offered no reason for not submitting the evidence
comprised in its request to supplement the record when it had the chance to do so
before OOR. DOH has been subject to the RTKL in its current form for more than
a decade. During that time, this Court’s decisional law consistently underscores the
necessity for evidence substantiating how asserted exemptions apply.




                                          11
              Similarly, Mission offered no cause for not submitting an affidavit when
it had the opportunity. In December 2017, over Requester’s objection, OOR allowed
Permittees additional time to submit evidence supporting their redactions after
Requester detailed the deficiencies in DOH’s and Permittees’ prior submissions.
Only Terrapin submitted additional proof to remedy the identified deficiencies.


              Moreover, allowing additional evidence at the judicial review stage has
implications beyond the present matter. To ensure the RTKL offers an expedient
means of access to public records, parties withholding information must be held to
their burden of proof. Accepting additional evidence without cause essentially allows
agencies to withhold records without legal grounds until reaching a Chapter 13 court,
undermining the presumption of openness that forms the foundation of the current
RTKL.


              Here, OOR afforded maximum due process and attempted to develop a
thorough record, providing DOH and Permittees more than ample guidance, time
and opportunity to support the redactions. Therefore, we decline to review the
additional evidence as fact-finder, or to remand to OOR to reopen the record to
accept this evidence.        To do otherwise would allow Permittees and DOH a
“proverbial [third] bite at the apple.” Highmark, 163 A.3d at 491.


              Accordingly, we deny the requests to supplement the record on appeal,
and review the merits in our appellate capacity.8


       8
        This Court may review appeals involving Commonwealth agencies on the existing record
and defer to OOR as the initial fact-finder. Dep’t of Labor & Indus. v. Heltzel, 90 A.3d 823 (Pa.
Cmwlth. 2014) (en banc). Our review of matters of law is plenary. Id.

                                               12
                                           B. Merits
               In these consolidated appeals, this Court is tasked with examining
OOR’s analysis of several exemptions, and the evidence submitted to prove them.
Here, the disparate redaction of the Applications based on different grounds is at issue,
as DOH accepted Permittees’ redactions without ensuring their consistency.


                              1. Agency’s Duty of Disclosure
               Under the RTKL, an agency has a mandatory duty to disclose records9
in its possession unless an exemption applies to protect the requested information.
Sections 305(a) and 701 of the RTKL, 65 P.S. §67.305(a), §67.701. Entrusted as a
gatekeeper of records, an agency fulfills a public service of guaranteed access,
guided by the legal presumption of openness.


               In the request stage, an agency is required to assess the public status of
requested records, and if applicable, specify reasons for denying access with
“citation of supporting legal authority.” Section 903 of the RTKL, 65 P.S. §67.903.
When a record is not exempt, in whole or in part, an agency “shall” provide access
by inspection or duplication. 65 P.S. §67.701. When parts of a record are public,
meaning not exempt by another law, privilege or exception under Section 708(b) of
the RTKL, 65 P.S. §67.708(b), an agency “shall grant access to” the public parts of
the record pursuant to its disclosure duty. Section 706 of the RTKL, 65 P.S. §67.706.


               The RTKL places the statutory duty of disclosure solely on an agency.
The RTKL also places the burden of proving any asserted exemptions squarely on

       9
         There is no dispute that the Applications are “records” as that term is defined in Section
102 of the RTKL, 65 P.S. §67.102, because they were submitted to DOH for agency action.

                                                13
an agency. Section 708(a)(1) of the RTKL, 65 P.S. §67.708(a)(1). The RTKL does
not allow an agency to delegate its disclosure duty or burden of proof to third parties.
As to records that are not in an agency’s possession, this Court explained a third-
party contractor may wear the “shoes of [an] agency for purposes of the burden of
proof when the contractor performs a governmental function.” Allegheny Cty. Dep’t
of Admin. Servs. v. Parsons, 61 A.3d 336, 342 (Pa. Cmwlth. 2013).


