MCKELVEY v. PENNSYLVANIA DEPT. OF HEALTH

OPINION

JUSTICE TODD.

In this appeal by allowance, we consider the contours of the Pennsylvania Right-to-Know Law ("RTKL")1 with respect to the disclosure of information contained in applications to grow, process, or dispense medical marijuana pursuant to the Pennsylvania Medical Marijuana Act ("Medical Marijuana Act").2 For the reasons that follow, we affirm in part, vacate in part, and remand for further proceedings.

I. Facts

As described more fully below, the General Assembly enacted the Medical Marijuana Act to establish a framework for the legalization of medical marijuana in the Commonwealth. Appellant, the Department of Health ("Department"), is the agency responsible for administering the statute, and it promulgated temporary regulations to aid in this endeavor.3 28 Pa. Code §§ 1131.1 et seq. Relevantly, beginning in 2017, the Department established a general application process for businesses seeking to operate as medical marijuana organizations, with additional criteria specific to those acting as either a grower/processor ("GP") or a dispensary ("DS"). The applications for this inaugural issuance of permits required extensive information pertaining to various facets of the applicant's intended business, including, inter alia, financial and operational capabilities; community impact plans; site and facility plans; the verification of an applicant's principals, operators, financial backers, and employees; a description of the business activities in which the applicant intended to engage; and a statement that the applicant was able to maintain effective security and prevent diversion or other illegal conduct related to their medical marijuana business. 35 P.S. § 10231.602(a). This information was used to evaluate the relative capabilities of competing applicants for the award of DS and GP permits. The Department received dozens of permit applications composed of thousands of pages. In June 2017, it awarded 12 GP permits and 27 DS permits, including a GP permit to Appellant Terrapin Investment Fund 1, LLC ("Terrapin"); and a DS permit to Appellants SMPB Retail, LLC and SMPD Manufacturing, LLC (collectively, "Harvest").

Prior thereto, in May 2017, PennLive reporter Wallace McKelvey, PennLive, and the Patriot-News (collectively, "Appellees") requested disclosure of all of the medical marijuana business permit applications pursuant to the RTKL. The Medical Marijuana Act, as well as the Department's temporary regulations, explicitly provide that permit applications are public records subject to disclosure under the RTKL. See 35 P.S. § 10231.302(b); 28 Pa. Code § 1141.22. Additionally, in the application instructions, the Department advised all applicants to submit redacted and unredacted copies of their applications, stating that the redacted versions of the applications would be posted on the Department's website. As discussed below, the RTKL places a duty to disclose records sought by a requester on the governmental agency, here the Department, unless the records are exempt, privileged, or fall into an exemption under the statute. 65 P.S. §§ 67.706, 708(b).4 Furthermore, the Department's regulations provided that information that falls within an exemption to the RTKL, or is "considered to be confidential proprietary information by other law," or is "[i]nformation regarding the physical features of, and security measures installed in, a [medical marijuana] facility" is not subject to disclosure except by court order. 28 Pa. Code § 1141.22(b)(8), (9).

On July 10, 2017, the Department denied Appellees' RTKL request, in part, referring Appellees to the redacted copies of the GP applications which had been posted on its website, and denied access to the DS applications, which had not yet been posted. As described more fully below, the Department, inter alia, did not independently review the applicants' redactions, but accepted all applicants' redactions that they deemed confidential or proprietary, or otherwise subject to redaction under the RTKL. This resulted in a disparity in redactions across the various applications.

II. Procedural History

A. Office of Open Records

On July 26, 2017, Appellees appealed to the Office of Open Records ("OOR"),5 limiting their appeal to records regarding the Department's partial denial of two successful GP applications — Cresco Yeltrah, LLC ("Cresco") and Appellant Terrapin — and four successful DS applications — Cresco, KW Ventures Holding, LLC ("KW Ventures"), Mission Pennsylvania II, LLC ("Mission"), and Appellant Harvest. For ease of identification, these six permit awardees that are the subject of Appellees' RTKL request will be referred to as "Applicants."

Appellees asserted that the Department lacked a legal basis for its redactions, particularly given the disparity in redactions among applications. Appellees also maintained that the OOR should conduct an in camera review of the records, require the Department to submit a privilege log identifying the reasons why the redacted material was exempt from disclosure, and conduct a hearing so that they could confront any evidence offered by the Department or third-party participants. The OOR invited parties to supplement the record and directed the Department to notify any third parties of their ability to participate in the appeal, 65 P.S. § 67.1101(c), but declined Appellees' request for in camera review.

For its part, the Department notified the Applicants of their right to participate in the proceedings, and all asked to do so. Additionally, the Department submitted a position statement, with a supporting affidavit of Director of the Office of Medical Marijuana John Collins, which described the redactions and the Department's redaction process. Collins explained that the Department redacted only information that the Applicants had marked in their applications as confidential proprietary information; as personal and financial information; or as information related to building and infrastructure security. Collins noted, however, that the Department did not make its own assessment; rather, it relied upon the redacted versions of Applicants' applications due to the sheer volume of records sought in Appellees' request. He also offered that the Department added redactions if necessary, and posted the redacted applications on its public website. As a result, there was disparity in the degree to which individual applications were redacted, with entire sections of applications redacted in some instances, and not in others.

Due to the Department's limited review of the applications, including the fact that the Department did not review the applications in unredacted form prior to asserting its exemptions, and concluding that the Department did not conduct a good faith effort to determine if the redacted information was subject to public access, on September 11, 2017, the OOR stayed the matter until November 20, 2017 (as requested by the Department), in order to allow the Department to evaluate the propriety of Applicants' redactions, assert any applicable exemptions, and submit supporting evidence. On November 9, 2017, the Department provided a revised response explaining that it removed redactions it deemed to be improper, whether made by the Applicants or the Department, but retained redactions of information that Applicants had characterized as trade secrets, confidential proprietary information, or security information, claiming that it was unable to stand in the shoes of an applicant when assessing these exemptions. The Department also provided legal argument regarding the redactions it made, as well an exemption log as to each application,6 but did not submit affidavits describing the information redacted or the risks of disclosure, and suggested that the OOR determine the merits of the redactions by holding a hearing or by conducting in camera review; the OOR declined to do so.

The OOR granted Applicants' request to participate and provided them until December 13, 2017 to submit additional evidence beyond what the Department or Applicants had already submitted. Terrapin timely submitted additional evidence in support of its exemptions, including another brief and four affidavits regarding, inter alia, the confidential nature of its financial information; its infrastructure and physical security; and the maintenance of its trade secrets. Harvest did not initially make additional submissions, but later attempted to submit additional argument and more detailed exemption logs; however, the OOR did not consider the additional submission, finding it to be untimely and unsworn.

In its Final Determination dated January 11, 2018, after noting the "multiple opportunities to submit evidence," OOR Final Determination at 13, the OOR determined that because Mission, KW Ventures, and Harvest did not submit "competent evidence," their submissions did not prove the applicability of any claimed exemptions, id. at 14. As Terrapin and Cresco did submit affidavits in support of their exemptions, the OOR proceeded to the merits of Applicants' arguments. As to Cresco's claim that it performed a public safety or public protection activity, the OOR, after finding a lack of support for Cresco's position and noting its conclusory affidavits, found that Cresco failed to establish that "the operation of a medical marijuana growing and processing facility constitutes a public safety or public protection activity," and, thus, did not fall within the RTKL's exemption for records maintained in connection with law enforcement or public safety activities. Id. at 17 (citing 65 P.S. § 67.708(b)(2)). The OOR also found that Cresco did not meet its burden of establishing that its application information (the entire application) was exempt from disclosure as endangering the safety or physical security of Cresco's facility, as a trade secret, or as confidential proprietary information, again noting the conclusory nature of Cresco's affidavits and its mere referencing of general categories of information without explaining how these categories would be exempt from disclosure. Id. at 21-22.

