Since the inception of the Payroll Protection Program to provide struggling businesses with loans under the CARES Act, the public and the media have been clamoring for information on who has received the loans. Controversies over a few acknowledged recipients, including Shake Shack and the Los Angeles Lakers, highlighted the lack of information about others. And in May, five prominent media outlets sued the Small Business Administration under the Freedom of Information Act for access to information about PPP loan recipients.

Perhaps bowing to intense public pressure and complaints from Congress, on July 6 the U.S. Treasury and the SBA released the identity of all recipients who received loans over $150,000. For each borrower, SBA data includes the business name and address, business type and structure (corporation, nonprofit, etc.), self-reported demographic data, number of jobs supported by the business, and the lender.

While the effort to foster transparency is laudable, the decision to limit disclosure to borrowers receiving loans over $150,000 leaves a large amount of information undisclosed. While the Treasury noted that its disclosure covers nearly 75% of the total funds loaned under the program, it neglected to point out that it reveals only about 25% of the borrowers. The public will remain in the dark as to three-quarters of the entities who received PPP loans.

Does the SBA have a basis under FOIA to limit its disclosure to loan recipients above $150,000? Most likely not. FOIA imposes a presumption of disclosure unless an agency can show that the information sought is protected by a specific FOIA exemption. Although the government may invoke several exemptions, it will face significant problems justifying the exemptions' application to PPP loan information.

The two FOIA exemptions that might conceivably apply to the identity of PPP loan recipients are Exemption 4 (governing trade secrets and confidential financial information the government obtains from outside persons), and Exemption 6 (governing records whose release will cause an unwarranted invasion of personal privacy). But neither exemption seems to apply here.

Exemption 6 can be easily dismissed in this context. That exemption covers information that would cause an "unwarranted invasion of personal privacy." As the language suggests, it covers only individuals and not corporations or business entities. So, while the SBA can rely on this exemption to justify withholding the names of employees and the home addresses of business owners, it cannot do so with respect to withholding the identity of businesses and nonprofit entities that received loans.

Exemption 4 is more complicated. The exemption allows agencies to withhold "trade secrets and commercial or financial information obtained from a person and privileged or confidential." One can imagine quite a bit of confidential information from a borrower that would find its way to the SBA in conjunction with the PPP loan process: the application itself contains confidential financial information about each business.

But is the mere identity of the recipient confidential financial information covered by Exemption 4? One might argue that revealing the fact that a particular business received a PPP loan shows something about its financial situation and therefore ought to be kept secret. Or perhaps revealing borrowers' identity will discourage small businesses from applying for future PPP (or similar) loans. The problem, however, is that this information concerns a decision by the government to back a loan.

However "confidential" one might deem the information, courts will likely conclude that it was not "obtained from a person" as required by Exemption 4. The Second Circuit Court of Appeals, for instance, has held that information concerning "discount window" loans made by the Federal Reserve Bank was not "obtained from a person" because it involved actions taken by the government (in granting the loan). That reasoning applies here: while the loan applications undoubtedly contain confidential information obtained by a person (the person applying on behalf of the business), merely identifying the entities that received SBA-backed loans reflects government action rather than information obtained from a source outside the government.

The government may argue courts outside the Second Circuit should reach a different result. The D.C. Circuit has not addressed the issue in the context of loans, but the court has held that line-item pricing in a government contract is protected by Exemption 4. Or perhaps the government will argue that this instance does not involve a government decision but rather one made by the bank that handled the loan.

But any such arguments will be hard to square with the SBA's decision to release the list of borrowers that received over $150,000. SBA regulations require the agency to notify any "submitter" of information of a FOIA request for that information and to give the submitter a chance to object before the information is released. This obligation applies to any information "that may arguably be protected from disclosure under Exemption 4 of the FOIA." The SBA appears not to have given any of the borrowers recently identified an opportunity to object to disclosure. In releasing the current list of borrowers with loans over $150,000, the SBA either violated its own regulation or concluded that the information is not even "arguably" subject to Exemption 4. If information regarding borrowers who received large loans is not even arguably subject to Exemption 4, it is hard to see how the identity of borrowers with smaller loans would be covered.

The media lawsuit seeking information regarding PPP loan recipients is in its early stages, and one might expect additional litigation over FOIA requests filed by others. Given the SBA's actions to date, those who received loans under $150,000 should brace themselves for the likelihood that their identities will be released to FOIA requesters in the future.

Matthew Collette is a partner at Massey & Gail and formerly was deputy director of the appellate staff of the Civil Division at the Justice Department and senior counsel to the associate attorney general.