              Mindful of the presumption of openness to records in an agency’s
possession, including records submitted by private parties, decisional law allows
third parties to raise and defend exemptions to protect their information. Highmark;
Dep’t of Educ. v. Bagwell, 131 A.3d 638 (Pa. Cmwlth. 2016); Office of the Governor
v. Bari, 20 A.3d 634 (Pa. Cmwlth. 2011). Further, “agencies are not permitted to
waive a third party’s interest in protecting the records.” Bagwell, 131 A.3d at 650.


              We reject DOH’s premise that its voluntary reliance on Permittees’
redactions merely followed this precedent. Our decisions on third-party rights do
not compel an agency to defer to a third party’s exemptions without regard to their
validity or consistent application.10


                As the responding agency, DOH bore the burden of supporting its
grounds for partially denying access to the Applications. That a third party may be
best suited to provide the most detailed proof does not relieve an agency of its burden.



       10
          Because Permittees’ level of redaction varied widely, DOH’s denial of access among the
Applications was inconsistent. For example, Cresco redacted almost all of Section 14 (Inventory),
whereas KW Ventures did not redact it, so DOH redacted only a few words for security reasons.

                                               14
We disapprove of any attempt to shift this burden to third parties, particularly as an
agency’s duty of disclosure conflicts with a private party’s interest in protection.


                                     2. Public Nature
              Records in an agency’s possession are presumed public unless exempt
under an exception in the RTKL, a privilege, or another law. Section 305(a) of the
RTKL, 65 P.S. §67.305(a). Also, the RTKL does not supersede the public nature of a
record established by statute or regulation. Section 306 of the RTKL, 65 P.S. §67.306.


              The Act expressly provides permit applications “are public records and
shall be subject to the [RTKL].” Section 302(b) of the Act, 35 P.S. §10231.302(b)
(emphasis added). We agree with OOR that the phrase “subject to” renders the
Applications public except when any RTKL exceptions or other exemptions apply.11


              Here, DOH and Permittees asserted the varied redactions are protected
under the constitutional right to privacy, certain RTKL exceptions, regarding security
and trade secret/proprietary status, and the Temporary Regulation.


                                        a. Evidence
              The party asserting an exemption bears the burden of proving that
exemption applies. Global Tel*Link Corp. v. Wright, 147 A.3d 978 (Pa. Cmwlth. 2016);
Jones v. Office of Open Records, 993 A.2d 339 (Pa. Cmwlth. 2010) (agency must prove
its regulation applies). Under Section 708(a)(1) of the RTKL, a party must prove a
RTKL exception applies “by a preponderance of the evidence.” 65 P.S. §67.708(a)(1).

       11
          OOR’s jurisdiction to assess statutory and regulatory exemptions pursuant to Section
305(a)(3) of the RTKL, 65 P.S. §67.305(a)(3), is well-established. Heltzel.

                                             15
In this context, we define a preponderance as “a more likely than not inquiry.”
Borough of Pottstown v. Suber-Aponte, 202 A.3d 173, 180 n.11 (Pa. Cmwlth. 2019).


              Only three parties submitted evidence to prove the asserted exemptions:
DOH, Cresco, and Terrapin. DOH submitted the Director Affidavit and DOH Logs.
Cresco submitted the Figone Affidavit, and Terrapin submitted multiple affidavits.
KW Ventures, Harvest and Mission did not submit evidence.                    Therefore, the
redactions of their applications are unsubstantiated, except to the extent the evidence
applies to all Permittees.


                                      b. Exemptions
                                   (i). Right to Privacy
              First, we consider OOR’s application of the constitutional right to
informational privacy to certain redactions. As Requester did not file a cross appeal,
we do not disturb the redactions OOR upheld premised on this right to privacy.


              Article I, Section 1 of the Pennsylvania Constitution inures individuals
with the right “to control access to, or the dissemination of, personal information
about himself or herself.” Pa. State Educ. Ass’n v. Dep’t of Cmty. & Econ. Dev.,
148 A.3d 142 (Pa. 2016) (PSEA). In PSEA, our Supreme Court explained the
intersection of the personal right to privacy with the public right to access under the
RTKL. Applying precedent analyzing the former law,12 it reconfirmed that “certain
types of [personal] information” may be protected under the right of privacy when

       12
         Act of June 21, 1957, P.L. 390, as amended, formerly 65 P.S. §§66.1-66.9, repealed by
Section 3102(2)(ii) of the RTKL, 65 P.S. §67.3102(2)(ii).