As to Terrapin's assertion that the disclosure of details regarding security and surveillance features of Terrapin's facility would endanger the safety or physical security of that facility, and its redactions of certain application sections in toto, the OOR stressed that Terrapin did not point to any "specific" security-sensitive information that should be redacted, and while noting that the application "could conceivably contain security-sensitive information," Terrapin's affidavit had not provided "enough evidence" for the OOR to make this determination. Id. at 25-27 (citing 65 P.S. § 67.708(b)(3) (excepting from disclosure critical systems endangering the safety or physical security of the building)). The OOR went on to note that, in any event, the entirety of the application section could not be withheld merely because it contained some exempt information. As the Department and Terrapin, according to the OOR, did not provide a detailed analysis of these sections to determine which portions would threaten infrastructure security, the OOR found Terrapin failed to meet its burden of proving the redacted information was subject to exemption.

Turning to Terrapin's assertion that certain information contained trade secrets and confidential proprietary information, 65 P.S. § 67.708(b)(11), and its affidavits addressing its formulas, methods, growing processes, and techniques, the OOR found that Terrapin had established the economic value of the material sought to be exempt from disclosure as well as the confidential nature of the information, including steps taken to preserve the confidentiality, and, thus, met its burden in proving the information contained trade secrets. However, the OOR found Terrapin did not explain why the description of the type of medical marijuana products that would be produced was a trade secret. OOR Final Determination at 30-31.

Finally, the OOR addressed Terrapin's claim that the entirety of its financial information constituted a trade secret or confidential proprietary information. While noting that Terrapin treated this information as confidential, the OOR rejected Terrapin's assertions for its perceived failure to demonstrate that the disclosure of such material would cause substantial harm to Terrapin's competitive position, how competitors could use the information for their economic enrichment, as well as for failing to provide specific evidence in support of its redactions. Id. at 33.

As to the Department's exemptions, regarding the physical features of a facility, and the security measures installed therein, the OOR found the Department's affidavit and exemption logs submitted in support thereof to be conclusory in nature, and in tension with the exemptions sought by Applicants, noting that it "is unclear how one applicant's response can necessitate the entire redaction of a Section under the regulation, while another's only implicates a few words being redacted." Id. at 49. As such, the OOR concluded that neither the Department nor Applicants met their burden regarding these exemptions.

Ultimately, after considering the evidence submitted — which the OOR found deficient in many respects — the OOR granted Appellees access to most of the information contained in the applications, but allowed exemptions as to Terrapin's trade secrets, and, on constitutional grounds, upheld the redaction of certain of Applicants' personal information, including, dates of birth, drivers license and passport photographs, personal identification numbers, banking account numbers, organ donor status, telephone numbers, email addresses, and residential street addresses.7

B. Commonwealth Court

The Department and Applicants filed petitions for review with the Commonwealth Court, asserting various claims of error with respect to, inter alia, the OOR's application of the exemptions under the RTKL to their respective applications.8 Additionally, the Department requested that the Commonwealth Court allow it to supplement the record to assert and support its own exemptions. The Commonwealth Court consolidated the matters. While the Department and Applicants appealed the OOR decision to the Commonwealth Court, only the Department, Terrapin, and Harvest were granted review in our Court. Thus, the discussion of the Commonwealth Court's decision will focus primarily on the issues involving these parties.

A unanimous, en banc, Commonwealth Court, reversed in part, affirmed in part, and remanded to the OOR. Mission Pennsylvania, LLC v. McKelvey, 212 A.3d 119 (Pa. Cmwlth. 2019). Preliminarily, the court considered, and ultimately rejected, requests to supplement the record filed by the Department and Mission, finding that the Department and some Applicants were at fault for any alleged inadequacy in the record because they had ample opportunity to submit evidence to the OOR, yet failed to do so sufficiently. Specifically, the court emphasized that, by issuing a stay in this matter, the OOR had given the Department additional time and opportunity to raise any applicable exemptions or to remedy any deficiencies in its review process, but the Department did not do so, instead responding with a submission that was substantially similar to its prior submission. The court further cautioned that allowing the submission of additional evidence at the judicial review stage would undermine the presumption of openness attendant to the RTKL, as doing so would permit agencies to withhold records, without legal ground to do so, until reaching a court. Accordingly, in light of the foregoing considerations, the court denied the requests to supplement the record.

1. Department Deference to Applicants' Redactions

Turning to the merits of the Department's and Applicants' claims, the Commonwealth Court first emphasized that the Medical Marijuana Act expressly provides that permit applications are public records subject to the RTKL; thus, the court stressed that, upon receipt of a request for information, the governmental agency is obliged to assess the public status of the requested records, and disclose such records, unless exempt. The court explained that the burden is on the governmental agency to specify the reasons for denying access to the records, and prove any asserted exemptions, and that the agency, or a third party, must prove a RTKL exemption by a preponderance of the evidence. 65 P.S. § 67.708(a)(1). According to the Commonwealth Court, an agency may not delegate its disclosure duty or burden of proof to a third party, or voluntarily rely on a third party's redactions, even if such third party is best suited to provide the most detailed proof. Thus, the court rejected the Department's contention that it was permissible to rely on Applicants' redactions, and noted that, as a result of the Department's deference, Applicants' level of redaction varied widely.

As an additional preliminary matter, the court underscored that only three parties offered evidence to establish their respective exemptions. The Department provided the affidavit of Program Director John Collins; Cresco submitted an affidavit authored by General Counsel John Figone ("Figone Affidavit"), and Terrapin provided multiple affidavits. Harvest, KW Ventures, and Mission did not submit evidence. Thus, with respect to these applicants, the court found the redactions were unsubstantiated, except to the extent the evidence applied to all applicants.

2. Facility Security Exemption

The Commonwealth Court proceeded to examine the OOR's review of the RTKL exemptions.9 The court first considered the physical features and facility security exemption. See 65 P.S. § 67.708(b)(3) (allowing exemption from disclosure of information to protect physical security including location or configuration of critical systems and security measures of permitted facilities). The Commonwealth Court explained that, to invoke this exemption, the proponent must show that the disclosure of the records, rather than the records themselves, would create a reasonable likelihood of endangerment to the safety or physical security of certain structures. Mission Pennsylvania, 212 A.3d at 133-34 (citation omitted). The court concluded that the OOR erred in finding that no applicant had met its evidentiary burden to prove the exemption. The court highlighted that Terrapin had submitted an affidavit from its Director of Information Technology, James Wenzl (the "Wenzl Affidavit"), which explained that Terrapin had redacted information in its application related to its surveillance and physical security systems in order to protect against unauthorized entry into the facility, or the theft or loss of marijuana seeds, plants, and products; and to protect the security and safety of information describing the manner in which its patient data information is transmitted, the location of its surveillance systems, and the process by which it intends to transport its products. The court further noted that the affidavit detailed the danger posed by disclosure of Terrapin's security measures, including credible threats of diversion, theft, and black-market activity within the medical marijuana industry. Based on the foregoing, the court opined that the Wenzl Affidavit provided sufficient detail about Terrapin's facility security to warrant redactions to not only Terrapin's application, but to the other applicants' applications as well, as the security threats detailed in the Wenzl Affidavit were industry-wide. Thus, the court reversed the OOR's final determination regarding its application of the facility security exemption. The court, however, also determined that Terrapin's sweeping redaction of entire sections of its application was improper, and concluded that Terrapin was entitled to redact "only the locations of security and surveillance measures and the description of the processes for transmitting patient data and transporting products." Mission Pennsylvania, 212 A.3d at 134 (emphasis original) (stressing the limited redactions to be allowed).

Further, while the court found it "tempting" "to apply this exemption to all [applicants] to the same extent it applies to Terrapin, it explained that doing so would undermine the evidentiary requirements of the RTKL," as an exemption requires evidence unless the facts are uncontested or clear from the face of the RTKL request or the exemption asserted. Id. at 135. Thus, the court found only security information set forth in "competent evidence" could be redacted. Id. The Commonwealth Court concluded the Department's logs, verified by its open records officer, were such competent evidence, and supported its redactions in applications submitted by Mission, KW Ventures, and Harvest. While the Commonwealth Court determined that the Department's description of its redactions satisfied its burden regarding this exemption, the court also pointed out that the Department offered no evidence as to the "reasonable likelihood of endangering the safety" as Section 708(b)(3) of the RTKL requires. See 65 P.S. § 67.708(b)(3). The court continued, however, noting that, as to this "reasonable likelihood" requirement, the record as a whole contained sufficient evidence regarding the dangers unique to the medical marijuana industry to extend Terrapin's proof of industry-wide risks beyond Terrapin's submissions to the other applicants.