                                             16
the personal right outweighed the public interest in disclosure.13 Id. at 156-57
(quoting Tribune-Review Publ’g Co. v. Bodack, 961 A.2d 110, 115-16 (Pa. 2008)).
Ultimately, the Court protected an individual’s home address.


               As to partial address information, however, our Supreme Court
remanded to the fact-finder to perform the balancing test of the personal and public
interests. See Reese v. Pennsylvanians for Union Reform, 173 A.3d 1143 (Pa. 2017).
Balancing of interests by the fact-finder is a crucial part of privacy analysis. Id.


               Here, after recognizing the competing interests, and an individual’s
right to privacy in a street address, OOR performed the requisite balancing test.
Deferring to OOR as the fact-finder, we decline to rebalance the interests. Id.


               We discern no error in OOR’s analysis of the right to privacy in the
residential addresses of certain individuals. First, OOR explained how certain types
of information were personal, emphasizing that corporate information is not
protected under an individual’s right to privacy.


               Second, OOR recognized the importance of “[v]erification of
principals, operators, financial backers or employees” in this budding industry.
Section 602(a)(1) of the Act, 35 P.S. §10231.602(a)(1). Noting the importance of


       13
          The Court recognized the right to privacy protects three identifiers: social security numbers,
telephone numbers and home addresses. Butler Area Sch. Dist. v. Pennsylvanians for Union Reform,
172 A.3d 1173, 1181 (Pa. Cmwlth. 2017) (citing Tribune-Review Publ’g Co. v. Bodack, 961 A.2d
110 (Pa. 2008); Penn State Univ. v. State Emps.’ Ret. Bd., 935 A.2d 530 (Pa. 2007); Sapp Roofing
Co. v. Sheet Metal Workers’ Int’l Ass’n, 713 A.2d 627 (Pa. 1998) (plurality op.)).



                                                  17
statutory intent,14 it also emphasized both the legislature and DOH required
applicants seeking the privilege of engaging in the medical marijuana business to
disclose names and residential addresses of financial backers and principals. The
submission of this information to the government is a condition of engaging in this
regulated industry.


               OOR determined the street addresses may be redacted from the
applications but required disclosure of the cities, states and zip codes of the
residential addresses. Accordingly, residential addresses that reveal an individual’s
location are not at issue. We are only evaluating an individual’s privacy right in the
remainder of the residential address.


               DOH’s primary argument that the full names and addresses are exempt
is that Requester did not cite any public interest in such information. However,
Requester articulated a public interest in identifying individuals who “own, operate
and finance medical marijuana organizations.” C.R., Item No. 1 (Verified Appeal
at 5); see also id. at 9; R.R. at 3618a (Requester’s Position Statement). This interest
is substantially similar to the interest OOR identified predicated on the Act.


               The record does not contain support for a reasonable subjective belief
that residential addresses would be protected from disclosure.                      Notably, the
application instructions do not list “residential addresses” as confidential information,
thus indicating the contrary. C.R., Item No. 4 (August Submission at 12). Further,

       14
          Our Supreme Court recognized that in crafting legislation, the legislature is cognizant of
privacy interests, such that statutory provisions on public nature reflect the balancing test the
legislature already performed. Pa. State Educ. Ass’n v. Dep’t of Cmty. & Econ. Dev., 148 A.3d
142, 157-58 n.8 (Pa. 2016).

                                                18
none of the parties submitted evidence supporting a subjective expectation in the
privacy of residential addresses submitted in a voluntary application process.


             OOR struck an appropriate balance in permitting partial redaction of
addresses here. Thus, we discern no error by OOR in analyzing the right to privacy.


                          (ii). Physical & Facility Security
             To protect the physical features and security measures of permitted
facilities, DOH and Permittees asserted Section 708(b)(3) of the RTKL, 65 P.S.
§67.708(b)(3). DOH and Terrapin also asserted the Temporary Regulation.