Specifically, the court explained, inter alia, that Terrapin's Wenzl Affidavit established that disclosure of specified security information has a reasonable likelihood of endangering the security of facilities engaged in the "legal cannabis industry." Mission Pennsylvania, 212 A.3d at 135 (citing Wenzl Affidavit at ¶ 8). Based on the risks inherent in this cash-based industry, the court determined that disclosure of security measures and locations of surveillance systems presented a credible threat to the security of facilities that amounts to more than mere speculation. As the record taken as a whole contained adequate evidence satisfying the reasonable likelihood requirement, the Commonwealth Court upheld the Department's minimal redactions under Section 708(b)(3) of the RTKL from the applications of Mission, KW Ventures, and Harvest. Moreover, as to Cresco, the court noted that Figone attested that its "application contains detailed descriptions of its security protocols and surveillance systems[,] [s]chematic drawings [that] disclose the location of each of the video surveillance cameras, primary power hook-ups, facility access points, [and] of the vault and other designated highsecurity areas." Id. at 135-36 (emphasis original) (citing Figone Affidavit at ¶ 12). This, according to the court, sufficiently described "schematic drawings" and "detailed descriptions of ... surveillance systems" justifying redaction. Id. at 136. As a result, the court concluded that this information was an allowable redaction from Cresco's application. Thus, the Commonwealth Court reversed the OOR's determination, that no applicant established an exemption under the facility security exemption, and allowed certain redactions pursuant thereto.

3. Trade Secret and Confidential Proprietary Information Exemption

Next, the Commonwealth Court considered the OOR's application of the trade secret and confidential proprietary information exemptions. 65 P.S. § 67.708(b)(11). The court determined that the OOR properly applied the trade secret exemption only to Terrapin, and correctly found the confidential proprietary information exemption inapplicable to Applicants. Noting that Applicants each provided varying degrees of evidence in support of their redactions on these grounds, the court separately reviewed the evidence as to each applicant when considering whether they satisfied the exemptions.

With respect to the trade secret exemption, id. § 67.102 (defining "Trade secret"), the court explained that, in order to support the redactions on this ground, Applicants were required to establish that (1) the information they sought to protect derived economic and competitive value from not being generally known to the public; and (2) was subject to reasonable efforts to maintain the information's secrecy. Mission Pennsylvania, 212 A.3d at 136. In conducting this inquiry, the court ultimately complimented Terrapin's evidence as the "model" for establishing the exemption. Id. at 137. Specifically, the court noted that Terrapin provided affidavits from its Director of Cultivation, Ian Peak, regarding its growing and harvesting processes, and an affidavit from its Director of Infused Product Manufacturing, Jef Frick, which detailed its extraction and production processes. The court determined that these affidavits sufficiently established that the processes described therein were trade secrets, and, thus, that similar processes described by Applicants in their respective applications were likewise trade secrets. Thus, the court found the affidavits submitted by Terrapin satisfied the first prong of the trade secret exemption for all applicants. Nevertheless, the court concluded that only Terrapin could avail itself of the exemption because it was the only party that submitted evidence of its reasonable efforts to maintain the secrecy of its processes, a necessary second component in establishing trade secret status. Accordingly, the court affirmed the OOR's application of the trade secrets exemption only to Terrapin.

Finally, as to Applicants' alleged confidential proprietary information, 65 P.S. § 67.708(b)(11), the court concluded that none of the Applicants established the exemption. Noting that such information must be privileged or confidential, and that disclosure would cause substantial harm to the parties' competitive position, id. § 67.102 (defining "Confidential proprietary information"), the court emphasized that "[t]he measures undertaken to maintain secrecy of the information are important indicators of its confidential nature." Mission Pennsylvania, 212 A.3d at 137. As none of the Applicants other than Terrapin submitted evidence regarding the steps they took to maintain secrecy, the court determined that they failed to establish the confidential nature of the information. Thus, it only considered the application of the exemption to Terrapin. Id. at 138.

The court pointed out that Terrapin redacted a significant number of pages of information, including all organizational documents, a diversity plan, security information, business history, capital requirements, and community impact. Id. While Terrapin had submitted an affidavit from its Director of Government Affairs, Shawn Coleman ("Coleman Affidavit") as to the confidential nature of its financial information, the court found the Coleman Affidavit to be flawed because it failed to describe the information's contents sufficiently to allow for total redaction. Moreover, the court determined that the Coleman Affidavit described Terrapin's efforts to maintain the confidentiality of "any and all financial information" generally, without alleging any facts to sufficiently establish the confidentiality of the information or describing any of the subject matter Terrapin sought to protect. Id. The Commonwealth Court reasoned that, "[i]n removing all indicators of subject matter, there is no context for evaluating the redacted content;" thus, it concluded that Terrapin did not establish that the redactions were warranted under this exemption. Id.10

In sum, the Commonwealth Court reversed the OOR's Final Determination regarding the sufficiency of the evidence submitted regarding certain security information, as the record evidence, taken as a whole, supported the facilities' security exemption for all applicants, upheld the Department's minimal redaction of the applications submitted by Mission, KW Ventures, and Harvest, as set forth in the Department's logs, and upheld the OOR's determination in all other respects.

C. Appeal to this Court

We granted allocatur, limited to three aspects of the RTKL with respect to applications filed pursuant to the Medical Marijuana Act. First, we granted allocatur on an issue raised by the Department as to whether the RTKL, and the Commonwealth Court's approach thereunder, failed to create a workable standard for dealing with "iterative redactions"11 in the absence of statutory guidance.12 We also granted consideration of the question raised by Harvest as to whether similarly-situated applicants should be treated similarly, even without an individual applicant providing an independent submission of evidence, or be provided an opportunity to supplement the record. Finally, we granted Terrapin's request to review whether it provided substantial evidence of competitive harm and security-related issues associated with disclosure of financial information in this uniquely cash-based business, which, according to Terrapin, constituted confidential proprietary information. We will address these issues seriatim.13

III. Analysis

A. Governing Law

As each of the issues on which we granted allocatur requires interpretation of the RTKL and the Medical Marijuana Act, our analysis is governed by the Statutory Construction Act of 1972 ("Statutory Construction Act"). 1 Pa.C.S. §§ 1501-1991. Unlike its federal counterpart, our General Assembly has expressly provided direction regarding how the judiciary is to discern its statutory intent. Pursuant to the Statutory Construction Act, the overriding object of all statutory interpretation "is to ascertain and effectuate the intention of the General Assembly" in enacting the statute under review. Id. § 1921(a). If statutory language is "clear and free from all ambiguity, the letter of it is not to be disregarded under the pretext of pursuing its spirit." Id. § 1921(b). Thus, when the words of a statute have a plain and unambiguous meaning, it is this meaning which is the paramount indicator of legislative intent. However, in situations where the words of a statute "are not explicit," the legislature's intent may be determined by considering any of the factors enumerated in Section 1921(c). DEP v. Cumberland Coal, 628 Pa. 17, 102 A.3d 962, 975 (2014).

In addition to the guideposts set by the Statutory Construction Act, an understanding of the Medical Marijuana Act and the RTKL is essential to resolving all three issues before us. Thus, we turn to an overview of these statutes.

As noted above, in 2016, the General Assembly enacted the Medical Marijuana Act. While marijuana remains illegal at the federal level, the legislature made certain uses or possession of medical marijuana, as set forth in the statute, lawful within the Commonwealth. 35 P.S. §§ 10231.303, 10231.304. Through the Medical Marijuana Act, the General Assembly sought to create a "[p]rogram of access to medical marijuana which balances the need of patients to have access to the latest treatments" to mitigate suffering with the need to promote patient safety, provide a safe and effective delivery system, and to promote research into the effectiveness and utility of medical marijuana. Id. § 10231.102(3)(i). In furtherance of these goals, the legislature established a framework for the growing, processing, and dispensing of medical marijuana in Pennsylvania. Specifically, the Medical Marijuana Act tasks the Department with the implementation and administration of the Act. See id. § 10231.301(a). The Department is charged with issuing DS and GP permits, ensuring medical marijuana businesses comply with the Medical Marijuana Act, and registering practitioners; it also has regulatory and enforcement authority over the growing, processing, sale, and use of medical marijuana. Id. § 10231.301(a)(1-3)(i).

The Act provides for a detailed permit application and renewal process for growers, processors, and distributors. See id. § 10231.601-10231.616. The information required in an application for an initial permit is extensive, and includes, inter alia, financial information, a history of prior activities in the medical marijuana industry, and criminal history record checks of principals, financial backers, operators and employees.14

To carry out its responsibilities, including the application process, the Department is authorized to promulgate regulations, id. § 10231.310(b), including the promulgation of temporary regulations, id. § 10231.1107. Under this authority, the Department promulgated temporary regulations and established an application process for businesses seeking permission to operate as a medical marijuana organization. See 28 Pa. Code §§ 1131.1-1191.33. As noted above, the temporary regulations regarding the initial application process have expired. See supra note 3.

Importantly for purposes of this appeal, with respect to documents filed under the Medical Marijuana Act, including applications, Section 302(b) provides that "[a]pplications for permits submitted by medical marijuana organizations" are "public records and shall be subject to the [RTKL]." 35 P.S. § 10231.302(b)(1). The Department's temporary regulations likewise provided that applications are "public records... subject to disclosure under the [RTKL]." 28 Pa. Code § 1141.22(a).

The RTKL is remedial legislation to facilitate government transparency and promote accountability. Pennsylvania State Police v. Grove, 640 Pa. 1, 161 A.3d 877, 892 (2017); Bowling v. Office of Open Records, 990 A.2d 813, 824 (Pa. Cmwlth. 2010) aff'd 621 Pa. 133, 75 A.3d 453 (2013). While enacted in 2008, the 2009 iteration of the statute dramatically expanded the public's access to government documents and demonstrated an intent on the part of the General Assembly to expand government transparency. Levy v. Senate of Pennsylvania, 619 Pa. 586, 65 A.3d 361, 381 (2013). The RTKL is "designed to promote access to official government information in order to prohibit secrets, scrutinize the actions of public officials, and make public officials accountable for their actions." Pennsylvania State Education Association v. Commonwealth Department of Community & Economic Development, 637 Pa. 337, 148 A.3d 142, 155 (2016). For this reason, the law must be construed to maximize access to public records that are in an agency's possession. Moreover, because the law is remedial legislation, and encourages the maximization of disclosure, the exemptions from disclosure must be strictly construed. ACLU, 232 A.3d at 656.

As to the disclosure requirements of the RTKL, by its express terms, a "Commonwealth agency shall provide public records in accordance with this act." 65 P.S. § 67.301. A record "in the possession of Commonwealth agency ... shall be presumed to be a public record" unless it is exempt under Section 708, privileged, or exempt from disclosure under other federal or state law or judicial order. Id. §§ 67.305(a), 67.701. At the initial request stage, an agency is required to assess the public status of requested records, and, if applicable, specify reasons for denying access with "citation of supporting legal authority." Id. § 67.903. When parts of a record are public — meaning not exempt by another law, privilege or exemption under Section 708(b), id. § 67.708(b) — an agency "shall grant access to" the public parts of the record pursuant to its disclosure duty. Id. § 67.706. Thus, by its plain and unambiguous language, the RTKL places the statutory duty of disclosure solely on the government agency.

Related thereto, the RTKL places the burden on the governmental agency to discern what parts of a record are subject to access and what parts are properly exempt, and, through redaction, disclose those parts subject to access:

Id.

There are, however, statutory exemptions to the presumption of disclosure. Id. § 67.708. While the RTKL provides for numerous exemptions, three Section 708 exemptions are the focus of the matter sub judice: the facility security exemption, the trade secrets exemption, and the confidential proprietary information exemption.

First, with respect to the facility security exemption, records regarding "building plans or infrastructure records that expose or create vulnerability through disclosure of the location, configuration or security of critical systems, including public utility systems, structural elements, technology, communication, electrical, fire suppression, ventilation, water, wastewater, sewage and gas systems" are exempt from disclosure. Id. § 67.708(b)(3)(iii).15 In applying this exemption, as noted above, the Commonwealth Court explained that, for this exemption to apply, the act of disclosing the records, rather than the records themselves, must create a reasonable likelihood of endangerment to the safety or physical security of certain structures. Mission Pennsylvania, 212 A.3d at 134.

Additionally exempt from disclosure is "[a] record that constitutes or reveals a trade secret or confidential proprietary information." 65 P.S. § 67.708(b)(11). "Trade secret" is defined as:

Id. at § 67.102. Additionally, "Confidential proprietary information" is defined as:

Id.

With respect to discerning and establishing exemptions, the RTKL provides that "[t]he burden of proving that a record of a Commonwealth agency or local agency is exempt from public access shall be on the Commonwealth agency or local agency receiving a request by a preponderance of the evidence." 65 P.S. § 67.708(a)(1). The RTKL does not allow an agency to delegate its disclosure duty or burden of proof to third parties. Furthermore, it is presumed that Commonwealth agencies will act in good faith in discharging their statutory duties under the RTKL. See Office of Governor v. Donahue, 626 Pa. 437, 98 A.3d 1223, 1239 (2014).

Mindful of the presumption of disclosure of agency records, but that such records may include sensitive information submitted by private parties such as trade secrets and confidential proprietary information, Section 707(b) requires the governmental agency to notify third parties of a request for trade secrets or confidential proprietary information, and gives such parties the opportunity to provide input to, and be notified of, the agency's determination. 65 P.S. § 67.707(b). Moreover, decisional law allows third parties to raise and defend exemptions to protect information that they believe is exempt from disclosure. Commonwealth, Department of Education v. Bagwell, 131 A.3d 638 (Pa. Cmwlth. 2016); Office of the Governor v. Bari, 20 A.3d 634 (Pa. Cmwlth. 2011). Further, "agencies are not permitted to waive a third party's interest in protecting the records." Bagwell, 131 A.3d at 650.

With these foundations in hand, we turn to the issues upon which we granted allocatur.

B. Appeal of the Department — RTKL Exemption Standards

The first issue that we will consider, raised by the Department, is whether the Commonwealth Court failed to create a workable standard for dealing with repetitive redactions in the absence of statutory guidance. Initially, the Department stresses the difficulties that government agencies face when confronted with third-party trade secret and confidential proprietary information redactions under the RTKL. The Department points to a lack of guidelines to address these redactions, noting that, without regulations, resolution of the redaction process has been determined through fact-specific litigation. The Department offers that it has consistently taken the position that it is unable to unilaterally assess and determine the propriety of redaction of trade secret and confidential and proprietary information. According to the Department, only the owner of the trade secret can identify and assert the secrecy or confidentiality of records. Related thereto, the Department also argues that the Commonwealth Court's opinion places the Department "in the impossible position of having to affirmatively declare whether certain records constitute a trade secret or confidential proprietary information, despite the fact that [it is] not permitted to waive a third party's interest in protecting its records." Department of Health Brief at 13 (citation omitted).

The Department maintains that this is an unworkable standard that forces it to make decisions on highly technical material when it lacks the resources to do so, and, according to the Department, only the individual applicant understands what constitutes a trade secret. Here, the Department allowed all applicants to defend their redactions, and, as the inquiry focuses on whether the information contained a secret of peculiar importance to the business, and of competitive value to the owner, it was the successful applicants who were better suited to object to certain disclosures, rather than the government agency overseeing the industry. The Department complains that governmental agencies face an unfair burden when faced with third-party assertions of a trade secret or proprietary information exemption, as they must make definitive determinations regarding highly technical information without the necessary tools. The Department argues that the Commonwealth Court should have permitted the parties to supplement the record, and asks this Court to remand to the Commonwealth Court with instructions to permit supplementation of the record.16