                          (a). Facility Security Exception
             Section 708(b)(3) of the RTKL protects from disclosure “[a] record, the
disclosure of which creates a reasonable likelihood of endangering the safety or the
physical security of a building … [including] (iii) building plans” disclosing the
location or configuration of critical systems. 65 P.S. §67.708(b)(3)(iii). “For this
exemption to apply, ‘the disclosure of’ the records, rather than the records themselves,
must create a reasonable likelihood of endangerment to the safety or physical security
of certain structures ….” Suber-Aponte, 202 A.3d at 181 (citation omitted). More
than speculation is required. Carey v. Dep’t of Corr., 61 A.3d 367 (Pa. Cmwlth. 2013).


             OOR concluded that none of the parties met their evidentiary burden
to prove this exception. Reviewing the record as a whole, we disagree.


             Terrapin submitted the Wenzl Affidavit to protect its facility security
information. See R.R. at 3658a-62a. Wenzl installed, operated and maintained video

                                          19
surveillance and physical security systems for Terrapin’s Pennsylvania facilities, and
he has a security certification. Wenzl Affidavit, ¶5. He attested Terrapin’s redactions
included descriptions of its “security and surveillance systems that are intended to
protect unauthorized entrance into the facility; and to prevent and detect diversion,
theft or loss of any [s]eeds, medical marijuana plants and medical marijuana
products.” Id., ¶11. Terrapin also redacted “information regarding the measures to
protect … the security and safety of its (i) facility … exhibits and other attachments
that describe, for example, the manner in which its patient data information is
transmitted, the location of its surveillance and security systems and the process by
which it intends to transport its products.” Id., ¶16. Wenzl identified Sections 10, 11,
12, 15, 16 and 20 and Attachments C and D as containing such information.


               The Wenzl Affidavit contains sufficient detail about some of Terrapin’s
redactions on security grounds. In concluding otherwise, OOR erred.


               OOR deemed the Wenzl Affidavit conclusory based on “[t]he breadth
of Terrapin’s argument […] as it advocates for the redaction of entire sections
without describing the specific information contained therein.” Final Determination
at 26. We disagree with OOR that a party’s legal argument may render its evidence
conclusory. Argument and evidence are distinct for purposes of assessing whether
an entity satisfied its burden of proof.15 Just as a position statement does not prove
an exception, a position statement does not render evidence incompetent. The Wenzl
Affidavit stands on its own merit.

       15
           An “unsworn position statement does not constitute evidence. Position statements are
akin to briefs … which, while part of the record, are distinguishable from the evidentiary record.”
Pa. Game Comm’n v. Fennell, 149 A.3d 101, 104 (Pa. Cmwlth. 2016) (italics in original) (quoting
Office of the Governor v. Davis, 122 A.3d 1185, 1193–94 (Pa. Cmwlth. 2015) (en banc)).

                                                20
             However, Terrapin’s redaction of entire sections does not comport with
the narrow construction of RTKL exceptions and the minimal redaction mandate.
Thus, only the locations of security and surveillance measures and the description of
the processes for transmitting patient data and transporting products contained in
Sections 10, 11, 12, 15, 16 and 20 and Attachments C and D may be redacted.


             In addition to describing protected content, Wenzl attested to the danger
posed by disclosure of Terrapin’s security measures. From his knowledge and
industry experience, he recognized “credible threats from unauthorized personnel
intent on committing crimes or other unethical actions.” Wenzl Affidavit, ¶20.
Noting the threats of diversion, theft and black-market activity within the medical
marijuana industry, Wenzl advised “disclosure of … security and surveillance measures
… would increase the danger of (i) security breaches; (ii) substantial injury to its staff
and customers and (iii) diversion of its medical marijuana products.” Id., ¶21.


             Based on this evidence, Terrapin proved the security-related content of
certain redactions and the danger posed by their disclosure. Thus, we allow limited
redaction of the above-described information under Section 708(b)(3) of the RTKL.