Appellees maintain that the Commonwealth Court properly placed the disclosure duty and burden of proof on the Department, citing various statutory provisions discussed above, including 65 P.S. § 67.901, which obliges the implicated agency to make a good faith determination about whether the requested record is a public record and to make any determinations regarding the validity of asserted exemptions. Appellees also offer that the Commonwealth Court correctly rejected the Department's attempt to shift the burden of proof to Applicants, as to do so would be inconsistent with the terms of the RTKL. Related thereto, Appellees contend that supplementation of the record is not warranted here, as the Department and Applicants received a full and fair opportunity, indeed, numerous opportunities, to participate and to submit evidence and argument before the OOR. Specifically, Appellees note that, after finding that the Department failed to independently review Applicants' redactions, and that the applications had been inconsistently redacted, the OOR issued a stay to allow the Department and Applicants more time to review the applications, issue revised responses, and provide exemption logs. Appellees point out that, after receiving submissions, as well as the Department's notification that it did not independently review Applicants' redactions, but was deferring to the OOR as fact finder, the OOR gave Applicants additional time to supplement the record, during which only Terrapin made an additional submission. Indeed, Appellees emphasize that Applicants received "extraordinary due process" during the OOR proceedings, and that the Commonwealth Court properly found that that the Department and Applicants had a full and fair opportunity to support their redactions and to participate in the OOR proceedings. Appellees Brief at 17, 24. According to Appellees, the Commonwealth Court's decision was a straightforward application of existing substantive and procedural law.17

We initially note that Appellees made a request for certain successful applications submitted under the Medical Marijuana Act, which were expressly classified as public records under the terms of that statute, and, thus, subject to the RTKL. Under the plain language of the RTKL, the Department was the agency charged with responding to Appellees' RTKL request, and, as such, bore the sole burden of granting access to that information that was subject to disclosure, and supporting any grounds for denial of any information that was exempt or privileged. That a third party may be best suited to provide the most detailed proof of an exemption does not relieve an agency of its statutory burden.

Based upon the language of the Medical Marijuana Act and the RTKL, we reject any attempt by the Department to shift this burden of analysis, assessment, and either disclosure or redaction to third parties. This is particularly true here, as an agency's duty of disclosure may conflict with a private party's interest in the protection of information. Furthermore, simply because a request under the RTKL is for a large number of records does not mean that agency is excused from performing its statutory mandate to determine whether exemptions apply. See Pennsylvania State System of Higher Educ. v. Ass'n of State College and University Faculties, 142 A.3d 1023, 1031 (Pa. Cmwlth. 2016). Rather, a governmental agency, as the Department did here, may request an extension of time in which to comply with a RTKL request.

Here, the Department did not fulfill its statutory mandate by independently reviewing Applicants' redactions. Indeed, it did not even review the unredacted versions of the applications. Rather, the Department allowed Applicants to redact any information they deemed to be proprietary, confidential, or otherwise subject to redaction, and, as noted above, merely added its own redactions, resulting in widely varying redactions for similar information. Moreover, it created the potential for unreviewed over-redaction. Simply stated, to effectuate the mandate of the RTKL and its underlying purposes, a government agency cannot blindly defer to the determinations of private entities as to what information is exempt from disclosure under the RTKL.

We fully appreciate the magnitude of the task of reviewing Applicants' submissions, including both the difficult job of discerning whether certain information constitutes security-related information, trade secrets, or confidential proprietary information, as well as the voluminous nature of the applications. Furthermore, we are cognizant of the unique nature of the nascent medical marijuana industry in our Commonwealth. Nevertheless, the language of the RTKL is plain and unambiguous, placing the burden and responsibility on the governmental agency to independently evaluate and discern the validity of claimed exemptions to disclosure in the first instance, including those made by third parties. Thus, in responding to a RTKL request, we emphasize that a government agency may not delegate its disclosure duties or defer to the redactions of third parties.

Here, the Department's failure to independently review Applicants' redactions was not in accord with the mandate of the RTKL, neither at the request stage, nor later during the administrative phase before the OOR. Thus, we reject the Department's request to alleviate it of its burden to independently review what records are subject to disclosure, or exempt from release. While the Department indicated that it was deferring to the OOR's fact-finding to determine the propriety of the asserted exemptions, and suggested in camera review or the submission of affidavits, the RTKL simply does not generally permit this type of delegation.

Additionally, we reject the Department's request for supplementation of the record. We note that the Department received numerous opportunities to submit evidence and argument before the OOR, and chose not to take advantage of those opportunities. Indeed, the Department largely failed to take advantage of the stay the OOR issued to allow the Department additional time to review the applications and provide revised responses. Instead of fulfilling its statutory mandate, it notified the OOR that it again did not independently review Applicants' redactions, but was deferring to the OOR. Accordingly, we reject the Department's request to be relieved of its obligations under the RTKL, as well as its request to supplement the record, and affirm the Commonwealth Court's decision in this regard.

C. Appeal of Harvest — Similar Treatment of Applicants

The second issue we consider, raised by Harvest, is whether the Commonwealth Court erred in treating similarly-situated applicants differently on the same record. Harvest suggests that, in cases where, as here, the evidence presented applies industry-wide, the OOR, in the first instance, should have considered the record as a whole when considering exemptions under the RTKL, rather than finding that Applicants are entitled to varying degrees of protection. That is, according to Harvest, despite varied submissions by Applicants, evidence of industry practice should sufficiently support exemptions for all of them. Related thereto, Harvest asserts that public policy supports establishing uniform redactions across the applications in this case, as, otherwise, the Department will be required to comb through thousands of pages of applications just to determine whether a single redaction is appropriate.

In support of its exemptions, Harvest emphasizes that it is not performing a governmental function, and that its relationship with the Department concerns only the submission and approval of its application. Thus, according to Harvest, because third-party information has been submitted to a governmental agency, the RTKL's disclosure requirements should be narrowly construed and its exemptions broadly construed. Harvest continues, contending that the uniquely competitive nature of the medical marijuana industry, as well as the significant effort and funds expended in developing, arranging, and presenting the extensive information in its application, establish that the application itself is a trade secret containing confidential information, even without sworn testimony. Harvest suggests that allowing disclosure of the application would cause it to suffer a substantial competitive disadvantage because competitors could simply copy the information from its application to obtain their own permits. In support thereof, Harvest stresses the measures taken to prevent disclosure of its application, including limiting access, password protected electronic storage of information, and confidentiality agreements for employees, contractors, and other third parties.

Alternatively, Harvest argues that, even if the entire application does not constitute a trade secret, the application nevertheless contains trade secrets as well as confidential proprietary information that is customarily, and actually, treated as private. Thus, Harvest submits that such information should be exempt from disclosure. Harvest also claims that its application contains security information that should be exempt from disclosure under the RTKL. Harvest argues that, despite the Commonwealth Court finding that Terrapin's affidavits supported security-related redactions, it improperly allowed only Terrapin to redact such information. According to Harvest, where consideration of the record as a whole, including industry-wide evidence, would support security-related redactions, then such redactions should be applied uniformly to all applicants, and such security-related information should be uniformly exempt from disclosure.

Finally, Harvest emphasizes that, in cases where the record is insufficient to determine whether the requested material is exempt from disclosure, the Commonwealth Court may permit the parties to supplement the record with additional evidence. Harvest maintains that, due to the unique nature of the medical marijuana industry, as well as the fact that this is a case of first impression, the Commonwealth Court should have permitted the parties to submit additional evidence in support of their redactions. Harvest suggests that this was particularly appropriate in this case given that the OOR did not conduct a hearing on this matter or an in camera review of the evidence. Thus, Harvest asserts that, in the interest of justice, this Court should remand for further fact-finding if our Court finds the current record inadequate.

Appellees initially contend that, as a general matter, Harvest's assertions regarding the unique nature of the medical marijuana industry do not justify the broad scope of its redactions, and they suggest that such information has already been disclosed to the public via other applications which were redacted far less than the applications at issue in the instant case. Appellees additionally argue that the applications are not exempt in their entirety as trade secrets or confidential proprietary information, as the Medical Marijuana Act explicitly provides that the applications are public and subject to the RTKL. See 35 P.S. § 10231.302(b)(1). In this regard, Appellees maintain that Harvest cannot credibly assert that it intended to keep secret or confidential the entire contents of its application made public by the RTKL. Appellees further emphasize that each Applicant bears the burden of establishing that the contents of their respective applications are exempt. They point out that, while the Commonwealth Court credited Terrapin's affidavit in concluding its processes to cultivate and manufacture marijuana products were trade secrets, such information did not establish that other Applicant's applications, including Harvest's, contained such information. Likewise, Appellees note that the Commonwealth Court held that Terrapin's affidavit established the first prong of the trade secrets exemption for all successful applicants. However, Appellees highlight that the court found that Harvest failed to submit evidence of the competitive value of the information or efforts taken for maintaining its secrecy, and, thus, due to this lack of evidence, the Commonwealth Court properly determined that Harvest did not prove that its redactions constituted trade secrets or confidential proprietary information.

Indeed, Appellees assert that, with respect to Harvest's argument that the Commonwealth Court's opinion treated similarly-situated Applicants differently based on the same record, Appellees maintain that Applicants are responsible for any disparity in the results below, as Harvest redacted dramatically more information than other applicants. Moreover, Appellees point out that Terrapin provided far more detailed evidence than the other applicants, including Harvest, in support of its redactions. Appellees further maintain that there is no basis on which to conclude that Terrapin's evidence represents an entire industry. Additionally, with respect to Harvest's attempt to assert that its information was exempt from disclosure under the confidential proprietary information exemption, Appellees argue that Harvest merely provided an exemption log in support of its claim, which offered no information with respect to how it maintains the confidentiality of the redacted information or the alleged harm resulting from disclosure.

Finally, Appellees maintain that the Commonwealth Court did not abuse its discretion in refusing to allow Applicants to supplement the record because adequate due process was afforded to them during the administrative process before the OOR. Appellees argue that Harvest has offered no legitimate justification why a remand to supplement the record is necessary, and they claim that "[i]t is time to bring an end to the unreasonable three-year delay to access of information in [a]pplications made expressly public by the Act." Appellees' Brief at 28.

Initially, we reject Harvest's sweeping assertions that, because it is not performing a governmental function, and because an application containing third-party information submitted to a governmental agency is at issue, the RTKL's disclosure requirements should be narrowly construed, and its exemptions broadly construed. There is simply no authority supporting Harvest's novel suggestion of reversing the RTKL's presumption of disclosure and narrow construction of exemptions. The RTKL, by its plain terms, as well as our case law, holds to the contrary. See 65 P.S. § 67.301; ACLU, 232 A.3d at 656. Likewise, we dismiss Harvest's claim that, in this instance, because of the uniquely competitive nature of the medical marijuana industry, its application, in toto, is a trade secret containing confidential information. As offered above, by its plain terms, the RTKL mandates the disclosure of records in the possession of a government agency unless an exemption applies, 65 P.S. §§ 67.305(a), 67.701, and, under the Medical Marijuana Act, applications filed with the Department are expressly deemed to be public records. 35 P.S. § 10231.302(b).

Turning to Harvest's assertion that, where evidence contained in the record as a whole implicates the entire industry, it should apply to every applicant, we first note that the governmental agency asserting an exemption bears the burden of proving that exemption applies. See 65 P.S. § 67.901 (placing duty on agency to make determination whether requested record is subject to disclosure). If the agency denies a request asserting an exemption from disclosure, the RTKL provides an opportunity for a third party to defend its claim before the OOR. Id. § 67.1101(c)(1). Related thereto, the agency or third party must prove a RTKL exemption applies "by a preponderance of the evidence." Id. § 67.708(a)(1). Thus, again by its terms, the RTKL places the burden of disclosure, or proving an exemption from disclosure, on the governmental agency and individual third parties. Additionally, we find nothing in the RTKL that would mandate in every circumstance the collective use of information to establish an exemption. Moreover, such a collective use requirement would be contrary to legal processes in general, which require parties to offer competent evidence to establish their claims.

Rather than mandating application of all record evidence for each alleged exemption, we believe that it is within the discretion of the OOR or the Commonwealth Court to give broader significance to the record as a whole when it relates to industry-wide issues. Indeed, in this matter, the Commonwealth Court applied certain information used by one applicant to satisfy a requirement for an exemption for every applicant, and for other requirements found individualized support was necessary. Specifically, as the Commonwealth Court explained, three parties submitted evidence to prove their asserted exemptions: the Department, Cresco, and Terrapin. As noted above, the Department submitted an affidavit and logs, Cresco submitted an affidavit, and Terrapin submitted multiple affidavits. By contrast, KW Ventures, Harvest, and Mission did not submit evidence. Thus, the Commonwealth Court concluded, as a general matter, that the redactions of these latter entities' applications were unsubstantiated, except to the extent the proffered evidence applied to every applicant.

Even more to the point, regarding the facility security exemption, the Commonwealth Court noted that, while certain parties failed to submit evidence, the Department's logs, as well as the record as a whole contained dangers unique to the medical marijuana industry, and, thus, applied these industry-wide risks to every applicant. Mission Pennsylvania, 212 A.3d at 135.

Conversely, with respect to the trade secret exemption, the court determined that the OOR properly applied the trade secret exemption only to Terrapin, and correctly found the confidential proprietary information exemption inapplicable to every applicant. Rather than rejecting outright any exemption by those applicants who offered no evidence to substantiate their exemptions, the court reviewed the evidence as to each applicant when considering whether they satisfied the exemptions. With respect to the trade secret exemption, the court, finding Terrapin's presentation to be exemplary, determined that its affidavits sufficiently established that the processes described therein were trade secrets, and extended that record evidence to similar processes described by the other applications. Thus, the court concluded that the affidavits submitted by Terrapin satisfied the first prong of the trade secret exemption for every applicant. Nevertheless, the court concluded that only Terrapin could avail itself of the exemption because it was the only party that submitted evidence of its reasonable efforts to maintain the secrecy of its processes, a necessary second component in establishing trade secret status — and requiring individualized assessment. Accordingly, the court affirmed the OOR's application of the trade secrets exemption to only Terrapin. Similarly, as to Applicants' alleged exemption for confidential proprietary information, the court concluded that none of the Applicants established the exemption, emphasizing that "[t]he measures undertaken to maintain secrecy of the information are important indicators of its confidential nature." Id. at 137. This assessment, consistent with court's trade secret analysis, required individualized evidence of each applicant's efforts in this regard. Id. As no applicant other than Terrapin submitted evidence regarding these steps to maintain secrecy, the applicants other than Terrapin failed to establish the confidential nature of the information.

In light of the above, we hold that the Commonwealth Court properly analyzed the exemptions to disclosure under the RTKL, and did not abuse its discretion in finding certain information to be industry-wide in nature, and, thus, applicable to all applicants, and other information to be applicant-specific, necessitating individualized assessment. This is especially true with respect to efforts to maintain the secrecy of information, which would necessarily differ by applicant. These are individualized determinations, which the Commonwealth Court properly recognized required individualized evidence to support.

While the RTKL does not prohibit the use of industry-wide information to support an exemption for similarly-situated individuals, it also does not mandate its use in all instances. Indeed, to adopt Harvest's approach would place the primary burden on the OOR or the Commonwealth Court to discern the applicability of evidence to similarly-situated entities, and would stand on its head the burden the RTKL places on the agency and individual third parties to establish exemptions from disclosure. Related thereto, we reject the assertion that requiring individualized proof of exemption, especially with respect to security, would jeopardize and harm the public. Rather, requiring individual applicants to meet their burden upholds the plain language of the RTKL and the Medical Marijuana Act. Here, Harvest offered no evidence; yet, it benefitted from certain industry-wide evidence, through the introduction of evidence of others, in support of its claimed exemptions. However, because it provided no evidence regarding other matters requiring individualized proof, and no explanation for its failure to do so, the Commonwealth Court properly denied such exemptions.

Finally, we reject Harvest's request for a remand for additional fact-finding. The Commonwealth Court properly determined that it is the parties' burden to submit evidence to establish material facts. To the extent Harvest believes that the record is inadequate, we find that it had a full opportunity to participate in the proceedings and to provide evidence and argument to the OOR. Indeed, the OOR allowed Harvest additional time to do so after Appellees highlighted the deficiencies in the Department's and Applicants' prior submissions, yet only Terrapin offered additional proofs. Harvest offered no reason for neglecting to submit its own evidence. While the Commonwealth Court or the OOR may permit the introduction of additional evidence, conduct a hearing, or engage in in camera review of information, herein, we find the OOR allowed for ample notice, time, and opportunity for Harvest to develop its record in support of its claim of exemptions. Id. at 130.