             Although it is tempting for this Court to apply this exception to all
Permittees to the same extent it applies to Terrapin, doing so would undermine the
evidentiary requirements of the RTKL. A preponderance of the evidence may be the
lowest burden of proof, but it still requires evidence unless the facts are uncontested
or clear from the face of the RTKL request or the exemption. Therefore, only security
information described in competent evidence may be redacted.



                                           21
             The DOH Logs verified by its open records officer are competent
evidence supporting DOH’s redactions under this exception (mis-cited as Section
708(b)(6)(3)), R.R. at 114a-36a. DOH cited this exception to support its redactions
from the DS applications submitted by Harvest, Mission and KW Ventures.


             As to Harvest’s application, DOH redacted part of page 222 (R.R. at
1379a) described as “Site Plans/Blueprint” contained in Attachment C (relating to
property). R.R. at 114a. As to Mission’s application, it redacted a few words on
pages 48, 58 and 61 (R.R. at 2704a, 2714a, 2717a) described as “Detailed Information
Regarding Storage/Secured Areas” contained in Section 12 (Storage). R.R. at 116a.
As to KW Ventures’ application, DOH redacted a few words on pages 94, 112-13, and
115 described as “Detailed Information Regarding Storage/Secured Areas” from
Section 14 (Inventory Management), R.R. at 122a. DOH also redacted parts and full
pages (correlating to R.R. at 3452a-63a) from Section 12 and a few words on pages 451
and 453-54 (R.R. at 3465a, 3467a-69a) for the same reason. Lastly, DOH redacted a
few words from a letter (R.R. at 3563a) described as “Transport Fleet Details.” Id.


             Based on the surrounding unredacted content of the Applications,
DOH’s description of its redactions suffices to trigger this exception. However,
DOH provided no evidence as to the “reasonable likelihood of endangering safety” as
Section 708(b)(3) of the RTKL requires. 65 P.S. §67.708(b)(3).


             Regardless, as to reasonable likelihood, the record as a whole contains
sufficient evidence regarding the dangers unique to the medical marijuana industry.
We discern no reason for limiting proof of industry-wide risks to Terrapin alone.



                                          22
             The Wenzl Affidavit establishes that disclosure of specified security
information has a reasonable likelihood of endangering physical security of facilities
engaged in the “legal cannabis industry.” Wenzl Affidavit, ¶8. Moreover, the
application form itself recognizes the threat of diversion. See Sections 15 of the DS
application and 16B of the GP application (diversion prevention). Permittees
completed the same application form seeking information about security measures.
Based on the risks inherent in this cash-based industry, disclosure of security
measures and locations of surveillance systems presents a credible threat to physical
security of facilities that amounts to more than mere speculation. Carey.


             Because the record as a whole contains sufficient evidence satisfying the
reasonable likelihood prong, we uphold DOH’s minimal redactions under Section
708(b)(3) of the RTKL from the applications of Harvest, Mission and KW Ventures.


             Also, as to Cresco, Figone attested its “application contains detailed
descriptions of its security protocols and surveillance systems[,] [s]chematic drawings
[that] disclose the location of each of the video surveillance cameras, primary power
hook-ups, facility access points, [and] of the vault and other designated high-security
areas.” R.R. at 63a (Figone Affidavit, ¶12). This sufficiently describes “schematic
drawings” and “detailed descriptions of … surveillance systems” for redaction. Id.
Accordingly, this information may be redacted from Cresco’s application.


             In sum, the record supports certain redactions under Section 708(b)(3).
Thus, we reverse OOR’s Final Determination as to its application of this exception.




                                          23
                               (b). Temporary Regulation
              Only DOH and Terrapin asserted the Temporary Regulation as an
exemption.16 Importantly, DOH did not submit any supporting evidence. Jones. The
DOH Logs do not cite the Temporary Regulation, and the Director Affidavit does
not describe the contents of any of the Applications to support redaction. As such, we
discern no error in OOR allowing limited redaction of Attachment D on this ground.