We observe that allowing evidence to be supplemented at each stage of the proceedings undercuts the RTKL's goals of openness and providing expedient access to information. To allow a party to initially withhold evidence, but then introduce new evidence at later stages of the proceedings, would significantly delay the disclosure of often time-sensitive information, as well as frustrate the underlying policy of the RTKL. Thus, we conclude that the Commonwealth Court did not abuse its discretion in declining to permit Harvest to provide supplemental evidence or to remand to OOR to reopen the record.

D. Appeal of Terrapin — Confidential and Proprietary Information

Finally, we address the issue raised by Terrapin as to whether the Commonwealth Court, in considering whether the financial information submitted in an application under the Medical Marijuana Act was confidential and proprietary, erred by disregarding evidence of competitive harm and the significant security issues associated with the disclosure of financial information in the cash-based medical marijuana industry.

Initially, Terrapin stresses that the medical marijuana industry is atypical. Terrapin explains that, under the federal Controlled Substances Act, 21 U.S.C. §§ 801 et seq., the cultivation, possession, and distribution of marijuana is illegal. As a consequence of the federal restrictions on the use of marijuana, the industry, which is legal in various states, like Pennsylvania, is cash-based. Because marijuana is illegal at the federal level, the United States Department of the Treasury and Department of Justice have provided guidance to financial institutions that service state marijuana businesses. Terrapin offers that the federal guidelines for financial institutions address public safety concerns for cash operating businesses. To comply with these guidelines, financial institutions that deal with the marijuana industry have compliance protocols for their customers' due diligence and "Suspicious Activity Reporting for `verified lawful transactions of a medical marijuana business and ongoing customer monitoring for business compliance.'" Terrapin Brief at 15 (quoting Coleman Affidavit at ¶ 19). Terrapin thus argues that the financial information submitted in its application falls within the confidential proprietary information and safety and security information exemptions to disclosure under the RTKL. According to Terrapin, it presented substantial, uncontested evidence that its financial information is confidential, that it has undertaken efforts to maintain its secrecy, and that its disclosure would result in competitive harm. Terrapin submits that disclosure of confidential financial information could negatively impact its banking relationships, jeopardize the financial security of the medical marijuana industry, and endanger the physical security of facilities and the public.18

Specifically, Terrapin emphasizes that the financial information that it submitted to the Department does not deal with the Department's receipt or disbursement of funds, or with the Department's acquisition, use, or disposal of services, supplies, materials, equipment, or property, which would be subject to disclosure. Thus, Terrapin contends, the information is not a "financial record" under the RTKL.19 Rather, Terrapin offers that its financial information was submitted to the Department to demonstrate that Terrapin was financially responsible and capable of establishing and operating a facility.

Terrapin further contends that it presented substantial and uncontested evidence to the OOR in the form of its Coleman Affidavit, noted above, detailing competitive and security concerns with respect to disclosure of its financial information, including that Terrapin has developed unique industry-specific business practices that were proprietary in nature. Terrapin also submits that the Coleman Affidavit explained that, because the medical marijuana industry is entirely cash-based, Terrapin must maintain strict confidentiality with regard to its financial and security protocols in order to protect the stability of its banking services, and protect against robbery and injury to its staff and customers. Moreover, Terrapin adds that it has put measures into place to ensure the confidentiality of its financial information. Thus, Terrapin asserts that it established that its financial information was exempt as confidential proprietary information, 65 P.S. § 67.708(b)(11), and as implicating security concerns, id. § 67.708(b)(3).

Terrapin criticizes the OOR for considering only whether Terrapin had presented evidence that its financial information was confidential and disregarding its evidence related to security concerns as "not relevant to the exception at hand." OOR Final Determination at 33. While recognizing that the Commonwealth Court below found that the evidence supporting the confidential proprietary information and safety and security information exemption under the RTKL may be intertwined, Terrapin maintains that the court failed to address the limited nature of the OOR's review and did not consider the safety implications of disclosure. Terrapin also challenges the Commonwealth Court's failure to address the OOR's error in this regard and requests either reversal of the Commonwealth Court's decision or a remand for in camera review by the OOR of the information regarding nondisclosure.

As noted above, Appellees reject any sweeping assertions regarding the cash-based nature of the medical marijuana business as allowing for extensive redactions, and emphasize that the applications are not exempt in their entirety as trade secrets or confidential proprietary information, as the Medical Marijuana Act explicitly provides that the applications are public and subject to the RTKL. Additionally, Appellees underscore that Applicants bear the burden of establishing that the contents of their applications are exempt, and submit that Terrapin did not prove that its financial information constituted confidential proprietary information falling within the exemption. Specifically, Appellees note that, to establish the existence of confidential proprietary information, Terrapin needed to establish actual competition in the relevant market and a likelihood of substantial injury upon the release of the information. According to Appellees, the Commonwealth Court routinely upholds exemptions for trade secrets and confidential proprietary information when a third party submits an affidavit to the OOR with facts supporting each element of the exemption. Appellees maintain that Terrapin did not meet its burden in this regard, as the fact that the medical marijuana industry is extremely competitive does not, by itself, substantiate Terrapin's extensive redactions.

Initially, we reject Terrapin's assertion that its financial information is not a "financial record" and, thus, not subject to disclosure under the RTKL. Again, by its clear terms, the Medical Marijuana Act provides that "[a]pplications for permits submitted by medical marijuana organizations" are "public records and shall be subject to the [RTKL]." 35 P.S. § 10231.302(b)(1). Thus, regardless of whether the information contained therein also constitutes a "financial record" under the RTKL, applications are, by definition, public records for purposes of the RTKL.20

However, as to the OOR's and the Commonwealth Court's analysis of Terrapin's asserted exemptions, we find that the lower tribunals failed to recognize the potentially intertwined nature of financial information and safety and security information in a nascent, uniquely cash-based, and highly competitive industry such as that for growing, processing, and dispensing medical marijuana. Here, Terrapin's Coleman Affidavit described not only the potential impact of the disclosure of financial information on the physical security of its facilities, including an increase in robberies and burglaries, and threats or injury to staff and customers, but the potential impact upon the stability of its banking relationships.

Furthermore, the OOR disclosed the information without conducting in camera review or otherwise evaluating the basis of the claimed exemption. Rather than considering both the confidential nature of the financial information and the safety and security concerns regarding its disclosure, the OOR rejected any safety and security concerns, finding they were "not relevant to the exemption at hand." OOR Final Determination at 33. Similarly, we conclude that the Commonwealth Court failed to appreciate the security-related reasons for exemption of Terrapin's financial information from disclosure. While the burden is on the governmental agency or the third-party entities to raise and defend all of their proffered exemptions from disclosure, once a party raises and supports an exemption, it is the duty of the OOR, and then the Commonwealth Court, to review the various proffered reasons for nondisclosure and determine their validity, based upon a preponderance of the evidence.

Related thereto, in ACLU, supra, we recently explained that, under the RTKL, the reviewing court — here, the Commonwealth Court — is the ultimate finder of fact, enjoys the broadest scope of review, and retains plenary authority to expand the record beyond that developed before the OOR. ACLU, 232 A.3d at 663-64. Indeed, we emphasized the availability of in camera review as a valuable tool to discern the propriety of a claimed exemption to disclosure, and that our Court has "blessed" such review to consider application of various privileges. Id. at 665-66, 669.

We find that, after Terrapin supported its proffered exemptions regarding disclosure of confidential financial information, citing to competitive harm and security implications with affidavit and argument — indeed, in a presentation the Commonwealth Court found to be exemplary — it was incumbent upon the OOR, and, ultimately, the Commonwealth Court, to consider the alleged exemptions applicable to such financial information, to review the information at issue — in camera if beneficial — and to fully consider the reasons proffered to support exemption from disclosure. See id. at 669-70; Office of Open Records v. Center Township, 95 A.3d 354, 367 (Pa. Cmwlth. 2014) (noting authority of OOR to conduct in camera review to render a reasoned decision); Office of the Governor v. Bari, 20 A.3d 634, 648 (Pa. Cmwlth. 2011) (offering that OOR should "take all necessary precautions" including in camera review, when considering a claim of confidential proprietary information). Thus, we find that the lower tribunals' failure to do so constituted an abuse of discretion.