              (iii). Trade Secret & Confidential Proprietary Exception
              Permittees claim that various parts of the Applications are protected
under Section 708(b)(11) of the RTKL, 65 P.S. §67.708(b)(11). Section 708(b)(11)
protects “a record that constitutes or reveals a trade secret or confidential proprietary
information” from disclosure. 65 P.S. §67.708(b)(11). We analyze the trade secret
and confidential proprietary aspects of this exception separately. Bari.


                                 (a). Trade Secret Status
              Section 102 of the RTKL defines “trade secret” in pertinent part as:

              Information including a formula, drawing, pattern, compilation,
              including a customer list, program, device, method, technique or
              process that:

              (1) derives economic value, actual or potential, from not being
              generally known to and not being readily ascertainable by proper
              means by other persons who can obtain economic value from its
              disclosure or use; [and]

              (2) is the subject of efforts that are reasonable under the
              circumstances to maintain its secrecy.


       16
         As we allow Terrapin’s redaction of sufficiently described physical security information
under Section 708(b)(3) of the RTKL, analysis under the Temporary Regulation is unnecessary.

                                               24
65 P.S. §67.102. See also Uniform Trade Secrets Act, 12 Pa. C.S. §5302 (same).


             A fact-finder considers six factors to determine trade secret status under
the RTKL: (1) the extent to which the information is known outside of the business;
(2) the extent to which the information is known by employees and others in the
business; (3) the extent of measures taken to guard the secrecy of the information;
(4) the value of the information to the business and to competitors; (5) the amount
of effort or money expended in developing the information; and (6) the ease or
difficulty with which the information could be properly acquired or duplicated by
others. Smith v. Dep’t Envtl. Prot., 161 A.3d 1049 (Pa. Cmwlth. 2017).


             The most important indicia for determining whether information
constitutes a trade secret are “substantial secrecy and competitive value to the owner.”
W. Chester Univ. of Pa. v. Schackner (Bravo), 124 A.3d 382 (Pa. Cmwlth. 2015).
Trade secret status is a fact-specific inquiry, and must be decided “on a case-by-case
basis.” O.D. Anderson, Inc. v. Cricks, 815 A.2d 1063, 1071 (Pa. Super. 2003).


             Permittees had the opportunity to submit additional evidence to OOR
after receiving Requester’s brief outlining the deficiencies in the evidence DOH
submitted. Because the evidence Permittees submitted varies considerably as far as
competence and quality, we review the evidence of each Permittee separately.


             As to trade secrets, Terrapin submitted the Peak Affidavit and the Frick
Affidavit. These affidavits offer a model for establishing the trade secrets exception.




                                          25
             Peak attested to his considerable experience in marijuana cultivation
throughout the life cycle of the plants. He devoted years to developing the nutrient
regimen, fertilization for growing and enhancing the growth process. See Peak
Affidavit, ¶¶5-7. He attested to the competitiveness of the medical marijuana
industry, and the interest in producing a high-quality product. Id., ¶¶9, 15. His
descriptions of Terrapin’s growing and processing methods, nutrient and additive
practices, and harvest processes establish that information constitutes trade secrets.


             Frick attested to his experience in extraction processes and the
manufacturing of cannabis products. He explained this specialized technique was
developed after investing significant time and resources. Accordingly, the Frick
Affidavit establishes the trade secret status in the extraction and oil manufacturing
processes of cannabis products. Frick Affidavit, ¶¶5, 6, 16-18.


             Regarding the competitive nature of the industry and the trade secret
status of the growing, cultivation, nutrition, additive, extraction and harvest
processes and practices, we deem the Peak Affidavit and Frick Affidavit sufficient
evidence of the first prong of the trade secret exception, applicable as to all
Permittees. See, e.g., Dep’t of Pub. Welfare v. Eiseman, 85 A.3d 1117 (Pa. Cmwlth.
2014) (en banc), rev’d on other grounds, 125 A.3d 19 (Pa. 2015) (recognizing
testimony by expert in the field may support multiple managed care organizations’
claims of trade secret status in negotiated rates). Accordingly, these processes are
trade secrets that may qualify for protection if Permittees meet the second criterion,
i.e., undertaking reasonable steps to maintain secrecy of the described secrets.




                                          26
             As OOR concluded, Terrapin established its reasonable efforts to
maintain secrecy of trade secrets. See Peak Affidavit, ¶¶21-23; Frick Affidavit ¶¶20-
23. None of the other Permittees submitted evidence of the second prong.


             Other than Terrapin, among Permittees only Cresco submitted
evidence. Although Figone confirmed the competitiveness of the industry, he did
not attest to any steps Cresco undertook to protect secrecy as required to prove this
second prong. We also defer to OOR’s determination that Figone lacked credibility
because he deemed Cresco’s entire application a trade secret. Figone Affidavit, ¶¶5-
7.


             Because they did not substantiate any steps taken to maintain secrecy,
the trade secret claims of Cresco, Harvest, Mission and KW Ventures fail. We also
affirm OOR’s application of the trade secrets exception to Terrapin.


                     (b). Confidential Proprietary Information
             Only “[c]ommercial or financial information received by an agency:
(1) which is privileged or confidential; and (2) the disclosure of which would cause
substantial harm to the competitive position of the person that submitted the
information” is protected by the confidential proprietary exception. Section 102 of
the RTKL, 65 P.S. §67.102. The measures undertaken to maintain secrecy of the
information are important indicators of its confidential nature. Smith.




                                         27
                 Because none of the Permittees other than Terrapin submitted evidence
regarding steps for maintaining secrecy, they fail to prove confidential nature. As
such, we consider only whether OOR erred in applying this exception to Terrapin.17


                 Terrapin redacted hundreds of pages under this exception. For example,
Terrapin redacted all of Attachment B (Organizational Documents), 689 consecutive
pages, as “confidential proprietary information.”18 R.R. at 1785a-2474a. In support,
Terrapin submitted the Coleman Affidavit. R.R. at 3651a-56a.


                 Coleman advised Sections 3 (Diversity Plan), 10 (Security), 24 (Business
History), 27 (Capital Requirements) and 28 (Community Impact) of Terrapin’s
application contained confidential financial information. However, he did not describe
their content sufficiently so as to permit total redaction. Also, Coleman described
efforts to maintain confidentiality of “any and all financial information.” Coleman
Affidavit, ¶16. But the Coleman Affidavit is flawed in that it assumes all financial
information is confidential rather than alleging facts to establish its confidentiality.


                 The fact that the medical marijuana industry is extremely competitive
does not substantiate Terrapin’s extensive redaction here. In removing all indicators
of subject matter, there is no context for evaluating the redacted content. See R.R.



       17
          In its brief, Terrapin also argues OOR erred in not analyzing whether its financial
information qualifies as a “financial record” under Section 102 of the RTKL. Terrapin Br. at 23-27.
It was unnecessary for OOR to analyze the definition because it did not conclude Terrapin’s financial
information was public as a matter of law. Rather, OOR concluded Terrapin did not establish an
exception protecting its financial information because it did not submit sufficient evidence.
       18
            Terrapin also cited Section 708(b)(6) of the RTKL, but it did not explain its application.


                                                   28
at 1483a-2642a. Because Terrapin did not prove confidential nature or describe the
content of its redactions, we uphold OOR’s application of this exception.


                                     C. Bad Faith
             Lastly, we consider Requester’s bad faith charge. Requester argues that
DOH’s failure to review unredacted Applications to assess the appropriateness of
Permittees’ redactions during the request or appeals officer stage constitutes bad faith.


             Procedurally, we are not in a position to decide whether DOH
committed bad faith when it did not comply with the RTKL during the request stage,
or with OOR’s directive to evaluate unredacted Applications in the appeals officer
stage. See September Opinion. Although Requester refers to OOR’s findings
regarding DOH’s noncompliance with its statutory duties, the statute is clear that
only a court may make a finding regarding an agency’s bad faith. See Sections 1304
and 1305 of the RTKL, 65 P.S. §§67.1304-67.1305; Uniontown Newspapers, Inc. v.
Dep’t of Corr., 197 A.3d 825 (Pa. Cmwlth. 2018) (single j. op.).