As a result, we hold that the OOR and the Commonwealth Court did not appreciate the potentially intertwined nature of confidential financial information and safety and security information in the medical marijuana industry, and did not fully consider whether Terrapin's assertions regarding its financial information satisfied the confidential proprietary information and facility security exemptions. Accordingly, we remand to the Commonwealth Court for reconsideration of this matter.

IV. Conclusion

Thus, for the above-stated reasons, we affirm the Commonwealth Court's decision in two aspects. First, in light of the plain language of the RTKL, we agree the court properly rejected the Department's request to be relieved of its obligations to review all requests and determine what parts of a record are subject to disclosure and what parts are subject to redaction, as well as its request to supplement the record. Second, we agree the court properly rejected Harvest's contention that, because it is not performing a governmental function, the RTKL's disclosure requirements should be narrowly construed, and its exemptions broadly construed, and its assertion that its entire application should be deemed to be exempt from disclosure. Additionally, we find that the Commonwealth Court properly considered Harvest's claimed exemptions to disclosure under the RTKL, and did not abuse its discretion in finding certain information to be industry-wide in nature, and, thus, applicable to all applicants, including Harvest, and other information to be applicant-specific, necessitating individualized assessment.

We vacate, however, the Commonwealth Court's decision with respect to Terrapin's claim that it presented sufficient evidence that detailed competitive and security concerns with respect to disclosure of its financial information. We find that, after Terrapin supported its proffered exemptions regarding the disclosure of confidential financial information, citing to competitive harm and security implications with affidavit and argument, it was incumbent upon the OOR, and, ultimately, the Commonwealth Court, to consider the alleged exemptions applicable to such financial information. Additionally, we find that it was necessary for the OOR, and ultimately, the Commonwealth Court, to review the information at issue — in camera if prudent — and to consider fully the reasons proffered by Terrapin to support its claimed exemptions from disclosure. Thus, we remand this matter regarding Terrapin to the Commonwealth Court for reconsideration in this regard.

Accordingly, we affirm in part, vacate in part, and remand for proceedings consistent with our decision today. Jurisdiction relinquished.

Chief Justice Baer and Justices Saylor, Donohue, Wecht and Mundy join the opinion.

Justice Dougherty files a concurring opinion.

JUSTICE DOUGHERTY, concurring.

I agree substantially with the majority's careful unravelling of the thorny and intertwined issues before us in this case. Specifically, I fully join the majority's analysis with the sole exception of its discussion of financial information in Section (III)(D). Although I concur with the majority's resulting vacatur and remand of the issue with instructions for the lower tribunals, as well as its encouragement of the use of in camera review, see Majority Opinion at 412-14, I write separately to underscore a particular feature of the Right-to-Know Law (RTKL), 65 P.S. §§ 67.101-67.3104, as this Court has interpreted it which, though overlooked by the parties and the lower tribunals, nevertheless impacts proper review of Terrapin's financial information in this case. I believe it poses a plausible conflict between the majority's analysis and our decision in Dep't of Pub. Welfare v. Eiseman, 633 Pa. 366, 125 A.3d 19 (Pa. 2015).

In the forefront of its analysis of this issue, the majority flatly rejects Terrapin's assertion the financial information contained in its application is not a "financial record" as the term is defined under the RTKL. See Majority Opinion at 411. In doing so, the majority views whether Terrapin's financial information also constitutes a "financial record" under the RTKL as immaterial because, pursuant to the Medical Marijuana Act, all permit applications are by definition "public records" subject to the RTKL. See id.; 35 P.S. § 10231.302(b)(1). However, although RTKL-defined "financial records" are one category of "public records" subject to disclosure, see 65 P.S. § 67.102 (definition of "public record" includes "a financial record"),1 the particular treatment of a financial record under the RTKL is more nuanced than the general category of public records. Our distinctive treatment of financial records has repercussions regarding the particular exemptions at issue on remand.

As the majority describes, RTKL subsection 708(b) enumerates specific exceptions which, if their criteria are met, exempt a presumed-public record from disclosure; these provisions include the exemptions claimed by Terrapin to support redaction of the financial information in their application, i.e., the facility security exemption described in subsection 708(b)(3), and the confidential proprietary information exemption described in subsection 708(b)(11). See Majority Opinion at 400-01; 65 P.S. § 67.708(b)(3), (11). However, the exemptions listed in subsection 708(b) only apply "[e]xcept as provided in subsections (c) and (d)," and subsection (c) curtails the extent to which the exemptions apply to financial records. 65 P.S. § 67.708(b), (c). In relevant part, subsection (c) provides, "[t]he exceptions set forth in subsection (b) shall not apply to financial records, except that an agency may redact that portion of a financial record protected under subsection (b)(1), (2), (3), (4), (5), (6), (16) or (17)." Id. (emphasis added). In Eiseman, we observed the confidential proprietary information exemption — subsection 708(b)(11) — was not one of the enumerated exceptions to subsection 708(c), which therefore "render[ed] the [Right-to-Know] Law's own internal tradesecrets/confidential-proprietary-information exception inapplicable" even where competent evidence demonstrated the criteria under subsection 708(b) was otherwise met. Eiseman, 125 A.3d at 32; see id. at 32 n.12 ("confidential proprietary information within financial records is subject to public disclosure under the [RTKL]"). Thus, a "financial record" is a public record not exempt from disclosure, but may be redacted only if information it contains meets the criteria of those exemptions enumerated in subsection 708(c). See id.

Notably, and relevant to this case, pursuant to RTKL subsection 708(c), a financial record may be redacted if its disclosure creates a reasonable likelihood of endangering facility safety as provided in subsection 708(b)(3), but not if it constitutes confidential proprietary information as provided in subsection 708(b)(11). Thus, in my view, whether Terrapin's financial information is a "financial record," as the RTKL defines the term, may not be material to a determination of whether the information is presumed public, but it does matter to a determination of whether the claimed exemptions apply, and should not be discounted in our analysis. If the information is a financial record, as the majority appears to conclude by its rejection of Terrapin's argument to the contrary, no amount of competent evidence can support the redaction of confidential proprietary information. Instead, Terrapin's financial information may be redacted only in a manner consistent with the facility security exception in subsection 708(b)(3). See Eiseman, 125 A.3d at 32; 65 P.S. § 67.708(c).

To that end, the RTKL defines a "financial record" as "[a]ny of the following:"

65 P.S. § 67.102 (emphasis added). In Eiseman, we explained the term "financial record" was not limited to an agency's records of its own transactions, but also included records "dealing with" the agency's monetary disbursements via its contractors performing delegated governmental functions. See Eiseman, 125 A.3d at 29 ("`financial records' encompass records `dealing with' disbursements of public money and services acquisitions by agencies"); id. at 32 (records submitted to government agency for approval "which embody a delegation (albeit a downstream delegation) of a governmental function" are records "`dealing with' the agency's monetary disbursements and services acquisitions"). Here, Terrapin is a third-party permit applicant, not a contractor or subcontractor performing any delegated government function. In addition, as the majority relates, medical marijuana permit applicants are required by the terms of the Medical Marijuana Act to include in their applications, inter alia, the identity of and other information regarding their financial backers, a description of their business activities, activities in other jurisdictions, ability to obtain sufficient land and facilities for operation, and ability to maintain effective security. See Majority Opinion at 398-99 n.14 (setting forth medical marijuana permit application requirements pursuant to 35 P.S. § 10231.602). At least facially, none of these requirements appear to deal with disbursements of public money, and Terrapin asserts no such agency transactions are contained in its financial information. See Terrapin's Brief at 17-20, 27-28 n.23-24, 32.

Accordingly, in my view, Terrapin's claim the financial information contained in its permit application is not a "financial record" as defined by the RTKL has some merit. Yet, as the majority concludes, and I agree, absent integral fact-finding by the lower tribunals, we are constrained to remand the issue of whether the information could properly be redacted under RTKL subsection 708(b)(3) or (11). However, for the foregoing reasons, I view a determination of whether the financial information constitutes a "financial record" as an integral preliminary step to implementing the majority's directive "to review the information at issue — in camera if prudent — and to consider fully the reasons proffered by Terrapin to support its claimed exemptions from disclosure." Majority Opinion at 413.