             Whether an agency committed bad faith is not determined as a matter
of law; rather, it depends in part on the degree of noncompliance. Uniontown
Newspapers, Inc. v. Dep’t of Corr., 151 A.3d 1196 (Pa. Cmwlth. 2016) (declining
to grant summary relief as to bad faith). Requester has not enlisted this Court’s fact-
finding under Chapter 13 of the RTKL here.


             Notwithstanding DOH’s noncompliance with the RTKL, we note this
case is distinguishable from Uniontown Newspapers in that DOH did not mis-



                                           29
identify responsive records. Throughout, DOH was clear that the Applications were
at issue and that DOH relied on Permittees’ redactions without assessing them.
Whether DOH’s approach amounted to bad faith would entail judicial fact-finding.


                                   III. Conclusion
             OOR afforded extraordinary due process to DOH and Permittees,
including multiple opportunities to submit evidence supporting their redactions.
DOH and Mission offer no reason for not submitting the evidence they want to
submit to this Court during that process. Therefore, we deny their applications for
relief seeking to supplement the record.


             Based on the existing record, we reverse OOR’s Final Determination
as to the sufficiency of the evidence submitted to protect certain security information
pursuant to Section 708(b)(3) of the RTKL. The record as a whole demonstrated the
reasonable likelihood aspect of the building and physical security exception as
applied to medical marijuana facilities such that Terrapin and Cresco may support
minimal redaction of the security measures detailed in their affidavits. We also
uphold DOH’s minimal redaction of the DS applications submitted by Mission,
Harvest and KW Ventures as set forth in the DOH Logs.


             We affirm the Final Determination in all other material respects.




                                        ROBERT SIMPSON, Judge




                                           30
       IN THE COMMONWEALTH COURT OF PENNSYLVANIA


Mission Pennsylvania, LLC,            :
                        Petitioner    :
                                      :
            v.                        :   No. 185 C.D. 2018
                                      :
Wallace McKelvey and PennLive         :
and The Patriot-News,                 :
                      Respondents     :

Terrapin Investment Fund 1, LLC,      :
                        Petitioner    :
                                      :
            v.                        :   No. 186 C.D. 2018
                                      :
Wallace McKelvey and PennLive         :
and The Patriot-News, and The         :
Pennsylvania Department of Health,    :
                        Respondents   :

SMPD Manufacturing, LLC               :
and SMPB Retail, LLC,                 :
                      Petitioners     :
                                      :
            v.                        :   No. 187 C.D. 2018
                                      :
Wallace McKelvey, PennLive            :
and The Patriot-News,                 :
                      Respondents     :

Cresco Yeltrah, LLC,                  :
                        Petitioner    :
                                      :
            v.                        :   No. 188 C.D. 2018
                                      :
Wallace McKelvey, PennLive            :
and the Patriot-News,                 :
                      Respondents     :
  Pennsylvania Department                          :
  of Health,                                       :
                         Petitioner                :
                                                   :
                   v.                              :   No 189 C.D. 2018
                                                   :
  Wallace McKelvey and PennLive,                   :
                        Respondents                :

  KW Ventures Holdings, LLC,                       :
                         Petitioner                :
                                                   :
                   v.                              :   No. 190 C.D. 2018
                                                   :   Argued: February 1, 2019
  Wallace McKelvey and Pennlive                    :
  and the Patriot-News,                            :
                        Respondents                :


                                             ORDER

                   AND NOW, this 4th day of June, 2019, the Final Determination of the
  Office of Open Records is REVERSED IN PART, as to the application of Section
  708(b)(3) of the Right-to-Know Law,1 65 P.S. §67.708(b)(3), in accordance with the
  foregoing opinion, and is AFFIRMED IN PART as to the remaining exemptions.


                   The applications for relief seeking to supplement the record on appeal
  filed by the Department of Health and by Mission Pennsylvania, LLC, are DENIED.




                                                ROBERT SIMPSON, Judge




_____________________________
     1
         Act of February 14, 2008, P.L. 6, 65 P.S. §§67.101-67.3104
